Documentation
¶
Overview ¶
Package attestations implements attestation issuance and verification helpers.
Index ¶
- Constants
- func AttestationID(actorURI string, objectURI string, contentHash string, module string, ...) string
- func BuildCompactJWSRS256(ctx context.Context, kid string, payload []byte, ...) (string, error)
- func InstanceAttestationID(instanceSlug string, actorURI string, objectURI string, contentHash string, ...) string
- func ParseCompactJWS(jws string) ([]byte, []byte, []byte, error)
- type CompactJWSHeader
- type JWK
- type JWKS
- type KMSService
- type LinkSafetyBasicResultV1
- type PayloadV1
Constants ¶
const (
PayloadTypeV1 = "lesser.host/attestation/v1"
)
PayloadTypeV1 is the canonical "type" value for v1 attestation payloads.
Variables ¶
This section is empty.
Functions ¶
func AttestationID ¶
func AttestationID(actorURI string, objectURI string, contentHash string, module string, policyVersion string) string
AttestationID derives the legacy deterministic attestation ID from canonical identity inputs.
New trust writes should use InstanceAttestationID so public attestations are bound to the authenticated instance that produced them. This helper remains for tests and for recognizing legacy, pre-live records.
func BuildCompactJWSRS256 ¶
func BuildCompactJWSRS256(ctx context.Context, kid string, payload []byte, signDigest func(context.Context, []byte) ([]byte, error)) (string, error)
BuildCompactJWSRS256 builds a compact JWS signed with RS256.
func InstanceAttestationID ¶ added in v0.2.6
func InstanceAttestationID(instanceSlug string, actorURI string, objectURI string, contentHash string, module string, policyVersion string) string
InstanceAttestationID derives a deterministic attestation ID bound to the authenticated instance slug. Binding the slug prevents one tenant from squatting or minting attestations for another tenant's tuple.
Types ¶
type CompactJWSHeader ¶
type CompactJWSHeader struct {
Alg string `json:"alg"`
Kid string `json:"kid,omitempty"`
Typ string `json:"typ,omitempty"`
}
CompactJWSHeader is the JSON header used in compact JWS serialization.
type JWK ¶
type JWK struct {
Kty string `json:"kty"`
Use string `json:"use,omitempty"`
Alg string `json:"alg,omitempty"`
Kid string `json:"kid,omitempty"`
N string `json:"n,omitempty"`
E string `json:"e,omitempty"`
}
JWK is a JSON Web Key.
type KMSService ¶
type KMSService struct {
// contains filtered or unexported fields
}
KMSService signs attestations using AWS KMS and serves public keys as JWKS.
func NewKMSService ¶
func NewKMSService(signingKeyID string, publicKeyIDs []string) *KMSService
NewKMSService constructs a KMSService for a signing key and a set of public key IDs.
func (*KMSService) Enabled ¶
func (s *KMSService) Enabled() bool
Enabled reports whether the service has a signing key configured.
func (*KMSService) JWKS ¶
func (s *KMSService) JWKS(ctx context.Context) (JWKS, error)
JWKS returns a JSON Web Key Set for the configured public key IDs.
func (*KMSService) SignPayloadJWS ¶
SignPayloadJWS signs a payload and returns a compact JWS and the signing key ID.
type LinkSafetyBasicResultV1 ¶
type LinkSafetyBasicResultV1 struct {
PolicyVersion string `json:"policy_version"`
LinksHash string `json:"links_hash"`
Links []models.LinkSafetyBasicLinkResult `json:"links"`
Summary models.LinkSafetyBasicSummary `json:"summary"`
}
LinkSafetyBasicResultV1 is the result schema for link safety basic attestations.
type PayloadV1 ¶
type PayloadV1 struct {
Type string `json:"type"`
ActorURI string `json:"actor_uri,omitempty"`
ObjectURI string `json:"object_uri,omitempty"`
ContentHash string `json:"content_hash,omitempty"`
// InstanceSlug binds the signed claim to the authenticated lesser.host
// instance that produced it. Public lookup IDs are derived from this value.
InstanceSlug string `json:"instance_slug,omitempty"`
Module string `json:"module"`
PolicyVersion string `json:"policy_version"`
ModelSet string `json:"model_set,omitempty"`
CreatedAt time.Time `json:"created_at"`
ExpiresAt time.Time `json:"expires_at"`
Evidence any `json:"evidence,omitempty"`
Result any `json:"result,omitempty"`
}
PayloadV1 is the signed payload schema for v1 attestations.
Source Files