Documentation
¶
Overview ¶
Package attest checks that a release carries the GitHub artifact attestations its definition says it does.
Nothing about an attestation is visible in a release's asset list: it is held by GitHub, against the artifact's digest. A definition claiming an attestation that isn't there would produce a registry.json aqua can't install from, and — worse — a release that stopped being attested would otherwise look like any other.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Attestations ¶
type Attestations interface {
ListAttestations(ctx context.Context, owner, repo, subjectDigest string, opts *gogithub.ListOptions) (*gogithub.AttestationsResponse, *gogithub.Response, error)
}
Attestations is the part of GitHub's API that answers whether an artifact is attested.
type Checker ¶
type Checker struct {
// contains filtered or unexported fields
}
Checker asks GitHub whether an artifact is attested.
func (*Checker) Check ¶
func (c *Checker) Check(ctx context.Context, logger *slog.Logger, pkgName string, reg *generate.Registry) (bool, error)
Check drops the attestation from every asset that doesn't have one, and reports whether anything was dropped.
Only the assets whose definition claims an attestation are looked up, which is what keeps the cost off the packages that don't use them: a lookup is a request per asset, and a run generates far more assets than it could afford that for. A package gaining attestations is therefore not noticed here; whoever reviews its definition adds them, the same way it works in aqua-registry today.
A dropped attestation is a change the caller has to act on. It leaves the generated file honest — it says what can actually be verified — and the comparison against the version before it is what turns that into a pull request nobody merges by accident.
Source Files