Documentation
¶
Overview ¶
Package attest writes attestations capturing evaluation results in the format chosen by the caller. It is the home for the signing pipeline that will turn ampel results into signed attestations — for now it covers the format dispatch and intoto statement construction so call sites that move to it today don't change shape when signing lands.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type FnOpt ¶
type FnOpt func(*attestOptions)
FnOpt configures a ResultsAttester. Passed to New, it sets instance-wide defaults; passed to AttestTo / AttestToFile, it overrides those defaults for that one call.
func WithFormat ¶
WithFormat selects the results-attestation format for the call. Must be one of verifier.ResultsAttestationFormats. Empty resolves to "ampel" at dispatch, so passing through an unset AttestFormat option is safe.
func WithPrettyPrint ¶
WithPrettyPrint controls JSON formatting of the unsigned attestation. The default is true (2-space indented output); pass false for a single-line compact form.
When a signer is configured via WithSigner this option is a no-op — the produced *signer.SignedArtifact serializes with the formatting dictated by its kind (sigstore Bundle: compact; DSSE envelope: indented).
func WithSigner ¶
WithSigner configures the attester to sign the produced attestation instead of writing the raw in-toto Statement. The output shape becomes the *signer.SignedArtifact's canonical JSON form (sigstore Bundle for the sigstore/SPIFFE backends, DSSE envelope for the key backend).
nil resets to the unsigned path — useful per-call to override an instance-level default set at New time.
type ResultsAttester ¶
type ResultsAttester struct {
// contains filtered or unexported fields
}
ResultsAttester writes a results attestation in the format chosen per call via WithFormat. The "ampel" format produces an in-toto statement carrying a predicates.ResultSet; "vsa" and "svr" route through their format-specific drivers.
FnOpts passed to New populate the attester's defaults; the same FnOpts passed to AttestTo / AttestToFile override those defaults for one call. A typical CLI configures once via New (e.g. with a pre-built *signer.Signer) and never overrides; library callers can stay stateless and pass options per call instead.
func New ¶
func New(opts ...FnOpt) *ResultsAttester
New returns a ResultsAttester with optional instance-level defaults. Pass FnOpts here when the same configuration applies to every call (typical CLI use); otherwise leave empty and pass options per call.
func (*ResultsAttester) AttestTo ¶
AttestTo writes the results attestation for results to w. The effective configuration is the attester's defaults overlaid with any per-call FnOpts. Splitting the writer- and path-based entry points keeps the dispatch testable without touching the filesystem.
func (*ResultsAttester) AttestToFile ¶
AttestToFile writes the results attestation for results to path, truncating any existing file. The file handle is closed before the call returns. Per-call FnOpts override any defaults set at New time.
Source Files