releasetrust

package
v3.0.17 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 27, 2026 License: MIT Imports: 13 Imported by: 0

Documentation

Overview

Package releasetrust defines the host-neutral types and adapter capabilities used by the release trust state machine.

Index

Constants

View Source 
const (
	MaxReleasePointerBytes  int64 = 64 << 10
	MaxReleaseDocumentBytes int64 = 1 << 20
)
View Source 
const SignatureAlgorithmEd25519 = "ed25519"

Variables

View Source 
var (
	ErrInvalidReleaseIdentity = errors.New("release trust release identity is invalid")
	ErrReleasePolicyDenied    = errors.New("release trust source policy denied the release")
)
View Source 
var (
	ErrReleaseTrustVerification = errors.New("release trust verification failed")
	ErrReleaseTrustExpired      = errors.New("release trust document is expired")
	ErrReleaseTrustRevoked      = errors.New("release trust subject is revoked")
)
View Source 
var (
	ErrInvalidLocator          = errors.New("release trust locator is invalid")
	ErrInvalidTransportPayload = errors.New("release trust transport payload is invalid")
)
View Source 
var (
	ErrInvalidSourceConfiguration = errors.New("release trust source configuration is invalid")
	ErrSourceChannelNotAllowed    = errors.New("release trust source channel is not allowed")
	ErrInvalidTrustAnchor         = errors.New("release trust anchor is invalid")
	ErrInvalidReleaseTrustOptions = errors.New("release trust options are invalid")
)

Functions

This section is empty.

Types

type LocatorPolicy 

type LocatorPolicy uint8
const SourceRelativeLocatorPolicyV1 LocatorPolicy = 1

type PreparedRelease 

type PreparedRelease struct {
	// contains filtered or unexported fields
}

func (PreparedRelease) AllowsPackageSigningKey 

func (prepared PreparedRelease) AllowsPackageSigningKey(keyID string) bool

AllowsPackageSigningKey reports whether the freshly prepared source state still authorizes a package signing key and has not revoked it.

func (PreparedRelease) AllowsReleaseMetadataSigningKey added in v3.0.8 

func (prepared PreparedRelease) AllowsReleaseMetadataSigningKey(keyID string) bool

AllowsReleaseMetadataSigningKey reports whether the freshly prepared source state still authorizes a release-metadata signing key and has not revoked it.

func (PreparedRelease) Identity 

func (prepared PreparedRelease) Identity() ReleaseIdentity

func (PreparedRelease) SourcePolicy 

func (prepared PreparedRelease) SourcePolicy() releasecontract.SourcePolicyV3

func (PreparedRelease) SourceTrustKey 

func (prepared PreparedRelease) SourceTrustKey() SourceTrustKey

func (PreparedRelease) VerifiedAt 

func (prepared PreparedRelease) VerifiedAt() time.Time

type ReleaseDocumentKind 

type ReleaseDocumentKind string
const (
	ReleaseDocumentRootDelegation      ReleaseDocumentKind = "root_delegation"
	ReleaseDocumentSourcePolicy        ReleaseDocumentKind = "source_policy"
	ReleaseDocumentSourcePolicyPointer ReleaseDocumentKind = "source_policy_pointer"
	ReleaseDocumentRevocation          ReleaseDocumentKind = "revocation"
	ReleaseDocumentRevocationPointer   ReleaseDocumentKind = "revocation_pointer"
)

type ReleaseDocumentRequest 

type ReleaseDocumentRequest struct {
	// contains filtered or unexported fields
}

func (ReleaseDocumentRequest) Channel 

func (request ReleaseDocumentRequest) Channel() string

func (ReleaseDocumentRequest) Kind 

func (request ReleaseDocumentRequest) Kind() ReleaseDocumentKind

func (ReleaseDocumentRequest) Locator 

func (request ReleaseDocumentRequest) Locator() SourceRelativeLocator

func (ReleaseDocumentRequest) MaxBytes 

func (request ReleaseDocumentRequest) MaxBytes() int64

func (ReleaseDocumentRequest) SourceID 

func (request ReleaseDocumentRequest) SourceID() string

type ReleaseDocumentResult 

type ReleaseDocumentResult struct {
	// contains filtered or unexported fields
}

func NewReleaseDocumentResult 

func NewReleaseDocumentResult(request ReleaseDocumentRequest, transportToken string, value []byte) (ReleaseDocumentResult, error)

type ReleaseDocumentTransport 

type ReleaseDocumentTransport interface {
	FetchReleaseDocument(context.Context, ReleaseDocumentRequest) (ReleaseDocumentResult, error)
}

type ReleaseIdentity 

type ReleaseIdentity struct {
	SourceID              string
	Channel               string
	ReleaseMetadataRef    string
	ReleaseMetadataSHA256 string
	PublisherID           string
	PluginID              string
	Version               string
}

type ReleaseTrustAdapters 

type ReleaseTrustAdapters struct {
	Documents ReleaseDocumentTransport
}

type ReleaseTrustOptions 

type ReleaseTrustOptions struct {
	// contains filtered or unexported fields
}

ReleaseTrustOptions contains only immutable source trust policy. Runtime adapters are supplied separately when the service is constructed.

func NewReleaseTrustOptions 

func NewReleaseTrustOptions(
	sourceConfiguration SourceConfiguration,
	rootAnchor TrustAnchor,
	locatorPolicy LocatorPolicy,
) (ReleaseTrustOptions, error)

func (ReleaseTrustOptions) LocatorPolicy 

func (options ReleaseTrustOptions) LocatorPolicy() LocatorPolicy

func (ReleaseTrustOptions) RootAnchor 

func (options ReleaseTrustOptions) RootAnchor() TrustAnchor

func (ReleaseTrustOptions) SourceConfiguration 

func (options ReleaseTrustOptions) SourceConfiguration() SourceConfiguration

type ReleaseTrustService 

type ReleaseTrustService struct {
	// contains filtered or unexported fields
}

func NewReleaseTrustService 

func NewReleaseTrustService(options ReleaseTrustOptions, adapters ReleaseTrustAdapters) (*ReleaseTrustService, error)

func (*ReleaseTrustService) RefreshSource 

func (service *ReleaseTrustService) RefreshSource(ctx context.Context, key SourceTrustKey) (VerifiedSourceSnapshot, error)

type ServiceSet 

type ServiceSet struct {
	// contains filtered or unexported fields
}

func NewServiceSet 

func NewServiceSet(services ...*ReleaseTrustService) (*ServiceSet, error)

func (*ServiceSet) PrepareRelease 

func (set *ServiceSet) PrepareRelease(ctx context.Context, identity ReleaseIdentity) (PreparedRelease, error)

func (*ServiceSet) VerifyPackage 

func (set *ServiceSet) VerifyPackage(
	ctx context.Context,
	metadata VerifiedReleaseMetadata,
	signature releasecontract.PackageSignatureV1,
) (VerifiedPackage, error)

func (*ServiceSet) VerifyReleaseMetadata 

func (set *ServiceSet) VerifyReleaseMetadata(
	ctx context.Context,
	prepared PreparedRelease,
	raw []byte,
	signature []byte,
) (VerifiedReleaseMetadata, error)

type SourceConfiguration 

type SourceConfiguration struct {
	// contains filtered or unexported fields
}

SourceConfiguration is a sealed, immutable source identity and channel set.

func NewSourceConfiguration 

func NewSourceConfiguration(sourceID string, allowedChannels []string) (SourceConfiguration, error)

func (SourceConfiguration) AllowedChannels 

func (configuration SourceConfiguration) AllowedChannels() []string

func (SourceConfiguration) SourceID 

func (configuration SourceConfiguration) SourceID() string

func (SourceConfiguration) TrustKey 

func (configuration SourceConfiguration) TrustKey(channel string) (SourceTrustKey, error)

type SourceRelativeLocator 

type SourceRelativeLocator struct {
	// contains filtered or unexported fields
}

func (SourceRelativeLocator) String 

func (locator SourceRelativeLocator) String() string

type SourceTrustKey 

type SourceTrustKey struct {
	// contains filtered or unexported fields
}

SourceTrustKey identifies channel-scoped trust state. Values can only be derived from a validated SourceConfiguration.

func (SourceTrustKey) Channel 

func (key SourceTrustKey) Channel() string

func (SourceTrustKey) SourceID 

func (key SourceTrustKey) SourceID() string

func (SourceTrustKey) String 

func (key SourceTrustKey) String() string

type TrustAnchor 

type TrustAnchor struct {
	// contains filtered or unexported fields
}

TrustAnchor is an owned public verification key.

func NewEd25519TrustAnchor 

func NewEd25519TrustAnchor(keyID string, publicKey []byte) (TrustAnchor, error)

func (TrustAnchor) Algorithm 

func (anchor TrustAnchor) Algorithm() string

func (TrustAnchor) KeyID 

func (anchor TrustAnchor) KeyID() string

func (TrustAnchor) PublicKey 

func (anchor TrustAnchor) PublicKey() []byte

type VerifiedPackage 

type VerifiedPackage struct {
	// contains filtered or unexported fields
}

func (VerifiedPackage) PackageSignature 

func (verified VerifiedPackage) PackageSignature() releasecontract.PackageSignatureV1

func (VerifiedPackage) ReleaseMetadata 

func (verified VerifiedPackage) ReleaseMetadata() VerifiedReleaseMetadata

type VerifiedReleaseMetadata 

type VerifiedReleaseMetadata struct {
	// contains filtered or unexported fields
}

func (VerifiedReleaseMetadata) CanonicalBytes 

func (verified VerifiedReleaseMetadata) CanonicalBytes() []byte

func (VerifiedReleaseMetadata) Document 

func (verified VerifiedReleaseMetadata) Document() releasecontract.ReleaseMetadata

func (VerifiedReleaseMetadata) PreparedRelease 

func (verified VerifiedReleaseMetadata) PreparedRelease() PreparedRelease

type VerifiedSourceSnapshot 

type VerifiedSourceSnapshot struct {
	// contains filtered or unexported fields
}

func (VerifiedSourceSnapshot) Revocation 

func (snapshot VerifiedSourceSnapshot) Revocation() releasecontract.RevocationV3

func (VerifiedSourceSnapshot) RootDelegation 

func (snapshot VerifiedSourceSnapshot) RootDelegation() releasecontract.RootDelegationV1

func (VerifiedSourceSnapshot) SourcePolicy 

func (snapshot VerifiedSourceSnapshot) SourcePolicy() releasecontract.SourcePolicyV3

func (VerifiedSourceSnapshot) SourceTrustKey 

func (snapshot VerifiedSourceSnapshot) SourceTrustKey() SourceTrustKey

func (VerifiedSourceSnapshot) VerifiedAt 

func (snapshot VerifiedSourceSnapshot) VerifiedAt() time.Time

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.