Documentation
¶
Overview ¶
Package rules implements Interseptor's rule-pack format: a signed-intent tarball of Starlark checks (passive and active) plus a manifest, so a community can author, share, install, and remove whole bundles of checks — the "OhMy" ecosystem layer over the per-check authoring API.
A pack is a .tar.gz containing:
manifest.json — name, version, author, entries[] with per-file sha256 checks/<id>.star — passive checks active-checks/<id>.star — active checks
Integrity: every file's sha256 is recorded in the manifest at build time and verified on read, so a corrupted or tampered pack is rejected before any check is written to disk. (Detached minisign/ed25519 signing is the next layer; the manifest+sha256 gate is the foundation it rides on.)
Index ¶
- Constants
- func ReadPack(r io.Reader) (Manifest, []File, error)
- type CatalogPack
- type Entry
- type File
- type InstallRecord
- type Manifest
- type Registry
- func (r *Registry) Get(name string) (InstallRecord, bool, error)
- func (r *Registry) InstallFile(path, checksDir, activeChecksDir string) (Manifest, int, error)
- func (r *Registry) InstallStream(rdr readSeekFree, checksDir, activeChecksDir, source string) (Manifest, int, error)
- func (r *Registry) List() ([]InstallRecord, error)
- func (r *Registry) Remove(name, checksDir, activeChecksDir string) (int, error)
Constants ¶
const ( KindPassive = "passive" KindActive = "active" )
KindPassive / KindActive are the two check categories a pack can carry.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type CatalogPack ¶
type CatalogPack struct {
Name string `json:"name"`
Version string `json:"version"`
Description string `json:"description"`
Author string `json:"author"`
Checks int `json:"checks"`
}
CatalogPack describes a bundled pack available for one-click install.
func ListCatalog ¶
func ListCatalog() ([]CatalogPack, error)
ListCatalog returns bundled packs (sorted by name) with check counts.
type Entry ¶
Entry is one check in a pack manifest: its category, id, and the sha256 of the file bytes — verified before install so a tampered file aborts the pack.
type InstallRecord ¶
type InstallRecord struct {
Name string `json:"name"`
Version string `json:"version"`
Installed string `json:"installed"`
Source string `json:"source,omitempty"`
IDs []string `json:"ids"`
}
InstallRecord is one pack the operator has installed: its manifest identity plus the check ids it owns (so `rules remove` can delete exactly those files).
type Manifest ¶
type Manifest struct {
Name string `json:"name"`
Version string `json:"version"`
Description string `json:"description,omitempty"`
Author string `json:"author,omitempty"`
Homepage string `json:"homepage,omitempty"`
License string `json:"license,omitempty"`
Created string `json:"created,omitempty"`
Entries []Entry `json:"entries"`
}
Manifest is the pack's front matter plus its file index.
func BuildCatalogPack ¶
BuildCatalogPack writes a verified pack tarball for the named catalog entry into w. Sources are embedded; install uses the same sha256 gate as community packs.
func BuildPack ¶
BuildPack writes a pack tarball to w from the checks found under srcDir (expected layout: srcDir/checks/*.star and srcDir/active-checks/*.star). The supplied meta fills the manifest's descriptive fields; entries + hashes are computed from the files. Files are written in a stable (sorted) order so two builds of the same source are byte-identical.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry tracks installed packs in <root>/packs/registry.json. It is the source of truth for `rules list` / `rules remove` and for the REST/MCP pack surfaces. Filesystem layout for installed checks: passive → <root>/checks, active → <root>/active-checks (same dirs the engines already read), so an installed pack's checks run immediately with everything else.
func NewRegistry ¶
NewRegistry opens (or creates) the pack registry rooted at root (the global interseptor data dir, e.g. ~/.interseptor).
func (*Registry) Get ¶
func (r *Registry) Get(name string) (InstallRecord, bool, error)
Get returns one installed pack by name.
func (*Registry) InstallFile ¶
InstallFile installs a pack from a local .tar.gz path.
func (*Registry) InstallStream ¶
func (r *Registry) InstallStream(rdr readSeekFree, checksDir, activeChecksDir, source string) (Manifest, int, error)
InstallStream reads a pack from r, verifies it, writes its checks to disk, and records it in the registry. source is stored for provenance (e.g. a URL).
func (*Registry) List ¶
func (r *Registry) List() ([]InstallRecord, error)
List returns installed packs, sorted by name.
Source Files