Documentation
¶
Overview ¶
Package releasetrust defines the host-neutral types and adapter capabilities used by the release trust state machine.
Index ¶
- Constants
- Variables
- type ActivationLease
- type LocatorPolicy
- type MonotonicStateAdapter
- type MonotonicStateCASRequest
- func (request MonotonicStateCASRequest) ExpectedCounter() uint64
- func (request MonotonicStateCASRequest) NextCounter() uint64
- func (request MonotonicStateCASRequest) NextSHA256() string
- func (request MonotonicStateCASRequest) PreviousSHA256() string
- func (request MonotonicStateCASRequest) SourceID() string
- func (request MonotonicStateCASRequest) TransactionID() string
- type MonotonicStateReadRequest
- type MonotonicStateReadResult
- type PreparedRelease
- type ReleaseDocumentKind
- type ReleaseDocumentRequest
- func (request ReleaseDocumentRequest) Channel() string
- func (request ReleaseDocumentRequest) Kind() ReleaseDocumentKind
- func (request ReleaseDocumentRequest) Locator() SourceRelativeLocator
- func (request ReleaseDocumentRequest) MaxBytes() int64
- func (request ReleaseDocumentRequest) SourceID() string
- type ReleaseDocumentResult
- type ReleaseDocumentTransport
- type ReleaseIdentity
- type ReleaseSigningLedgerStateV1
- type ReleaseTrustAdapters
- type ReleaseTrustChannelStateV1
- type ReleaseTrustDocumentHeadV1
- type ReleaseTrustFenceV1
- type ReleaseTrustOptions
- func (options ReleaseTrustOptions) LocatorPolicy() LocatorPolicy
- func (options ReleaseTrustOptions) RootAnchor() TrustAnchor
- func (options ReleaseTrustOptions) SigningLedgerRoot() SigningLedgerRoot
- func (options ReleaseTrustOptions) SourceConfiguration() SourceConfiguration
- func (options ReleaseTrustOptions) TransparencyRoots() []TransparencyRoot
- type ReleaseTrustRootHeadV1
- type ReleaseTrustService
- func (service *ReleaseTrustService) CurrentVerifiedSource(key SourceTrustKey) (VerifiedSourceSnapshot, bool)
- func (service *ReleaseTrustService) FenceSource(ctx context.Context, key SourceTrustKey, reason SourceFenceReason) (SourceFenceStatus, error)
- func (service *ReleaseTrustService) RefreshActivationLease(ctx context.Context, lease ActivationLease) (ActivationLease, error)
- func (service *ReleaseTrustService) RefreshSource(ctx context.Context, key SourceTrustKey) (VerifiedSourceSnapshot, error)
- func (service *ReleaseTrustService) RefreshTrustedTime(ctx context.Context, key SourceTrustKey) (TrustedTimeStatus, error)
- func (service *ReleaseTrustService) String() string
- func (service *ReleaseTrustService) ValidateActivationLease(lease ActivationLease) error
- type ReleaseTrustStateV1
- type ReleaseTrustedTimeStateV1
- type ServiceSet
- func (set *ServiceSet) BindFenceCoordinator(coordinator SourceFenceCoordinator) error
- func (set *ServiceSet) PrepareRelease(ctx context.Context, identity ReleaseIdentity) (PreparedRelease, error)
- func (set *ServiceSet) RefreshActivationLease(ctx context.Context, lease ActivationLease) (ActivationLease, error)
- func (set *ServiceSet) ValidateActivationLease(lease ActivationLease) error
- func (set *ServiceSet) VerifyCapabilityContract(metadata VerifiedReleaseMetadata, bundle capabilitycontract.Bundle, ...) (capabilitycontract.VerifiedContract, error)
- func (set *ServiceSet) VerifyPackage(ctx context.Context, metadata VerifiedReleaseMetadata, ...) (VerifiedPackage, error)
- func (set *ServiceSet) VerifyReleaseMetadata(ctx context.Context, prepared PreparedRelease, raw []byte, signature []byte) (VerifiedReleaseMetadata, error)
- type SigningLedgerArtifactKind
- type SigningLedgerRequest
- type SigningLedgerResult
- type SigningLedgerRoot
- type SigningLedgerRootMode
- type SigningLedgerTransport
- type SourceConfiguration
- type SourceFenceCoordinator
- type SourceFenceReason
- type SourceFenceRequest
- func (request SourceFenceRequest) Generation() uint64
- func (request SourceFenceRequest) ProcessInstanceID() string
- func (request SourceFenceRequest) Reason() SourceFenceReason
- func (request SourceFenceRequest) SourceTrustKey() SourceTrustKey
- func (request SourceFenceRequest) StateSHA256() string
- func (request SourceFenceRequest) TeardownDeadline() time.Duration
- type SourceFenceStatus
- type SourceRelativeLocator
- type SourceTrustKey
- type SourceTrustStateCommitRequest
- type SourceTrustStateLoadRequest
- type SourceTrustStateLoadResult
- type SourceTrustStatePrepareRequest
- type SourceTrustStateStore
- type StateMutationOutcome
- type TransparencyRoot
- type TransparencyRootMode
- type TrustAnchor
- type TrustedTimeAdapter
- type TrustedTimeCheckpointV1
- type TrustedTimeEvidenceV1
- type TrustedTimeLeafV1
- type TrustedTimeObservation
- type TrustedTimeRequest
- type TrustedTimeStatus
- type VerifiedPackage
- type VerifiedReleaseMetadata
- type VerifiedSourceSnapshot
- func (snapshot VerifiedSourceSnapshot) ProcessInstanceID() string
- func (snapshot VerifiedSourceSnapshot) Revocation() releasecontract.RevocationV2
- func (snapshot VerifiedSourceSnapshot) RootDelegation() releasecontract.RootDelegationV1
- func (snapshot VerifiedSourceSnapshot) SourcePolicy() releasecontract.SourcePolicyV2
- func (snapshot VerifiedSourceSnapshot) SourceTrustKey() SourceTrustKey
- func (snapshot VerifiedSourceSnapshot) StateSHA256() string
- func (snapshot VerifiedSourceSnapshot) TrustedFloor() time.Time
- type VerifiedTrustedTime
Constants ¶
const ( ReleaseTrustStateSchemaVersion = "redevplugin.release_trust_state.v1" MaxReleaseTrustStateBytes = 1 << 20 MaxReleaseTrustPendingBytes = 2 << 20 )
const ( MaxReleasePointerBytes int64 = 64 << 10 MaxReleaseDocumentBytes int64 = 1 << 20 MaxSigningLedgerCheckpointBytes int64 = 8 << 10 MaxSigningLedgerEvidenceBytes int64 = 64 << 10 )
const ( TrustedTimeLeafSchemaVersion = "redevplugin.trusted_time_leaf.v1" TrustedTimeEvidenceSchemaVersion = "redevplugin.trusted_time_evidence.v1" TrustedTimeCheckpointSchemaVersion = "redevplugin.trusted_time_checkpoint.v1" TrustedTimeEvidenceTransparency = "transparency" MaxTrustedTimeEvidenceBytes = 64 << 10 MaxTrustedTimeCheckpointBytes = 8 << 10 MaxTrustedTimeProofNodes = 64 )
const SignatureAlgorithmEd25519 = "ed25519"
Variables ¶
var ( ErrActivationLeaseInvalid = errors.New("release trust activation lease is invalid") ErrActivationLeaseExpired = errors.New("release trust activation lease expired") ErrSourceTrustFenced = errors.New("release trust source is fenced") )
var ( ErrInvalidReleaseIdentity = errors.New("release trust release identity is invalid") ErrReleasePolicyDenied = errors.New("release trust source policy denied the release") ErrServiceSetFenceBound = errors.New("release trust service set fence coordinator is already bound") )
var ( ErrInvalidReleaseTrustState = errors.New("release trust state is invalid") ErrReleaseTrustStateConflict = errors.New("release trust state compare-and-swap conflict") ErrReleaseTrustStateUnknown = errors.New("release trust state mutation outcome is unknown") ErrReleaseTrustSplitView = errors.New("release trust local and monotonic state disagree") )
var ( ErrInvalidLocator = errors.New("release trust locator is invalid") ErrInvalidTransportPayload = errors.New("release trust transport payload is invalid") )
var ( ErrInvalidTrustedTimeRequest = errors.New("trusted time request is invalid") ErrInvalidTrustedTimeEvidence = errors.New("trusted time evidence is invalid") ErrTrustedTimeRollback = errors.New("trusted time evidence rolls back persisted state") )
var ( ErrInvalidSourceConfiguration = errors.New("release trust source configuration is invalid") ErrSourceChannelNotAllowed = errors.New("release trust source channel is not allowed") ErrInvalidTrustAnchor = errors.New("release trust anchor is invalid") ErrInvalidReleaseTrustOptions = errors.New("release trust options are invalid") )
var ( ErrReleaseTrustVerification = errors.New("release trust verification failed") ErrReleaseTrustExpired = errors.New("release trust document is expired") ErrReleaseTrustRollback = errors.New("release trust state rolled back or forked") ErrReleaseTrustRevoked = errors.New("release trust subject is revoked") )
Functions ¶
This section is empty.
Types ¶
type ActivationLease ¶
type ActivationLease struct {
// contains filtered or unexported fields
}
func (ActivationLease) ProcessInstanceID ¶
func (lease ActivationLease) ProcessInstanceID() string
func (ActivationLease) RefreshAfter ¶
func (lease ActivationLease) RefreshAfter() time.Duration
func (ActivationLease) SourceTrustKey ¶
func (lease ActivationLease) SourceTrustKey() SourceTrustKey
func (ActivationLease) StateSHA256 ¶
func (lease ActivationLease) StateSHA256() string
func (ActivationLease) ValidFor ¶
func (lease ActivationLease) ValidFor() time.Duration
type MonotonicStateAdapter ¶
type MonotonicStateAdapter interface {
ReadMonotonicState(context.Context, MonotonicStateReadRequest) (MonotonicStateReadResult, error)
CompareAndSwapMonotonicState(context.Context, MonotonicStateCASRequest) (StateMutationOutcome, error)
}
type MonotonicStateCASRequest ¶
type MonotonicStateCASRequest struct {
// contains filtered or unexported fields
}
func (MonotonicStateCASRequest) ExpectedCounter ¶
func (request MonotonicStateCASRequest) ExpectedCounter() uint64
func (MonotonicStateCASRequest) NextCounter ¶
func (request MonotonicStateCASRequest) NextCounter() uint64
func (MonotonicStateCASRequest) NextSHA256 ¶
func (request MonotonicStateCASRequest) NextSHA256() string
func (MonotonicStateCASRequest) PreviousSHA256 ¶
func (request MonotonicStateCASRequest) PreviousSHA256() string
func (MonotonicStateCASRequest) SourceID ¶
func (request MonotonicStateCASRequest) SourceID() string
func (MonotonicStateCASRequest) TransactionID ¶
func (request MonotonicStateCASRequest) TransactionID() string
type MonotonicStateReadRequest ¶
type MonotonicStateReadRequest struct {
// contains filtered or unexported fields
}
func (MonotonicStateReadRequest) SourceID ¶
func (request MonotonicStateReadRequest) SourceID() string
type MonotonicStateReadResult ¶
type MonotonicStateReadResult struct {
// contains filtered or unexported fields
}
func NewMonotonicStateReadResult ¶
func NewMonotonicStateReadResult(request MonotonicStateReadRequest, counter uint64, stateSHA256 string) (MonotonicStateReadResult, error)
type PreparedRelease ¶
type PreparedRelease struct {
// contains filtered or unexported fields
}
func (PreparedRelease) Identity ¶
func (prepared PreparedRelease) Identity() ReleaseIdentity
func (PreparedRelease) SourcePolicy ¶
func (prepared PreparedRelease) SourcePolicy() releasecontract.SourcePolicyV2
func (PreparedRelease) SourceTrustKey ¶
func (prepared PreparedRelease) SourceTrustKey() SourceTrustKey
func (PreparedRelease) StateSHA256 ¶
func (prepared PreparedRelease) StateSHA256() string
type ReleaseDocumentKind ¶
type ReleaseDocumentKind string
const ( ReleaseDocumentRootDelegation ReleaseDocumentKind = "root_delegation" ReleaseDocumentSourcePolicy ReleaseDocumentKind = "source_policy" ReleaseDocumentSourcePolicyPointer ReleaseDocumentKind = "source_policy_pointer" ReleaseDocumentRevocation ReleaseDocumentKind = "revocation" ReleaseDocumentRevocationPointer ReleaseDocumentKind = "revocation_pointer" )
type ReleaseDocumentRequest ¶
type ReleaseDocumentRequest struct {
// contains filtered or unexported fields
}
func (ReleaseDocumentRequest) Channel ¶
func (request ReleaseDocumentRequest) Channel() string
func (ReleaseDocumentRequest) Kind ¶
func (request ReleaseDocumentRequest) Kind() ReleaseDocumentKind
func (ReleaseDocumentRequest) Locator ¶
func (request ReleaseDocumentRequest) Locator() SourceRelativeLocator
func (ReleaseDocumentRequest) MaxBytes ¶
func (request ReleaseDocumentRequest) MaxBytes() int64
func (ReleaseDocumentRequest) SourceID ¶
func (request ReleaseDocumentRequest) SourceID() string
type ReleaseDocumentResult ¶
type ReleaseDocumentResult struct {
// contains filtered or unexported fields
}
func NewReleaseDocumentResult ¶
func NewReleaseDocumentResult(request ReleaseDocumentRequest, transportToken string, value []byte) (ReleaseDocumentResult, error)
type ReleaseDocumentTransport ¶
type ReleaseDocumentTransport interface {
FetchReleaseDocument(ctx context.Context, request ReleaseDocumentRequest) (ReleaseDocumentResult, error)
}
type ReleaseIdentity ¶
type ReleaseSigningLedgerStateV1 ¶
type ReleaseSigningLedgerStateV1 struct {
CheckpointSHA256 string `json:"checkpoint_sha256"`
Checkpoint releasecontract.SigningLedgerCheckpointV1 `json:"checkpoint"`
}
type ReleaseTrustAdapters ¶
type ReleaseTrustAdapters struct {
Documents ReleaseDocumentTransport
Ledger SigningLedgerTransport
State SourceTrustStateStore
TrustedTime TrustedTimeAdapter
Monotonic MonotonicStateAdapter
Fence SourceFenceCoordinator
}
type ReleaseTrustChannelStateV1 ¶
type ReleaseTrustChannelStateV1 struct {
Channel string `json:"channel"`
Policy *ReleaseTrustDocumentHeadV1 `json:"policy,omitempty"`
Revocation *ReleaseTrustDocumentHeadV1 `json:"revocation,omitempty"`
FenceGeneration uint64 `json:"fence_generation,omitempty"`
Fence *ReleaseTrustFenceV1 `json:"fence,omitempty"`
}
type ReleaseTrustDocumentHeadV1 ¶
type ReleaseTrustDocumentHeadV1 struct {
PointerLocator string `json:"pointer_locator"`
PointerTransportToken string `json:"pointer_transport_token"`
PointerEpoch string `json:"pointer_epoch"`
PointerSHA256 string `json:"pointer_sha256"`
DocumentLocator string `json:"document_locator"`
DocumentTransportToken string `json:"document_transport_token"`
DocumentSHA256 string `json:"document_sha256"`
GeneratedAt string `json:"generated_at"`
ExpiresAt string `json:"expires_at"`
KeyID string `json:"key_id"`
}
type ReleaseTrustFenceV1 ¶
type ReleaseTrustFenceV1 struct {
Generation uint64 `json:"generation"`
Reason SourceFenceReason `json:"reason"`
FencedAt string `json:"fenced_at"`
}
type ReleaseTrustOptions ¶
type ReleaseTrustOptions struct {
// contains filtered or unexported fields
}
ReleaseTrustOptions contains only immutable source trust policy. Runtime adapters are supplied separately when the service is constructed.
func NewReleaseTrustOptions ¶
func NewReleaseTrustOptions( sourceConfiguration SourceConfiguration, rootAnchor TrustAnchor, transparencyRoots []TransparencyRoot, signingLedgerRoot SigningLedgerRoot, locatorPolicy LocatorPolicy, ) (ReleaseTrustOptions, error)
func (ReleaseTrustOptions) LocatorPolicy ¶
func (options ReleaseTrustOptions) LocatorPolicy() LocatorPolicy
func (ReleaseTrustOptions) RootAnchor ¶
func (options ReleaseTrustOptions) RootAnchor() TrustAnchor
func (ReleaseTrustOptions) SigningLedgerRoot ¶
func (options ReleaseTrustOptions) SigningLedgerRoot() SigningLedgerRoot
func (ReleaseTrustOptions) SourceConfiguration ¶
func (options ReleaseTrustOptions) SourceConfiguration() SourceConfiguration
func (ReleaseTrustOptions) TransparencyRoots ¶
func (options ReleaseTrustOptions) TransparencyRoots() []TransparencyRoot
type ReleaseTrustRootHeadV1 ¶
type ReleaseTrustService ¶
type ReleaseTrustService struct {
// contains filtered or unexported fields
}
func NewReleaseTrustService ¶
func NewReleaseTrustService(options ReleaseTrustOptions, adapters ReleaseTrustAdapters) (*ReleaseTrustService, error)
func (*ReleaseTrustService) CurrentVerifiedSource ¶
func (service *ReleaseTrustService) CurrentVerifiedSource(key SourceTrustKey) (VerifiedSourceSnapshot, bool)
func (*ReleaseTrustService) FenceSource ¶
func (service *ReleaseTrustService) FenceSource(ctx context.Context, key SourceTrustKey, reason SourceFenceReason) (SourceFenceStatus, error)
func (*ReleaseTrustService) RefreshActivationLease ¶
func (service *ReleaseTrustService) RefreshActivationLease(ctx context.Context, lease ActivationLease) (ActivationLease, error)
func (*ReleaseTrustService) RefreshSource ¶
func (service *ReleaseTrustService) RefreshSource(ctx context.Context, key SourceTrustKey) (VerifiedSourceSnapshot, error)
func (*ReleaseTrustService) RefreshTrustedTime ¶
func (service *ReleaseTrustService) RefreshTrustedTime(ctx context.Context, key SourceTrustKey) (TrustedTimeStatus, error)
func (*ReleaseTrustService) String ¶
func (service *ReleaseTrustService) String() string
func (*ReleaseTrustService) ValidateActivationLease ¶
func (service *ReleaseTrustService) ValidateActivationLease(lease ActivationLease) error
type ReleaseTrustStateV1 ¶
type ReleaseTrustStateV1 struct {
SchemaVersion string `json:"schema_version"`
SourceID string `json:"source_id"`
Revision uint64 `json:"revision"`
ExternalCounter uint64 `json:"external_counter"`
Root *ReleaseTrustRootHeadV1 `json:"root,omitempty"`
TrustedTime ReleaseTrustedTimeStateV1 `json:"trusted_time"`
SigningLedger *ReleaseSigningLedgerStateV1 `json:"signing_ledger,omitempty"`
Channels []ReleaseTrustChannelStateV1 `json:"channels"`
}
type ReleaseTrustedTimeStateV1 ¶
type ReleaseTrustedTimeStateV1 struct {
Floor string `json:"floor"`
CheckpointSHA256 string `json:"checkpoint_sha256"`
Checkpoint TrustedTimeCheckpointV1 `json:"checkpoint"`
}
type ServiceSet ¶
type ServiceSet struct {
// contains filtered or unexported fields
}
func NewServiceSet ¶
func NewServiceSet(services ...*ReleaseTrustService) (*ServiceSet, error)
func (*ServiceSet) BindFenceCoordinator ¶
func (set *ServiceSet) BindFenceCoordinator(coordinator SourceFenceCoordinator) error
func (*ServiceSet) PrepareRelease ¶
func (set *ServiceSet) PrepareRelease(ctx context.Context, identity ReleaseIdentity) (PreparedRelease, error)
func (*ServiceSet) RefreshActivationLease ¶
func (set *ServiceSet) RefreshActivationLease(ctx context.Context, lease ActivationLease) (ActivationLease, error)
func (*ServiceSet) ValidateActivationLease ¶
func (set *ServiceSet) ValidateActivationLease(lease ActivationLease) error
func (*ServiceSet) VerifyCapabilityContract ¶
func (set *ServiceSet) VerifyCapabilityContract( metadata VerifiedReleaseMetadata, bundle capabilitycontract.Bundle, expected capabilitycontract.Pin, ) (capabilitycontract.VerifiedContract, error)
func (*ServiceSet) VerifyPackage ¶
func (set *ServiceSet) VerifyPackage( ctx context.Context, metadata VerifiedReleaseMetadata, signature releasecontract.PackageSignatureV1, ) (VerifiedPackage, error)
func (*ServiceSet) VerifyReleaseMetadata ¶
func (set *ServiceSet) VerifyReleaseMetadata( ctx context.Context, prepared PreparedRelease, raw []byte, signature []byte, ) (VerifiedReleaseMetadata, error)
type SigningLedgerArtifactKind ¶
type SigningLedgerArtifactKind string
const ( SigningLedgerCheckpoint SigningLedgerArtifactKind = "checkpoint" SigningLedgerEvidence SigningLedgerArtifactKind = "evidence" SigningLedgerReceipt SigningLedgerArtifactKind = "receipt" SigningLedgerInclusionProof SigningLedgerArtifactKind = "inclusion_proof" SigningLedgerLatestProof SigningLedgerArtifactKind = "latest_proof" SigningLedgerConsistencyProof SigningLedgerArtifactKind = "consistency_proof" )
type SigningLedgerRequest ¶
type SigningLedgerRequest struct {
// contains filtered or unexported fields
}
func (SigningLedgerRequest) Channel ¶
func (request SigningLedgerRequest) Channel() string
func (SigningLedgerRequest) Kind ¶
func (request SigningLedgerRequest) Kind() SigningLedgerArtifactKind
func (SigningLedgerRequest) Locator ¶
func (request SigningLedgerRequest) Locator() SourceRelativeLocator
func (SigningLedgerRequest) MaxBytes ¶
func (request SigningLedgerRequest) MaxBytes() int64
func (SigningLedgerRequest) SourceID ¶
func (request SigningLedgerRequest) SourceID() string
type SigningLedgerResult ¶
type SigningLedgerResult struct {
// contains filtered or unexported fields
}
func NewSigningLedgerResult ¶
func NewSigningLedgerResult(request SigningLedgerRequest, value []byte) (SigningLedgerResult, error)
type SigningLedgerRoot ¶
type SigningLedgerRoot struct {
// contains filtered or unexported fields
}
SigningLedgerRoot is a closed choice between an independently pinned log root and a key selected from a verified release-root delegation.
func NewDelegatedSigningLedgerRoot ¶
func NewDelegatedSigningLedgerRoot(logID, delegatedKeyID string) (SigningLedgerRoot, error)
func NewPinnedSigningLedgerRoot ¶
func NewPinnedSigningLedgerRoot(logID string, anchor TrustAnchor) (SigningLedgerRoot, error)
func (SigningLedgerRoot) DelegatedKeyID ¶
func (root SigningLedgerRoot) DelegatedKeyID() string
func (SigningLedgerRoot) LogID ¶
func (root SigningLedgerRoot) LogID() string
func (SigningLedgerRoot) Mode ¶
func (root SigningLedgerRoot) Mode() SigningLedgerRootMode
func (SigningLedgerRoot) PinnedAnchor ¶
func (root SigningLedgerRoot) PinnedAnchor() (TrustAnchor, bool)
type SigningLedgerRootMode ¶
type SigningLedgerRootMode string
const ( SigningLedgerRootPinned SigningLedgerRootMode = "pinned" SigningLedgerRootRootDelegated SigningLedgerRootMode = "root_delegated" )
type SigningLedgerTransport ¶
type SigningLedgerTransport interface {
FetchSigningLedgerArtifact(ctx context.Context, request SigningLedgerRequest) (SigningLedgerResult, error)
}
type SourceConfiguration ¶
type SourceConfiguration struct {
// contains filtered or unexported fields
}
SourceConfiguration is a sealed, immutable source identity and channel set.
func NewSourceConfiguration ¶
func NewSourceConfiguration(sourceID string, allowedChannels []string) (SourceConfiguration, error)
func (SourceConfiguration) AllowedChannels ¶
func (configuration SourceConfiguration) AllowedChannels() []string
func (SourceConfiguration) SourceID ¶
func (configuration SourceConfiguration) SourceID() string
func (SourceConfiguration) TrustKey ¶
func (configuration SourceConfiguration) TrustKey(channel string) (SourceTrustKey, error)
type SourceFenceCoordinator ¶
type SourceFenceCoordinator interface {
TeardownSourceTrust(context.Context, SourceFenceRequest) error
}
type SourceFenceReason ¶
type SourceFenceReason string
const ( SourceFenceRefreshFailed SourceFenceReason = "refresh_failed" SourceFenceExpired SourceFenceReason = "expired" SourceFenceTrustAdvanced SourceFenceReason = "trust_advanced" SourceFenceRestartRecovery SourceFenceReason = "restart_recovery" )
type SourceFenceRequest ¶
type SourceFenceRequest struct {
// contains filtered or unexported fields
}
func (SourceFenceRequest) Generation ¶
func (request SourceFenceRequest) Generation() uint64
func (SourceFenceRequest) ProcessInstanceID ¶
func (request SourceFenceRequest) ProcessInstanceID() string
func (SourceFenceRequest) Reason ¶
func (request SourceFenceRequest) Reason() SourceFenceReason
func (SourceFenceRequest) SourceTrustKey ¶
func (request SourceFenceRequest) SourceTrustKey() SourceTrustKey
func (SourceFenceRequest) StateSHA256 ¶
func (request SourceFenceRequest) StateSHA256() string
func (SourceFenceRequest) TeardownDeadline ¶
func (request SourceFenceRequest) TeardownDeadline() time.Duration
type SourceFenceStatus ¶
type SourceFenceStatus struct {
// contains filtered or unexported fields
}
func (SourceFenceStatus) Generation ¶
func (status SourceFenceStatus) Generation() uint64
func (SourceFenceStatus) Reason ¶
func (status SourceFenceStatus) Reason() SourceFenceReason
func (SourceFenceStatus) SourceTrustKey ¶
func (status SourceFenceStatus) SourceTrustKey() SourceTrustKey
func (SourceFenceStatus) StateSHA256 ¶
func (status SourceFenceStatus) StateSHA256() string
type SourceRelativeLocator ¶
type SourceRelativeLocator struct {
// contains filtered or unexported fields
}
func (SourceRelativeLocator) String ¶
func (locator SourceRelativeLocator) String() string
type SourceTrustKey ¶
type SourceTrustKey struct {
// contains filtered or unexported fields
}
SourceTrustKey identifies channel-scoped trust state. Values can only be derived from a validated SourceConfiguration.
func (SourceTrustKey) Channel ¶
func (key SourceTrustKey) Channel() string
func (SourceTrustKey) SourceID ¶
func (key SourceTrustKey) SourceID() string
func (SourceTrustKey) String ¶
func (key SourceTrustKey) String() string
type SourceTrustStateCommitRequest ¶
type SourceTrustStateCommitRequest struct {
// contains filtered or unexported fields
}
func (SourceTrustStateCommitRequest) NextStateBytes ¶
func (request SourceTrustStateCommitRequest) NextStateBytes() []byte
func (SourceTrustStateCommitRequest) NextStateSHA256 ¶
func (request SourceTrustStateCommitRequest) NextStateSHA256() string
func (SourceTrustStateCommitRequest) PendingSHA256 ¶
func (request SourceTrustStateCommitRequest) PendingSHA256() string
func (SourceTrustStateCommitRequest) SourceID ¶
func (request SourceTrustStateCommitRequest) SourceID() string
type SourceTrustStateLoadRequest ¶
type SourceTrustStateLoadRequest struct {
// contains filtered or unexported fields
}
func (SourceTrustStateLoadRequest) SourceID ¶
func (request SourceTrustStateLoadRequest) SourceID() string
type SourceTrustStateLoadResult ¶
type SourceTrustStateLoadResult struct {
// contains filtered or unexported fields
}
func NewSourceTrustStateLoadResult ¶
func NewSourceTrustStateLoadResult(request SourceTrustStateLoadRequest, committed, pending []byte) (SourceTrustStateLoadResult, error)
type SourceTrustStatePrepareRequest ¶
type SourceTrustStatePrepareRequest struct {
// contains filtered or unexported fields
}
func (SourceTrustStatePrepareRequest) ExpectedCommittedSHA256 ¶
func (request SourceTrustStatePrepareRequest) ExpectedCommittedSHA256() string
func (SourceTrustStatePrepareRequest) PendingBytes ¶
func (request SourceTrustStatePrepareRequest) PendingBytes() []byte
func (SourceTrustStatePrepareRequest) PendingSHA256 ¶
func (request SourceTrustStatePrepareRequest) PendingSHA256() string
func (SourceTrustStatePrepareRequest) SourceID ¶
func (request SourceTrustStatePrepareRequest) SourceID() string
type SourceTrustStateStore ¶
type SourceTrustStateStore interface {
LoadSourceTrustState(context.Context, SourceTrustStateLoadRequest) (SourceTrustStateLoadResult, error)
PrepareSourceTrustState(context.Context, SourceTrustStatePrepareRequest) (StateMutationOutcome, error)
CommitSourceTrustState(context.Context, SourceTrustStateCommitRequest) (StateMutationOutcome, error)
}
type StateMutationOutcome ¶
type StateMutationOutcome string
const ( StateMutationApplied StateMutationOutcome = "applied" StateMutationConflict StateMutationOutcome = "conflict" StateMutationUnknown StateMutationOutcome = "unknown" )
type TransparencyRoot ¶
type TransparencyRoot struct {
// contains filtered or unexported fields
}
TransparencyRoot is a closed choice between a pinned transparency key and a trusted-time key selected from a verified release-root delegation.
func NewDelegatedTransparencyRoot ¶
func NewDelegatedTransparencyRoot(logID, delegatedKeyID string) (TransparencyRoot, error)
func NewTransparencyRoot ¶
func NewTransparencyRoot(logID string, anchor TrustAnchor) (TransparencyRoot, error)
func (TransparencyRoot) Anchor ¶
func (root TransparencyRoot) Anchor() TrustAnchor
func (TransparencyRoot) DelegatedKeyID ¶
func (root TransparencyRoot) DelegatedKeyID() string
func (TransparencyRoot) LogID ¶
func (root TransparencyRoot) LogID() string
func (TransparencyRoot) Mode ¶
func (root TransparencyRoot) Mode() TransparencyRootMode
type TransparencyRootMode ¶
type TransparencyRootMode string
const ( TransparencyRootPinned TransparencyRootMode = "pinned" TransparencyRootRootDelegated TransparencyRootMode = "root_delegated" )
type TrustAnchor ¶
type TrustAnchor struct {
// contains filtered or unexported fields
}
TrustAnchor is an owned public verification key.
func NewEd25519TrustAnchor ¶
func NewEd25519TrustAnchor(keyID string, publicKey []byte) (TrustAnchor, error)
func (TrustAnchor) Algorithm ¶
func (anchor TrustAnchor) Algorithm() string
func (TrustAnchor) KeyID ¶
func (anchor TrustAnchor) KeyID() string
func (TrustAnchor) PublicKey ¶
func (anchor TrustAnchor) PublicKey() []byte
type TrustedTimeAdapter ¶
type TrustedTimeAdapter interface {
Observe(context.Context, TrustedTimeRequest) (TrustedTimeObservation, error)
}
type TrustedTimeCheckpointV1 ¶
type TrustedTimeEvidenceV1 ¶
type TrustedTimeEvidenceV1 struct {
SchemaVersion string `json:"schema_version"`
Kind string `json:"kind"`
Leaf TrustedTimeLeafV1 `json:"leaf"`
LeafSHA256 string `json:"leaf_sha256"`
IntegratedTime string `json:"integrated_time"`
SignedEntryTimestamp string `json:"signed_entry_timestamp"`
Checkpoint TrustedTimeCheckpointV1 `json:"checkpoint"`
LeafIndex uint64 `json:"leaf_index"`
InclusionProof []string `json:"inclusion_proof"`
ConsistencyProof []string `json:"consistency_proof"`
}
type TrustedTimeLeafV1 ¶
type TrustedTimeLeafV1 struct {
SchemaVersion string `json:"schema_version"`
SourceID string `json:"source_id"`
Channel string `json:"channel"`
Nonce string `json:"nonce"`
MinimumTime string `json:"minimum_time"`
ClaimedTime string `json:"claimed_time"`
RequestSHA256 string `json:"request_sha256"`
LogID string `json:"log_id"`
}
type TrustedTimeObservation ¶
type TrustedTimeObservation struct {
// contains filtered or unexported fields
}
func NewTransparencyTimeObservation ¶
func NewTransparencyTimeObservation(request TrustedTimeRequest, evidence []byte) (TrustedTimeObservation, error)
type TrustedTimeRequest ¶
type TrustedTimeRequest struct {
// contains filtered or unexported fields
}
func (TrustedTimeRequest) LogID ¶
func (request TrustedTimeRequest) LogID() string
func (TrustedTimeRequest) MinimumTime ¶
func (request TrustedTimeRequest) MinimumTime() string
func (TrustedTimeRequest) Nonce ¶
func (request TrustedTimeRequest) Nonce() string
func (TrustedTimeRequest) RequestSHA256 ¶
func (request TrustedTimeRequest) RequestSHA256() string
func (TrustedTimeRequest) SourceTrustKey ¶
func (request TrustedTimeRequest) SourceTrustKey() SourceTrustKey
type TrustedTimeStatus ¶
type TrustedTimeStatus struct {
// contains filtered or unexported fields
}
func (TrustedTimeStatus) CheckpointSHA256 ¶
func (status TrustedTimeStatus) CheckpointSHA256() string
func (TrustedTimeStatus) Floor ¶
func (status TrustedTimeStatus) Floor() time.Time
func (TrustedTimeStatus) ProcessInstanceID ¶
func (status TrustedTimeStatus) ProcessInstanceID() string
func (TrustedTimeStatus) SourceTrustKey ¶
func (status TrustedTimeStatus) SourceTrustKey() SourceTrustKey
func (TrustedTimeStatus) StateSHA256 ¶
func (status TrustedTimeStatus) StateSHA256() string
type VerifiedPackage ¶
type VerifiedPackage struct {
// contains filtered or unexported fields
}
func (VerifiedPackage) AuthorizeActivation ¶
func (verified VerifiedPackage) AuthorizeActivation() (ActivationLease, error)
func (VerifiedPackage) PackageSignature ¶
func (verified VerifiedPackage) PackageSignature() releasecontract.PackageSignatureV1
func (VerifiedPackage) ReleaseMetadata ¶
func (verified VerifiedPackage) ReleaseMetadata() VerifiedReleaseMetadata
type VerifiedReleaseMetadata ¶
type VerifiedReleaseMetadata struct {
// contains filtered or unexported fields
}
func (VerifiedReleaseMetadata) CanonicalBytes ¶
func (verified VerifiedReleaseMetadata) CanonicalBytes() []byte
func (VerifiedReleaseMetadata) Document ¶
func (verified VerifiedReleaseMetadata) Document() releasecontract.ReleaseMetadataV5
func (VerifiedReleaseMetadata) PreparedRelease ¶
func (verified VerifiedReleaseMetadata) PreparedRelease() PreparedRelease
type VerifiedSourceSnapshot ¶
type VerifiedSourceSnapshot struct {
// contains filtered or unexported fields
}
func (VerifiedSourceSnapshot) ProcessInstanceID ¶
func (snapshot VerifiedSourceSnapshot) ProcessInstanceID() string
func (VerifiedSourceSnapshot) Revocation ¶
func (snapshot VerifiedSourceSnapshot) Revocation() releasecontract.RevocationV2
func (VerifiedSourceSnapshot) RootDelegation ¶
func (snapshot VerifiedSourceSnapshot) RootDelegation() releasecontract.RootDelegationV1
func (VerifiedSourceSnapshot) SourcePolicy ¶
func (snapshot VerifiedSourceSnapshot) SourcePolicy() releasecontract.SourcePolicyV2
func (VerifiedSourceSnapshot) SourceTrustKey ¶
func (snapshot VerifiedSourceSnapshot) SourceTrustKey() SourceTrustKey
func (VerifiedSourceSnapshot) StateSHA256 ¶
func (snapshot VerifiedSourceSnapshot) StateSHA256() string
func (VerifiedSourceSnapshot) TrustedFloor ¶
func (snapshot VerifiedSourceSnapshot) TrustedFloor() time.Time
type VerifiedTrustedTime ¶
type VerifiedTrustedTime struct {
// contains filtered or unexported fields
}
func (VerifiedTrustedTime) Checkpoint ¶
func (verified VerifiedTrustedTime) Checkpoint() TrustedTimeCheckpointV1
func (VerifiedTrustedTime) CheckpointSHA256 ¶
func (verified VerifiedTrustedTime) CheckpointSHA256() string
func (VerifiedTrustedTime) Floor ¶
func (verified VerifiedTrustedTime) Floor() time.Time
func (VerifiedTrustedTime) SourceTrustKey ¶
func (verified VerifiedTrustedTime) SourceTrustKey() SourceTrustKey