v1

package
v0.5.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 7, 2026 License: Apache-2.0 Imports: 18 Imported by: 4

Documentation

Index

Constants

View Source 
const (
	SigstoreModeExact  string = "exact"
	SigstoreModeRegexp string = "regexp"
)

Variables

View Source 
var File_carabiner_signer_v1_identity_proto protoreflect.FileDescriptor
View Source 
var File_carabiner_signer_v1_matcher_proto protoreflect.FileDescriptor
View Source 
var File_carabiner_signer_v1_signer_proto protoreflect.FileDescriptor

Functions

This section is empty.

Types

type Identity 

type Identity struct {
	Id       string            `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Sigstore *IdentitySigstore `protobuf:"bytes,2,opt,name=sigstore,proto3,oneof" json:"sigstore,omitempty"`
	Key      *IdentityKey      `protobuf:"bytes,3,opt,name=key,proto3,oneof" json:"key,omitempty"`
	Ref      *IdentityRef      `protobuf:"bytes,4,opt,name=ref,proto3,oneof" json:"ref,omitempty"`
	Spiffe   *IdentitySpiffe   `protobuf:"bytes,5,opt,name=spiffe,proto3,oneof" json:"spiffe,omitempty"`
	// Canonical policy-side matcher slice. Each Matcher targets a
	// sub-field of whichever variant is set. Verified-side Identity
	// leaves this empty.
	Matchers []*Matcher `protobuf:"bytes,10,rep,name=matchers,proto3" json:"matchers,omitempty"`
	// contains filtered or unexported fields
}

Identity captures a signer identity. An identity can one of: 

a) A sigstore identity
b) A key
c) A reference to an identity defined outside the policy
d) A SPIFFE identity

The variant fields describe the signer ("who").

The matchers slice and per-variant *_match convenience fields describe how policy matches against the signer ("how").

In general: Verified-side Identity leaves matcher fields empty; Policy-side Identity populates them as needed.

func NewIdentityFromPrincipal added in v0.5.0 

func NewIdentityFromPrincipal(principal string) (*Identity, error)

NewIdentityFromPrincipal parses an Identity from its canonical principal string — a pure, matcher-free identifier. Supported forms: 

sigstore::<issuer>::<identity>
key::<type>::<id>
ref:<id>
spiffe://<trust-domain><path>

Strict: parenthetical annotations like "sigstore(regexp)::..." or "sigstore(issuerMatch=exact)::..." are rejected — those carry matcher semantics and belong to NewIdentityFromSpec. Round-trips with (*Identity).Principal.

func NewIdentityFromSlug deprecated added in v0.3.4 

func NewIdentityFromSlug(slug string) (*Identity, error)

NewIdentityFromSlug is a compatibility alias for NewIdentityFromSpec. Retained because legacy callers depended on the rich form (e.g. the "sigstore(regexp)::..." marker that Principal no longer emits).

Deprecated: prefer NewIdentityFromSpec; or NewIdentityFromPrincipal for the pure form.

func NewIdentityFromSpec added in v0.5.0 

func NewIdentityFromSpec(spec string) (*Identity, error)

NewIdentityFromSpec parses an Identity from its rich canonical form. The spec carries both the principal AND its matcher semantics.

Accepts:

  • all forms supported by NewIdentityFromPrincipal (pure identifiers)

  • the legacy single-token form "sigstore(regexp)::<issuer>::<identity>" (sets Mode=regexp on the resulting IdentitySigstore)

  • the rich form with per-field StringMatcher annotations:

    sigstore(issuerMatch=exact,identityMatch=regex)::<issuer>::<identity> key(idMatch=glob,typeMatch=exact)::<type>::<id> spiffe(svidMatch=regex)::<pattern> spiffe(trustDomainMatch=exact,pathMatch=glob)::<trust-domain>::<path>

Matcher kinds: exact | regex | prefix | glob. The /i suffix on a kind (e.g. "identityMatch=regex/i") sets case_insensitive on that matcher.

Slot semantics: each annotated field consumes a positional slot; slots not annotated populate the legacy field at that position (e.g. "sigstore(issuerMatch=regex)::https://.*::user@x" becomes IssuerMatch=regex, Identity="user@x"). Round-trips with (*Identity).Spec.

func (*Identity) Descriptor deprecated 

func (*Identity) Descriptor() ([]byte, []int)

Deprecated: Use Identity.ProtoReflect.Descriptor instead.

func (*Identity) GetId 

func (x *Identity) GetId() string

func (*Identity) GetKey 

func (x *Identity) GetKey() *IdentityKey

func (*Identity) GetMatchers added in v0.5.0 

func (x *Identity) GetMatchers() []*Matcher

func (*Identity) GetRef 

func (x *Identity) GetRef() *IdentityRef

func (*Identity) GetSigstore 

func (x *Identity) GetSigstore() *IdentitySigstore

func (*Identity) GetSpiffe added in v0.5.0 

func (x *Identity) GetSpiffe() *IdentitySpiffe

func (*Identity) Principal added in v0.5.0 

func (i *Identity) Principal() string

Principal returns the canonical string naming this identity — the security-domain "principal" that uniquely identifies who signed. Matcher semantics (e.g. sigstore Mode=regexp) are NOT encoded in the principal: it is a pure identifier. Round-trips with NewIdentityFromPrincipal.

func (*Identity) ProtoMessage 

func (*Identity) ProtoMessage()

func (*Identity) ProtoReflect 

func (x *Identity) ProtoReflect() protoreflect.Message

func (*Identity) PublicKey added in v0.3.4 

func (i *Identity) PublicKey() (key.PublicKeyProvider, error)

PublicKey returns the identity public key by parsing the data if set. It uses ParsePublicKeyProvider to preserve full key metadata (e.g. GPG key IDs and subkeys) required for PGP signature verification.

func (*Identity) Reset 

func (x *Identity) Reset()

func (*Identity) Slug deprecated added in v0.3.4 

func (i *Identity) Slug() string

Slug returns the rich form (alias of Spec).

Deprecated: prefer Spec for the rich form, Principal for the pure identifier. Retained for existing callers.

func (*Identity) Spec added in v0.5.0 

func (i *Identity) Spec() string

Spec returns the rich canonical string carrying both the principal and its matcher semantics. Suitable for CLI flag values like 

--identity=sigstore(identityMatch=regex)::https://accounts.google.com::user@.*\.example\.com

When no matchers are set, Spec returns the same string as Principal (with the legacy "(regexp)" marker reintroduced when Mode=regexp on IdentitySigstore). Round-trips with NewIdentityFromSpec.

Spec covers the per-variant *_match conveniences and the dominant principal-slot fields. It does NOT encode the outer Matchers slice, IdentityKey.signing_fingerprint(_match), IdentitySpiffe.trust_roots, or IdentitySigstore.source_repository_uri(_match) — callers that need full fidelity should use the proto directly.

func (*Identity) String 

func (x *Identity) String() string

func (*Identity) Validate added in v0.3.4 

func (i *Identity) Validate() error

Validate checks the integrity of the identity and returns an error if fields are missing or invalid. Validates each variant's required fields, compiles regex patterns on legacy sigstore fields (when Mode=regexp) and on any StringMatcher regex/glob kinds, and checks spiffe svid parses as a valid SPIFFE ID — surfacing authoring errors at validation time rather than at match time.

type IdentityKey 

type IdentityKey struct {
	Id                 string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`                                                           // Key ID
	Type               string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`                                                       // Identity type
	Data               string `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`                                                       // Public key data
	SigningFingerprint string `protobuf:"bytes,4,opt,name=signing_fingerprint,json=signingFingerprint,proto3" json:"signing_fingerprint,omitempty"` // Fingerprint of the signing subkey
	// Convenience per-field matchers. No data_match: PEM blobs aren't
	// pattern-matched; pin via id_match on the derived fingerprint.
	IdMatch                 *StringMatcher `protobuf:"bytes,5,opt,name=id_match,json=idMatch,proto3" json:"id_match,omitempty"`
	TypeMatch               *StringMatcher `protobuf:"bytes,6,opt,name=type_match,json=typeMatch,proto3" json:"type_match,omitempty"`
	SigningFingerprintMatch *StringMatcher `` /* 132-byte string literal not displayed */
	// contains filtered or unexported fields
}

IdentityKey registers the data of a key used to sign attestations.

func IdentityKeyFromPublic added in v0.4.5 

func IdentityKeyFromPublic(pub *key.Public) *IdentityKey

IdentityKeyFromPublic builds an IdentityKey from a verified *key.Public. It copies the key Id, Scheme (as Type) and — critically for GPG — the SigningKeyFingerprint populated during verification, so the resulting IdentityKey names the actual signing (sub)key rather than just the primary/identity key.

func (*IdentityKey) Descriptor deprecated 

func (*IdentityKey) Descriptor() ([]byte, []int)

Deprecated: Use IdentityKey.ProtoReflect.Descriptor instead.

func (*IdentityKey) GetData 

func (x *IdentityKey) GetData() string

func (*IdentityKey) GetId 

func (x *IdentityKey) GetId() string

func (*IdentityKey) GetIdMatch added in v0.5.0 

func (x *IdentityKey) GetIdMatch() *StringMatcher

func (*IdentityKey) GetSigningFingerprint added in v0.4.5 

func (x *IdentityKey) GetSigningFingerprint() string

func (*IdentityKey) GetSigningFingerprintMatch added in v0.5.0 

func (x *IdentityKey) GetSigningFingerprintMatch() *StringMatcher

func (*IdentityKey) GetType 

func (x *IdentityKey) GetType() string

func (*IdentityKey) GetTypeMatch added in v0.5.0 

func (x *IdentityKey) GetTypeMatch() *StringMatcher

func (*IdentityKey) Normalize added in v0.4.0 

func (ik *IdentityKey) Normalize() error

Normalize populates empty Type and Id fields by parsing the key Data. This ensures identities defined with only key material (e.g. a GPG key block) have their Id and Type resolved before matching.

func (*IdentityKey) ProtoMessage 

func (*IdentityKey) ProtoMessage()

func (*IdentityKey) ProtoReflect 

func (x *IdentityKey) ProtoReflect() protoreflect.Message

func (*IdentityKey) Reset 

func (x *IdentityKey) Reset()

func (*IdentityKey) String 

func (x *IdentityKey) String() string

type IdentityRef 

type IdentityRef struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

IdentityRef represents a reference to an identity. At the policy level, a ref allows to have a common definitions that can be reused by all policies in a set.

func (*IdentityRef) Descriptor deprecated 

func (*IdentityRef) Descriptor() ([]byte, []int)

Deprecated: Use IdentityRef.ProtoReflect.Descriptor instead.

func (*IdentityRef) GetId 

func (x *IdentityRef) GetId() string

func (*IdentityRef) ProtoMessage 

func (*IdentityRef) ProtoMessage()

func (*IdentityRef) ProtoReflect 

func (x *IdentityRef) ProtoReflect() protoreflect.Message

func (*IdentityRef) Reset 

func (x *IdentityRef) Reset()

func (*IdentityRef) String 

func (x *IdentityRef) String() string

type IdentitySigstore 

type IdentitySigstore struct {
	Mode     *string `protobuf:"bytes,1,opt,name=mode,proto3,oneof" json:"mode,omitempty"`   // exact | regexp (legacy ti be removed, prefer *_match)
	Issuer   string  `protobuf:"bytes,2,opt,name=issuer,proto3" json:"issuer,omitempty"`     // https://accounts.google.com
	Identity string  `protobuf:"bytes,3,opt,name=identity,proto3" json:"identity,omitempty"` //  "identity": "puerco@gmail.com"
	// Convenience per-field matchers. When set, participate in the
	// virtual matcher union alongside the legacy Mode/Issuer/Identity
	// fields and the outer Matcher slice.
	IssuerMatch   *StringMatcher `protobuf:"bytes,4,opt,name=issuer_match,json=issuerMatch,proto3" json:"issuer_match,omitempty"`
	IdentityMatch *StringMatcher `protobuf:"bytes,5,opt,name=identity_match,json=identityMatch,proto3" json:"identity_match,omitempty"`
	// Has no legacy form; pin via source_repository_uri_match.
	SourceRepositoryUri      string         `protobuf:"bytes,6,opt,name=source_repository_uri,json=sourceRepositoryUri,proto3" json:"source_repository_uri,omitempty"` // OID 1.3.6.1.4.1.57264.1.12
	SourceRepositoryUriMatch *StringMatcher ``                                                                                                                         /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

IdentitySigstore represents the identity data in a Fulcio cert.

func (*IdentitySigstore) Descriptor deprecated 

func (*IdentitySigstore) Descriptor() ([]byte, []int)

Deprecated: Use IdentitySigstore.ProtoReflect.Descriptor instead.

func (*IdentitySigstore) GetIdentity 

func (x *IdentitySigstore) GetIdentity() string

func (*IdentitySigstore) GetIdentityMatch added in v0.5.0 

func (x *IdentitySigstore) GetIdentityMatch() *StringMatcher

func (*IdentitySigstore) GetIssuer 

func (x *IdentitySigstore) GetIssuer() string

func (*IdentitySigstore) GetIssuerMatch added in v0.5.0 

func (x *IdentitySigstore) GetIssuerMatch() *StringMatcher

func (*IdentitySigstore) GetMode 

func (x *IdentitySigstore) GetMode() string

func (*IdentitySigstore) GetSourceRepositoryUri added in v0.5.1 

func (x *IdentitySigstore) GetSourceRepositoryUri() string

func (*IdentitySigstore) GetSourceRepositoryUriMatch added in v0.5.1 

func (x *IdentitySigstore) GetSourceRepositoryUriMatch() *StringMatcher

func (*IdentitySigstore) ProtoMessage 

func (*IdentitySigstore) ProtoMessage()

func (*IdentitySigstore) ProtoReflect 

func (x *IdentitySigstore) ProtoReflect() protoreflect.Message

func (*IdentitySigstore) Reset 

func (x *IdentitySigstore) Reset()

func (*IdentitySigstore) String 

func (x *IdentitySigstore) String() string

type IdentitySpiffe added in v0.5.0 

type IdentitySpiffe struct {
	Svid       string `protobuf:"bytes,1,opt,name=svid,proto3" json:"svid,omitempty"`
	TrustRoots string `protobuf:"bytes,2,opt,name=trust_roots,json=trustRoots,proto3" json:"trust_roots,omitempty"`
	// Convenience per-field matchers. svid_match matches against the
	// full SVID URI; trust_domain_match and path_match apply to the
	// decomposed components parsed from the signer's svid at eval time.
	// No trust_roots_match: trust anchors are cryptographic material.
	SvidMatch        *StringMatcher `protobuf:"bytes,3,opt,name=svid_match,json=svidMatch,proto3" json:"svid_match,omitempty"`
	TrustDomainMatch *StringMatcher `protobuf:"bytes,4,opt,name=trust_domain_match,json=trustDomainMatch,proto3" json:"trust_domain_match,omitempty"`
	PathMatch        *StringMatcher `protobuf:"bytes,5,opt,name=path_match,json=pathMatch,proto3" json:"path_match,omitempty"`
	// contains filtered or unexported fields
}

IdentitySpiffe represents a SPIFFE workload identity.

svid carries the canonical SPIFFE ID URI (spiffe://<trust-domain><path>). This matches the native SPIFFE representation and what verifiers surface in VerificationResult.VerifiedIdentity.SubjectAlternativeName.

trust_roots inlines the PEM-encoded SPIRE upstream CA root(s) used to validate the SVID chain, analogous to IdentityKey.data. Unlike the sigstore flow there is no universal trust-root registry for SPIFFE, so the policy must carry (or reference) the anchor itself.

func IdentitySpiffeFromCert added in v0.5.0 

func IdentitySpiffeFromCert(leaf *x509.Certificate) (*IdentitySpiffe, error)

IdentitySpiffeFromCert builds an IdentitySpiffe from a leaf certificate by extracting the SPIFFE ID from its URI SAN and then delegating to IdentitySpiffeFromString once the SAN is found. Useful when a caller has only the leaf (e.g. test fixtures or standalone cert inspection); when a VerificationResult is available, read the SAN from VerifiedIdentity and call IdentitySpiffeFromString directly.

func IdentitySpiffeFromString added in v0.5.0 

func IdentitySpiffeFromString(spiffeID string) (*IdentitySpiffe, error)

IdentitySpiffeFromString parses a SPIFFE ID string (e.g. "spiffe://example.org/workload") into an IdentitySpiffe.

TrustRoots is intentionally NOT populated — it is a verifier configuration (which root(s) the chain was validated against), not an attribute of the signer. Expectation-side IdentitySpiffe values carry TrustRoots to tell the verifier what to trust; verified-side IdentitySpiffe values describe who signed.

func (*IdentitySpiffe) Descriptor deprecated added in v0.5.0 

func (*IdentitySpiffe) Descriptor() ([]byte, []int)

Deprecated: Use IdentitySpiffe.ProtoReflect.Descriptor instead.

func (*IdentitySpiffe) GetPathMatch added in v0.5.0 

func (x *IdentitySpiffe) GetPathMatch() *StringMatcher

func (*IdentitySpiffe) GetSvid added in v0.5.0 

func (x *IdentitySpiffe) GetSvid() string

func (*IdentitySpiffe) GetSvidMatch added in v0.5.0 

func (x *IdentitySpiffe) GetSvidMatch() *StringMatcher

func (*IdentitySpiffe) GetTrustDomainMatch added in v0.5.0 

func (x *IdentitySpiffe) GetTrustDomainMatch() *StringMatcher

func (*IdentitySpiffe) GetTrustRoots added in v0.5.0 

func (x *IdentitySpiffe) GetTrustRoots() string

func (*IdentitySpiffe) ProtoMessage added in v0.5.0 

func (*IdentitySpiffe) ProtoMessage()

func (*IdentitySpiffe) ProtoReflect added in v0.5.0 

func (x *IdentitySpiffe) ProtoReflect() protoreflect.Message

func (*IdentitySpiffe) Reset added in v0.5.0 

func (x *IdentitySpiffe) Reset()

func (*IdentitySpiffe) String added in v0.5.0 

func (x *IdentitySpiffe) String() string

type Matcher added in v0.5.0 

type Matcher struct {
	Field string `protobuf:"bytes,1,opt,name=field,proto3" json:"field,omitempty"`
	// Types that are valid to be assigned to Kind:
	//
	//	*Matcher_String_
	Kind isMatcher_Kind `protobuf_oneof:"kind"`
	// contains filtered or unexported fields
}

Matcher is a single constraint on a field of the selected Identity variant. The field selector names a sub-field using dotted notation: 

"principal"                  // the whole principal string
"sigstore.issuer"
"sigstore.identity"
"sigstore.source_repository_uri"
"key.id"
"key.type"
"key.signing_fingerprint"
"spiffe.trust_domain"
"spiffe.path"

The oneof `kind` is designed to grow additively. Adding new matcher kinds (Int, Duration, List, Bool, composite and/or/not) is a proto change, never a breaking one.

func (*Matcher) Descriptor deprecated added in v0.5.0 

func (*Matcher) Descriptor() ([]byte, []int)

Deprecated: Use Matcher.ProtoReflect.Descriptor instead.

func (*Matcher) GetField added in v0.5.0 

func (x *Matcher) GetField() string

func (*Matcher) GetKind added in v0.5.0 

func (x *Matcher) GetKind() isMatcher_Kind

func (*Matcher) GetString_ added in v0.5.0 

func (x *Matcher) GetString_() *StringMatcher

func (*Matcher) ProtoMessage added in v0.5.0 

func (*Matcher) ProtoMessage()

func (*Matcher) ProtoReflect added in v0.5.0 

func (x *Matcher) ProtoReflect() protoreflect.Message

func (*Matcher) Reset added in v0.5.0 

func (x *Matcher) Reset()

func (*Matcher) String added in v0.5.0 

func (x *Matcher) String() string

type Matcher_String_ added in v0.5.0 

type Matcher_String_ struct {
	String_ *StringMatcher `protobuf:"bytes,2,opt,name=string,proto3,oneof"`
}

type SignatureVerification 

type SignatureVerification struct {

	// Date when the verification was performed
	Date *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=date,proto3" json:"date,omitempty"`
	// SignatureVerified is set to true when a hash's signature was verified
	// with at least one key or cert. Verified does not imply any identity check.
	Verified bool `protobuf:"varint,2,opt,name=verified,proto3" json:"verified,omitempty"`
	// Identities has a list of the identities (sigstore signers or keys)
	// that signed the object.
	Identities []*Identity `protobuf:"bytes,3,rep,name=Identities,proto3" json:"Identities,omitempty"`
	// Message is an optional message that can be populated when a verification
	// was performed successfully.
	Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
	// Error is a message explaining why verification failed.
	Error string `protobuf:"bytes,5,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func SignatureVerificationFromResult added in v0.5.0 

func SignatureVerificationFromResult(r *verify.VerificationResult) *SignatureVerification

SignatureVerificationFromResult translates sigstore-go's *verify.VerificationResult into the api/v1 SignatureVerification used for identity matching. Handles both sigstore and SPIFFE flows by inspecting VerifiedIdentity: a spiffe:// SAN produces an IdentitySpiffe; any other SAN/Issuer pair produces an IdentitySigstore.

Pass a nil result (e.g. when verification failed) to get back an empty, unverified SignatureVerification. Callers typically invoke this after a successful Verify call: 

result, err := verifier.Verify(nil, bndl)
if err != nil {
    return err
}
sv := api.SignatureVerificationFromResult(result)
if !sv.MatchesIdentity(expected) {
    return errors.New("signer did not match expected identity")
}

func (*SignatureVerification) Descriptor deprecated 

func (*SignatureVerification) Descriptor() ([]byte, []int)

Deprecated: Use SignatureVerification.ProtoReflect.Descriptor instead.

func (*SignatureVerification) GetDate 

func (x *SignatureVerification) GetDate() *timestamppb.Timestamp

func (*SignatureVerification) GetError 

func (x *SignatureVerification) GetError() string

func (*SignatureVerification) GetIdentities 

func (x *SignatureVerification) GetIdentities() []*Identity

func (*SignatureVerification) GetMessage 

func (x *SignatureVerification) GetMessage() string

func (*SignatureVerification) GetVerified 

func (x *SignatureVerification) GetVerified() bool

func (*SignatureVerification) MatchesIdentity added in v0.3.4 

func (sv *SignatureVerification) MatchesIdentity(id *Identity) bool

MatchesIdentity returns true when at least one verified signer satisfies the variant-specific check AND every outer matcher in id.GetMatchers() passes for that same signer. AND semantics — all set constraints must pass for a signer to be accepted.

func (*SignatureVerification) MatchesKeyIdentity added in v0.3.4 

func (sv *SignatureVerification) MatchesKeyIdentity(keyIdentity *IdentityKey) bool

MatchesKeyIdentity returns true if one of the verified signatures was performed with the specified key. Matching rules:

  • Id (required via legacy field OR IdMatch): compared against both the signer's primary key Id and its signing subkey fingerprint — an expected identity can name a GPG signer by either. Legacy Id is case-insensitive; IdMatch follows its StringMatcher configuration.
  • Type (optional, legacy): narrows the match when both sides set it. An unset signer type skips the check. TypeMatch (new) is strict: when set, the signer's type must satisfy it.
  • SigningFingerprint (optional, legacy): case-insensitive exact pin. SigningFingerprintMatch (new) is strict when set.

If the identity has Data but no Id, Normalize is called first.

func (*SignatureVerification) MatchesSigstoreIdentity added in v0.3.4 

func (sv *SignatureVerification) MatchesSigstoreIdentity(id *IdentitySigstore) bool

MatchesSigstoreIdentity returns true if one of the verified signatures matches the supplied sigstore identity. Matching rules:

  • Legacy fields (Issuer + Identity + Mode): when used, BOTH Issuer and Identity must be set. Mode chooses literal-equality or (anchored) regex semantics for the pair. Both must match.
  • Convenience matchers (IssuerMatch / IdentityMatch): independent StringMatchers layered on top. Each, when set, must pass.
  • Legacy and convenience forms may be combined — all constraints that are set must match the signer (AND semantics).

An expectation that sets NO constraint across either path matches nothing. An expectation that sets exactly one legacy field (Issuer OR Identity but not both) is treated as malformed and matches nothing, preserving the previous "both required" contract for legacy-only expectations.

func (*SignatureVerification) MatchesSpiffeIdentity added in v0.5.0 

func (sv *SignatureVerification) MatchesSpiffeIdentity(id *IdentitySpiffe) bool

MatchesSpiffeIdentity returns true if one of the verified signatures was produced by a SPIFFE workload matching the supplied identity. Matching rules:

  • Svid (optional, exact): when set, the signer's svid must match this URI exactly.
  • SvidMatch (optional): StringMatcher applied to the full signer svid URI.
  • TrustDomainMatch / PathMatch (optional): StringMatchers applied to the trust-domain / path components parsed from the signer's svid at eval time. If the signer's svid doesn't parse as a valid SPIFFE ID, these matchers fail closed.
  • TrustRoots is not consulted here — it is verifier configuration used to validate the chain, not an attribute of the signer.

All conditions that are set must pass (AND semantics). At least one constraint must be specified; an identity with none of svid, svid_match, trust_domain_match, or path_match set matches nothing.

func (*SignatureVerification) ProtoMessage 

func (*SignatureVerification) ProtoMessage()

func (*SignatureVerification) ProtoReflect 

func (x *SignatureVerification) ProtoReflect() protoreflect.Message

func (*SignatureVerification) Reset 

func (x *SignatureVerification) Reset()

func (*SignatureVerification) String 

func (x *SignatureVerification) String() string

type StringMatcher added in v0.5.0 

type StringMatcher struct {

	// Types that are valid to be assigned to Kind:
	//
	//	*StringMatcher_Exact
	//	*StringMatcher_Regex
	//	*StringMatcher_Prefix
	//	*StringMatcher_Glob
	Kind            isStringMatcher_Kind `protobuf_oneof:"kind"`
	CaseInsensitive bool                 `protobuf:"varint,5,opt,name=case_insensitive,json=caseInsensitive,proto3" json:"case_insensitive,omitempty"`
	// from_context names a value the matching caller (e.g. ampel) resolves into
	// this matcher as an exact match before use. Mutually exclusive with a
	// `kind`. If it reaches matching unresolved, the match fails closed.
	FromContext string `protobuf:"bytes,6,opt,name=from_context,json=fromContext,proto3" json:"from_context,omitempty"`
	// contains filtered or unexported fields
}

StringMatcher is the concrete matcher for string-valued fields. Exactly one of the `kind` variants must be set, unless from_context is used.

func (*StringMatcher) Descriptor deprecated added in v0.5.0 

func (*StringMatcher) Descriptor() ([]byte, []int)

Deprecated: Use StringMatcher.ProtoReflect.Descriptor instead.

func (*StringMatcher) GetCaseInsensitive added in v0.5.0 

func (x *StringMatcher) GetCaseInsensitive() bool

func (*StringMatcher) GetExact added in v0.5.0 

func (x *StringMatcher) GetExact() string

func (*StringMatcher) GetFromContext added in v0.5.2 

func (x *StringMatcher) GetFromContext() string

func (*StringMatcher) GetGlob added in v0.5.0 

func (x *StringMatcher) GetGlob() string

func (*StringMatcher) GetKind added in v0.5.0 

func (x *StringMatcher) GetKind() isStringMatcher_Kind

func (*StringMatcher) GetPrefix added in v0.5.0 

func (x *StringMatcher) GetPrefix() string

func (*StringMatcher) GetRegex added in v0.5.0 

func (x *StringMatcher) GetRegex() string

func (*StringMatcher) ProtoMessage added in v0.5.0 

func (*StringMatcher) ProtoMessage()

func (*StringMatcher) ProtoReflect added in v0.5.0 

func (x *StringMatcher) ProtoReflect() protoreflect.Message

func (*StringMatcher) Reset added in v0.5.0 

func (x *StringMatcher) Reset()

func (*StringMatcher) String added in v0.5.0 

func (x *StringMatcher) String() string

type StringMatcher_Exact added in v0.5.0 

type StringMatcher_Exact struct {
	Exact string `protobuf:"bytes,1,opt,name=exact,proto3,oneof"`
}

type StringMatcher_Glob added in v0.5.0 

type StringMatcher_Glob struct {
	Glob string `protobuf:"bytes,4,opt,name=glob,proto3,oneof"` // shell-style glob (*, ?, [...])
}

type StringMatcher_Prefix added in v0.5.0 

type StringMatcher_Prefix struct {
	Prefix string `protobuf:"bytes,3,opt,name=prefix,proto3,oneof"`
}

type StringMatcher_Regex added in v0.5.0 

type StringMatcher_Regex struct {
	Regex string `protobuf:"bytes,2,opt,name=regex,proto3,oneof"` // anchored to the full input at compile time
}

type Verification 

type Verification struct {
	Signature *SignatureVerification `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

Results of the signature verification process

func (*Verification) Descriptor deprecated 

func (*Verification) Descriptor() ([]byte, []int)

Deprecated: Use Verification.ProtoReflect.Descriptor instead.

func (*Verification) Error added in v0.3.4 

func (v *Verification) Error() string

Error implements the Go error interface when verification fails

func (*Verification) GetSignature 

func (x *Verification) GetSignature() *SignatureVerification

func (*Verification) GetVerified added in v0.3.4 

func (v *Verification) GetVerified() bool

GetVerified returns true if verification passed

func (*Verification) MatchesIdentity added in v0.3.4 

func (v *Verification) MatchesIdentity(rawID any) bool

MatchesIdentity returns true if one of the verified signatures matches the identity.

func (*Verification) ProtoMessage 

func (*Verification) ProtoMessage()

func (*Verification) ProtoReflect 

func (x *Verification) ProtoReflect() protoreflect.Message

func (*Verification) Reset 

func (x *Verification) Reset()

func (*Verification) String 

func (x *Verification) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.