releasecontract

package
v0.6.11 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 24, 2026 License: MIT Imports: 17 Imported by: 0

Documentation

Overview

Package releasecontract defines the host-neutral canonical wire and signing preimages for plugin release trust documents. It does not select trusted keys or read the system clock; callers provide timestamps, signatures, and the verifier that enforces their source policy.

Index

Constants

View Source 
const (
	RootDelegationSchemaVersion        = "redevplugin.release_root_delegation.v1"
	PackageSignatureSchemaVersion      = "redevplugin.package_signature.v1"
	ReleaseMetadataSchemaVersion       = "redevplugin.release_metadata.v5"
	SourcePolicySchemaVersion          = "redevplugin.release_source_policy.v2"
	SourcePolicyPointerSchemaVersion   = "redevplugin.release_source_policy_pointer.v1"
	RevocationSchemaVersion            = "redevplugin.release_revocation.v2"
	RevocationPointerSchemaVersion     = "redevplugin.release_revocation_pointer.v1"
	SigningLedgerEvidenceSchemaVersion = "redevplugin.release_signing_ledger_evidence.v1"
	SigningLedgerSchemaVersion         = "redevplugin.release_signing_ledger.v1"
	SigningLedgerEntrySchemaVersion    = "redevplugin.release_signing_ledger_entry.v1"
	SigningLedgerLogLeafSchemaVersion  = "redevplugin.release_signing_ledger_log_leaf.v1"
	SigningSubjectSchemaVersion        = "redevplugin.release_signing_subject.v1"
	SigningEnvelopeSchemaVersion       = "redevplugin.release_signature_envelope.v1"
	SigningLedgerReceiptSchemaVersion  = "redevplugin.release_signing_ledger_receipt.v1"

	SignatureAlgorithmEd25519 = "ed25519"

	GenesisPreviousEpoch          = "0"
	GenesisPreviousDocumentSHA256 = "0000000000000000000000000000000000000000000000000000000000000000"
)
View Source 
const SigningLedgerLatestProofDepth = 256

Variables

View Source 
var (
	ErrInvalidDocument  = errors.New("release contract document is invalid")
	ErrInvalidSignature = errors.New("release contract signature is invalid")
	ErrVerifierRequired = errors.New("release contract signature verifier is required")
	ErrUnsupportedUsage = errors.New("release contract signing usage is unsupported")
)
View Source 
var ErrInvalidLedgerProof = errors.New("release signing ledger proof is invalid")

Functions

func CanonicalPackageSignature 

func CanonicalPackageSignature(context PackageVerificationContext, document PackageSignatureV1) ([]byte, error)

func CanonicalReleaseMetadata 

func CanonicalReleaseMetadata(document ReleaseMetadataV5) ([]byte, error)

func CanonicalRevocation 

func CanonicalRevocation(document RevocationV2) ([]byte, error)

func CanonicalRevocationPointer 

func CanonicalRevocationPointer(document RevocationPointerV1) ([]byte, error)

func CanonicalRootDelegation 

func CanonicalRootDelegation(document RootDelegationV1) ([]byte, error)

func CanonicalSignatureEnvelope 

func CanonicalSignatureEnvelope(envelope SignatureEnvelopeV1) ([]byte, error)

func CanonicalSigningLedgerCheckpoint 

func CanonicalSigningLedgerCheckpoint(checkpoint SigningLedgerCheckpointV1) ([]byte, error)

func CanonicalSigningLedgerConsistencyProof 

func CanonicalSigningLedgerConsistencyProof(proof SigningLedgerConsistencyProofV1) ([]byte, error)

func CanonicalSigningLedgerEntry 

func CanonicalSigningLedgerEntry(entry SigningLedgerEntryV1) ([]byte, error)

func CanonicalSigningLedgerEvidence 

func CanonicalSigningLedgerEvidence(evidence SigningLedgerEvidenceV1) ([]byte, error)

func CanonicalSigningLedgerInclusionProof 

func CanonicalSigningLedgerInclusionProof(proof SigningLedgerInclusionProofV1) ([]byte, error)

func CanonicalSigningLedgerLatestProof 

func CanonicalSigningLedgerLatestProof(proof SigningLedgerLatestProofV1) ([]byte, error)

func CanonicalSigningLedgerLogLeaf 

func CanonicalSigningLedgerLogLeaf(leaf SigningLedgerLogLeafV1) ([]byte, error)

func CanonicalSigningLedgerReceipt 

func CanonicalSigningLedgerReceipt(receipt SigningLedgerReceiptV1) ([]byte, error)

func CanonicalSigningSubject 

func CanonicalSigningSubject(subject SigningSubjectV1) ([]byte, error)

func CanonicalSourcePolicy 

func CanonicalSourcePolicy(document SourcePolicyV2) ([]byte, error)

func CanonicalSourcePolicyPointer 

func CanonicalSourcePolicyPointer(document SourcePolicyPointerV1) ([]byte, error)

func PackageSigningPreimage 

func PackageSigningPreimage(input PackageSigningInput) ([]byte, error)

func ReleaseMetadataSigningPreimage 

func ReleaseMetadataSigningPreimage(channel string, document ReleaseMetadataV5) ([]byte, error)

func RevocationPointerSigningPreimage 

func RevocationPointerSigningPreimage(input ReleasePointerInput) ([]byte, error)

func RevocationSigningPreimage 

func RevocationSigningPreimage(input RevocationInput) ([]byte, error)

func RootDelegationSigningPreimage 

func RootDelegationSigningPreimage(input RootDelegationInput) ([]byte, error)

func SignatureEnvelopeSHA256 

func SignatureEnvelopeSHA256(envelope SignatureEnvelopeV1) (string, error)

func SigningLedgerCheckpointSigningPreimage 

func SigningLedgerCheckpointSigningPreimage(checkpoint SigningLedgerCheckpointV1) ([]byte, error)

func SigningLedgerReceiptSigningPreimage 

func SigningLedgerReceiptSigningPreimage(receipt SigningLedgerReceiptV1) ([]byte, error)

func SigningSubjectIdentitySHA256 

func SigningSubjectIdentitySHA256(subject SigningSubjectV1) (string, error)

func SourcePolicyPointerSigningPreimage 

func SourcePolicyPointerSigningPreimage(input ReleasePointerInput) ([]byte, error)

func SourcePolicySigningPreimage 

func SourcePolicySigningPreimage(input SourcePolicyInput) ([]byte, error)

func VerifyPackageSignature 

func VerifyPackageSignature(context PackageVerificationContext, document PackageSignatureV1, verifier SignatureVerifier) error

func VerifyReleaseMetadata 

func VerifyReleaseMetadata(channel string, document ReleaseMetadataV5, signature []byte, verifier SignatureVerifier) error

func VerifyRevocation 

func VerifyRevocation(document RevocationV2, verifier SignatureVerifier) error

func VerifyRevocationPointer 

func VerifyRevocationPointer(document RevocationPointerV1, verifier SignatureVerifier) error

func VerifyRootDelegation 

func VerifyRootDelegation(document RootDelegationV1, verifier SignatureVerifier) error

func VerifySignatureEnvelope 

func VerifySignatureEnvelope(subject SigningSubjectV1, signingPreimage []byte, envelope SignatureEnvelopeV1, verifier SignatureVerifier) error

func VerifySigningLedgerCheckpoint 

func VerifySigningLedgerCheckpoint(checkpoint SigningLedgerCheckpointV1, verifier SignatureVerifier) error

func VerifySigningLedgerConsistency 

func VerifySigningLedgerConsistency(previous, current SigningLedgerCheckpointV1, proof SigningLedgerConsistencyProofV1, verifier SignatureVerifier) error

func VerifySigningLedgerInclusion 

func VerifySigningLedgerInclusion(receipt SigningLedgerReceiptV1, proof SigningLedgerInclusionProofV1, checkpoint SigningLedgerCheckpointV1, verifier SignatureVerifier) error

func VerifySigningLedgerLatest 

func VerifySigningLedgerLatest(receipt SigningLedgerReceiptV1, proof SigningLedgerLatestProofV1, checkpoint SigningLedgerCheckpointV1, verifier SignatureVerifier) error

func VerifySigningLedgerReceipt 

func VerifySigningLedgerReceipt(receipt SigningLedgerReceiptV1, checkpoint SigningLedgerCheckpointV1, verifier SignatureVerifier) error

func VerifySourcePolicy 

func VerifySourcePolicy(document SourcePolicyV2, verifier SignatureVerifier) error

func VerifySourcePolicyPointer 

func VerifySourcePolicyPointer(document SourcePolicyPointerV1, verifier SignatureVerifier) error

Types

type DelegatedKeyUsage 

type DelegatedKeyUsage string
const (
	DelegatedKeyUsagePackage                DelegatedKeyUsage = "package"
	DelegatedKeyUsageReleaseMetadata        DelegatedKeyUsage = "release_metadata"
	DelegatedKeyUsageHostCapabilityContract DelegatedKeyUsage = "host_capability_contract"
	DelegatedKeyUsageSourcePolicy           DelegatedKeyUsage = "source_policy_document"
	DelegatedKeyUsageSourcePolicyPointer    DelegatedKeyUsage = "source_policy_pointer"
	DelegatedKeyUsageRevocation             DelegatedKeyUsage = "revocation_document"
	DelegatedKeyUsageRevocationPointer      DelegatedKeyUsage = "revocation_pointer"
	DelegatedKeyUsageSigningLedger          DelegatedKeyUsage = "signing_ledger"
	DelegatedKeyUsageTrustedTime            DelegatedKeyUsage = "trusted_time"
)

type Ed25519PublicKeyVerifier 

type Ed25519PublicKeyVerifier map[string]ed25519.PublicKey

func (Ed25519PublicKeyVerifier) VerifySignature 

func (keys Ed25519PublicKeyVerifier) VerifySignature(request SignatureVerificationRequest) error

type HostCapabilityContractRef 

type HostCapabilityContractRef struct {
	PublisherID              string `json:"publisher_id"`
	ContractID               string `json:"contract_id"`
	ContractVersion          string `json:"contract_version"`
	ArtifactRef              string `json:"artifact_ref"`
	ArtifactSHA256           string `json:"artifact_sha256"`
	ManifestRef              string `json:"manifest_ref"`
	ManifestSHA256           string `json:"manifest_sha256"`
	SignatureRef             string `json:"signature_ref"`
	SignatureSHA256          string `json:"signature_sha256"`
	SignatureKeyID           string `json:"signature_key_id"`
	SignaturePolicyEpoch     string `json:"signature_policy_epoch"`
	SignatureRevocationEpoch string `json:"signature_revocation_epoch"`
	CompatibilityRef         string `json:"compatibility_ref"`
	CompatibilitySHA256      string `json:"compatibility_sha256"`
	GeneratedClientRef       string `json:"generated_client_ref"`
	GeneratedClientSHA256    string `json:"generated_client_sha256"`
	NoticesRef               string `json:"notices_ref"`
	NoticesSHA256            string `json:"notices_sha256"`
}

type HostCapabilityRequirementRef 

type HostCapabilityRequirementRef struct {
	CapabilityID      string                    `json:"capability_id"`
	CapabilityVersion string                    `json:"capability_version"`
	Contract          HostCapabilityContractRef `json:"contract"`
}

type PackageReleaseSignatureRef 

type PackageReleaseSignatureRef struct {
	Algorithm          string `json:"algorithm"`
	KeyID              string `json:"key_id"`
	SignatureBundleRef string `json:"signature_bundle_ref"`
	SourcePolicyEpoch  string `json:"source_policy_epoch"`
	RevocationEpoch    string `json:"revocation_epoch"`
}

type PackageSignatureV1 

type PackageSignatureV1 struct {
	SchemaVersion string `json:"schema_version"`
	Algorithm     string `json:"algorithm"`
	KeyID         string `json:"key_id"`
	PublisherID   string `json:"publisher_id,omitempty"`
	PluginID      string `json:"plugin_id,omitempty"`
	PackageHash   string `json:"package_hash"`
	ManifestHash  string `json:"manifest_hash"`
	EntriesHash   string `json:"entries_hash"`
	Signature     string `json:"signature"`
	SignedAt      string `json:"signed_at,omitempty"`
}

func BuildPackageSignature 

func BuildPackageSignature(input PackageSigningInput, signature []byte) (PackageSignatureV1, error)

func DecodePackageSignature 

func DecodePackageSignature(raw []byte, context PackageVerificationContext) (PackageSignatureV1, error)

type PackageSigningInput 

type PackageSigningInput struct {
	SourceID     string
	Channel      string
	Version      string
	Algorithm    string
	KeyID        string
	PublisherID  string
	PluginID     string
	PackageHash  string
	ManifestHash string
	EntriesHash  string
	SignedAt     string
}

type PackageVerificationContext 

type PackageVerificationContext struct {
	SourceID string
	Channel  string
	Version  string
}

type ReleaseCompatibility 

type ReleaseCompatibility struct {
	MinReDevPluginVersion string   `json:"min_redevplugin_version"`
	MinRuntimeVersion     string   `json:"min_runtime_version"`
	UIProtocolVersion     string   `json:"ui_protocol_version"`
	SupportedTargets      []string `json:"supported_targets,omitempty"`
}

type ReleaseDistributionRef 

type ReleaseDistributionRef struct {
	Distribution string `json:"distribution"`
	ArtifactRef  string `json:"artifact_ref"`
}

type ReleaseEvidence 

type ReleaseEvidence struct {
	NoticesSHA256    string `json:"notices_sha256,omitempty"`
	ProvenanceSHA256 string `json:"provenance_sha256,omitempty"`
	GeneratedAt      string `json:"generated_at,omitempty"`
}

type ReleaseHostRequirement 

type ReleaseHostRequirement struct {
	HostID                      string                         `json:"host_id"`
	MinHostVersion              string                         `json:"min_host_version,omitempty"`
	RequiredCapabilityContracts []HostCapabilityRequirementRef `json:"required_capability_contracts,omitempty"`
}

type ReleaseMetadataSignatureRef 

type ReleaseMetadataSignatureRef struct {
	Algorithm         string `json:"algorithm"`
	KeyID             string `json:"key_id"`
	SignatureRef      string `json:"signature_ref"`
	SourcePolicyEpoch string `json:"source_policy_epoch"`
	RevocationEpoch   string `json:"revocation_epoch"`
}

type ReleaseMetadataV5 

type ReleaseMetadataV5 struct {
	SchemaVersion            string                      `json:"schema_version"`
	SourceID                 string                      `json:"source_id"`
	ReleaseMetadataRef       string                      `json:"release_metadata_ref"`
	PublisherID              string                      `json:"publisher_id"`
	PluginID                 string                      `json:"plugin_id"`
	Version                  string                      `json:"version"`
	DistributionRef          ReleaseDistributionRef      `json:"distribution_ref"`
	Hashes                   ReleasePackageHashSet       `json:"hashes"`
	ReleaseMetadataSignature ReleaseMetadataSignatureRef `json:"release_metadata_signature"`
	PackageSignature         PackageReleaseSignatureRef  `json:"package_signature"`
	Compatibility            ReleaseCompatibility        `json:"compatibility"`
	HostRequirements         []ReleaseHostRequirement    `json:"host_requirements,omitempty"`
	ReleaseEvidence          *ReleaseEvidence            `json:"release_evidence,omitempty"`
	Metadata                 map[string]string           `json:"metadata,omitempty"`
}

func BuildReleaseMetadata 

func BuildReleaseMetadata(document ReleaseMetadataV5) (ReleaseMetadataV5, error)

func DecodeReleaseMetadata 

func DecodeReleaseMetadata(raw []byte) (ReleaseMetadataV5, error)

type ReleasePackageHashSet 

type ReleasePackageHashSet struct {
	PackageSHA256  string `json:"package_sha256"`
	ManifestSHA256 string `json:"manifest_sha256"`
	EntriesSHA256  string `json:"entries_sha256"`
}

type ReleasePointerInput 

type ReleasePointerInput struct {
	SourceID               string
	Channel                string
	Epoch                  string
	PreviousEpoch          string
	PreviousDocumentSHA256 string
	Ref                    string
	DocumentSHA256         string
	GeneratedAt            string
	ExpiresAt              string
	KeyID                  string
}

type RevocationInput 

type RevocationInput struct {
	SourceID               string
	Channel                string
	Epoch                  string
	PreviousEpoch          string
	PreviousDocumentSHA256 string
	RootEpoch              string
	GeneratedAt            string
	ExpiresAt              string
	RevokedKeyIDs          []string
	RevokedReleases        []RevokedRelease
	KeyID                  string
}

type RevocationPointerV1 

type RevocationPointerV1 struct {
	SchemaVersion          string `json:"schema_version"`
	SourceID               string `json:"source_id"`
	Channel                string `json:"channel"`
	Epoch                  string `json:"epoch"`
	PreviousEpoch          string `json:"previous_epoch"`
	PreviousDocumentSHA256 string `json:"previous_document_sha256"`
	Ref                    string `json:"ref"`
	DocumentSHA256         string `json:"document_sha256"`
	GeneratedAt            string `json:"generated_at"`
	ExpiresAt              string `json:"expires_at"`
	KeyID                  string `json:"key_id"`
	Signature              string `json:"signature"`
}

func BuildRevocationPointer 

func BuildRevocationPointer(input ReleasePointerInput, signature []byte) (RevocationPointerV1, error)

func DecodeRevocationPointer 

func DecodeRevocationPointer(raw []byte) (RevocationPointerV1, error)

type RevocationV2 

type RevocationV2 struct {
	SchemaVersion          string           `json:"schema_version"`
	SourceID               string           `json:"source_id"`
	Channel                string           `json:"channel"`
	Epoch                  string           `json:"epoch"`
	PreviousEpoch          string           `json:"previous_epoch"`
	PreviousDocumentSHA256 string           `json:"previous_document_sha256"`
	RootEpoch              string           `json:"root_epoch"`
	GeneratedAt            string           `json:"generated_at"`
	ExpiresAt              string           `json:"expires_at"`
	RevokedKeyIDs          []string         `json:"revoked_key_ids"`
	RevokedReleases        []RevokedRelease `json:"revoked_releases"`
	KeyID                  string           `json:"key_id"`
	Signature              string           `json:"signature"`
}

func BuildRevocation 

func BuildRevocation(input RevocationInput, signature []byte) (RevocationV2, error)

func DecodeRevocation 

func DecodeRevocation(raw []byte) (RevocationV2, error)

type RevokedRelease 

type RevokedRelease struct {
	PublisherID           string `json:"publisher_id"`
	PluginID              string `json:"plugin_id"`
	Version               string `json:"version"`
	ReleaseMetadataSHA256 string `json:"release_metadata_sha256"`
	RevokedAt             string `json:"revoked_at"`
}

type RootDelegatedKey 

type RootDelegatedKey struct {
	Algorithm  string              `json:"algorithm"`
	KeyID      string              `json:"key_id"`
	PublicKey  string              `json:"public_key"`
	Usages     []DelegatedKeyUsage `json:"usages"`
	Channels   []string            `json:"channels"`
	ValidFrom  string              `json:"valid_from"`
	ValidUntil string              `json:"valid_until"`
}

type RootDelegationInput 

type RootDelegationInput struct {
	SourceID                 string
	RootEpoch                string
	PreviousRootEpoch        string
	PreviousDelegationSHA256 string
	GeneratedAt              string
	ExpiresAt                string
	DelegatedKeys            []RootDelegatedKey
	KeyID                    string
}

type RootDelegationV1 

type RootDelegationV1 struct {
	SchemaVersion            string             `json:"schema_version"`
	SourceID                 string             `json:"source_id"`
	RootEpoch                string             `json:"root_epoch"`
	PreviousRootEpoch        string             `json:"previous_root_epoch"`
	PreviousDelegationSHA256 string             `json:"previous_delegation_sha256"`
	GeneratedAt              string             `json:"generated_at"`
	ExpiresAt                string             `json:"expires_at"`
	DelegatedKeys            []RootDelegatedKey `json:"delegated_keys"`
	KeyID                    string             `json:"key_id"`
	Signature                string             `json:"signature"`
}

func BuildRootDelegation 

func BuildRootDelegation(input RootDelegationInput, signature []byte) (RootDelegationV1, error)

func DecodeRootDelegation 

func DecodeRootDelegation(raw []byte) (RootDelegationV1, error)

type SignatureEnvelopeV1 

type SignatureEnvelopeV1 struct {
	SchemaVersion         string `json:"schema_version"`
	SubjectIdentitySHA256 string `json:"subject_identity_sha256"`
	SigningPreimageSHA256 string `json:"signing_preimage_sha256"`
	Algorithm             string `json:"algorithm"`
	KeyID                 string `json:"key_id"`
	Signature             string `json:"signature"`
}

func DecodeSignatureEnvelope 

func DecodeSignatureEnvelope(raw []byte) (SignatureEnvelopeV1, error)

type SignatureVerificationRequest 

type SignatureVerificationRequest struct {
	Usage                 SigningUsage
	KeyID                 string
	SigningPreimageSHA256 [sha256.Size]byte
	Signature             []byte
}

type SignatureVerifier 

type SignatureVerifier interface {
	VerifySignature(SignatureVerificationRequest) error
}

type SignatureVerifierFunc 

type SignatureVerifierFunc func(SignatureVerificationRequest) error

func (SignatureVerifierFunc) VerifySignature 

func (verify SignatureVerifierFunc) VerifySignature(request SignatureVerificationRequest) error

type SigningLedgerArtifactKind 

type SigningLedgerArtifactKind string
const (
	SigningLedgerArtifactCheckpoint       SigningLedgerArtifactKind = "checkpoint"
	SigningLedgerArtifactInclusionProof   SigningLedgerArtifactKind = "inclusion_proof"
	SigningLedgerArtifactLatestProof      SigningLedgerArtifactKind = "latest_proof"
	SigningLedgerArtifactConsistencyProof SigningLedgerArtifactKind = "consistency_proof"
)

type SigningLedgerCheckpointV1 

type SigningLedgerCheckpointV1 struct {
	SchemaVersion     string                    `json:"schema_version"`
	Kind              SigningLedgerArtifactKind `json:"kind"`
	LogID             string                    `json:"log_id"`
	TreeSize          uint64                    `json:"tree_size"`
	LogRootHash       string                    `json:"log_root_hash"`
	LatestMapRootHash string                    `json:"latest_map_root_hash"`
	CheckpointTime    string                    `json:"checkpoint_time"`
	KeyID             string                    `json:"key_id"`
	Signature         string                    `json:"signature"`
}

func DecodeSigningLedgerCheckpoint 

func DecodeSigningLedgerCheckpoint(raw []byte) (SigningLedgerCheckpointV1, error)

type SigningLedgerConsistencyProofV1 

type SigningLedgerConsistencyProofV1 struct {
	SchemaVersion string                    `json:"schema_version"`
	Kind          SigningLedgerArtifactKind `json:"kind"`
	LogID         string                    `json:"log_id"`
	OldTreeSize   uint64                    `json:"old_tree_size"`
	NewTreeSize   uint64                    `json:"new_tree_size"`
	Nodes         []string                  `json:"nodes"`
}

func DecodeSigningLedgerConsistencyProof 

func DecodeSigningLedgerConsistencyProof(raw []byte) (SigningLedgerConsistencyProofV1, error)

type SigningLedgerEntryState 

type SigningLedgerEntryState string
const (
	SigningLedgerEntryReserved       SigningLedgerEntryState = "reserved"
	SigningLedgerEntryFinalized      SigningLedgerEntryState = "finalized"
	SigningLedgerEntryTerminalFailed SigningLedgerEntryState = "terminal_failed"
)

type SigningLedgerEntryV1 

type SigningLedgerEntryV1 struct {
	SchemaVersion           string                   `json:"schema_version"`
	State                   SigningLedgerEntryState  `json:"state"`
	Subject                 SigningSubjectV1         `json:"subject"`
	SubjectIdentitySHA256   string                   `json:"subject_identity_sha256"`
	SigningPreimageSHA256   string                   `json:"signing_preimage_sha256"`
	Algorithm               string                   `json:"algorithm"`
	KeyID                   string                   `json:"key_id"`
	Revision                uint64                   `json:"revision"`
	ReservedAt              string                   `json:"reserved_at"`
	SignatureEnvelope       *SignatureEnvelopeV1     `json:"signature_envelope,omitempty"`
	SignatureEnvelopeSHA256 string                   `json:"signature_envelope_sha256,omitempty"`
	FinalizedAt             string                   `json:"finalized_at,omitempty"`
	FailureCode             SigningLedgerFailureCode `json:"failure_code,omitempty"`
	FailedAt                string                   `json:"failed_at,omitempty"`
}

func DecodeSigningLedgerEntry 

func DecodeSigningLedgerEntry(raw []byte) (SigningLedgerEntryV1, error)

type SigningLedgerEvidenceV1 

type SigningLedgerEvidenceV1 struct {
	SchemaVersion           string `json:"schema_version"`
	SourceID                string `json:"source_id"`
	Channel                 string `json:"channel,omitempty"`
	SubjectIdentitySHA256   string `json:"subject_identity_sha256"`
	SigningPreimageSHA256   string `json:"signing_preimage_sha256"`
	SignatureEnvelopeSHA256 string `json:"signature_envelope_sha256"`
	ReceiptRef              string `json:"receipt_ref"`
	ReceiptSHA256           string `json:"receipt_sha256"`
	CheckpointRef           string `json:"checkpoint_ref"`
	CheckpointSHA256        string `json:"checkpoint_sha256"`
	InclusionProofRef       string `json:"inclusion_proof_ref"`
	InclusionProofSHA256    string `json:"inclusion_proof_sha256"`
	LatestProofRef          string `json:"latest_proof_ref"`
	LatestProofSHA256       string `json:"latest_proof_sha256"`
	ConsistencyProofRef     string `json:"consistency_proof_ref,omitempty"`
	ConsistencyProofSHA256  string `json:"consistency_proof_sha256,omitempty"`
}

func DecodeSigningLedgerEvidence 

func DecodeSigningLedgerEvidence(raw []byte) (SigningLedgerEvidenceV1, error)

type SigningLedgerFailureCode 

type SigningLedgerFailureCode string
const (
	SigningLedgerFailureSignerRejected  SigningLedgerFailureCode = "signer_rejected"
	SigningLedgerFailureSubjectConflict SigningLedgerFailureCode = "subject_conflict"
	SigningLedgerFailureLedgerRejected  SigningLedgerFailureCode = "ledger_rejected"
)

type SigningLedgerInclusionProofV1 

type SigningLedgerInclusionProofV1 struct {
	SchemaVersion string                    `json:"schema_version"`
	Kind          SigningLedgerArtifactKind `json:"kind"`
	LogID         string                    `json:"log_id"`
	LeafIndex     uint64                    `json:"leaf_index"`
	TreeSize      uint64                    `json:"tree_size"`
	Nodes         []string                  `json:"nodes"`
}

func DecodeSigningLedgerInclusionProof 

func DecodeSigningLedgerInclusionProof(raw []byte) (SigningLedgerInclusionProofV1, error)

type SigningLedgerLatestProofV1 

type SigningLedgerLatestProofV1 struct {
	SchemaVersion           string                    `json:"schema_version"`
	Kind                    SigningLedgerArtifactKind `json:"kind"`
	LogID                   string                    `json:"log_id"`
	SubjectIdentitySHA256   string                    `json:"subject_identity_sha256"`
	Present                 bool                      `json:"present"`
	Sequence                uint64                    `json:"sequence,omitempty"`
	SigningPreimageSHA256   string                    `json:"signing_preimage_sha256,omitempty"`
	SignatureEnvelopeSHA256 string                    `json:"signature_envelope_sha256,omitempty"`
	Siblings                []string                  `json:"siblings"`
}

func DecodeSigningLedgerLatestProof 

func DecodeSigningLedgerLatestProof(raw []byte) (SigningLedgerLatestProofV1, error)

type SigningLedgerLogLeafV1 

type SigningLedgerLogLeafV1 struct {
	SchemaVersion           string `json:"schema_version"`
	SourceID                string `json:"source_id"`
	Channel                 string `json:"channel,omitempty"`
	SubjectIdentitySHA256   string `json:"subject_identity_sha256"`
	SigningPreimageSHA256   string `json:"signing_preimage_sha256"`
	SignatureEnvelopeSHA256 string `json:"signature_envelope_sha256"`
	Sequence                uint64 `json:"sequence"`
}

func SigningLedgerLogLeafFromReceipt 

func SigningLedgerLogLeafFromReceipt(receipt SigningLedgerReceiptV1) (SigningLedgerLogLeafV1, error)

type SigningLedgerReceiptV1 

type SigningLedgerReceiptV1 struct {
	SchemaVersion           string `json:"schema_version"`
	LogID                   string `json:"log_id"`
	SourceID                string `json:"source_id"`
	Channel                 string `json:"channel,omitempty"`
	SubjectIdentitySHA256   string `json:"subject_identity_sha256"`
	SigningPreimageSHA256   string `json:"signing_preimage_sha256"`
	SignatureEnvelopeSHA256 string `json:"signature_envelope_sha256"`
	Sequence                uint64 `json:"sequence"`
	LeafIndex               uint64 `json:"leaf_index"`
	TreeSize                uint64 `json:"tree_size"`
	LogRootHash             string `json:"log_root_hash"`
	LatestMapRootHash       string `json:"latest_map_root_hash"`
	CheckpointSHA256        string `json:"checkpoint_sha256"`
	CheckpointTime          string `json:"checkpoint_time"`
	KeyID                   string `json:"key_id"`
	Signature               string `json:"signature"`
}

func DecodeSigningLedgerReceipt 

func DecodeSigningLedgerReceipt(raw []byte) (SigningLedgerReceiptV1, error)

type SigningSubjectUsage 

type SigningSubjectUsage string
const (
	SigningSubjectUsageRootDelegation      SigningSubjectUsage = "root_delegation"
	SigningSubjectUsagePackage             SigningSubjectUsage = "package"
	SigningSubjectUsageReleaseMetadata     SigningSubjectUsage = "release_metadata"
	SigningSubjectUsageSourcePolicy        SigningSubjectUsage = "source_policy_document"
	SigningSubjectUsageSourcePolicyPointer SigningSubjectUsage = "source_policy_pointer"
	SigningSubjectUsageRevocation          SigningSubjectUsage = "revocation_document"
	SigningSubjectUsageRevocationPointer   SigningSubjectUsage = "revocation_pointer"
)

type SigningSubjectV1 

type SigningSubjectV1 struct {
	SchemaVersion          string              `json:"schema_version"`
	Usage                  SigningSubjectUsage `json:"usage"`
	SourceID               string              `json:"source_id"`
	Channel                string              `json:"channel,omitempty"`
	RootEpoch              string              `json:"root_epoch,omitempty"`
	PublisherID            string              `json:"publisher_id,omitempty"`
	PluginID               string              `json:"plugin_id,omitempty"`
	Version                string              `json:"version,omitempty"`
	ArtifactIdentitySHA256 string              `json:"artifact_or_metadata_identity_sha256,omitempty"`
	Epoch                  string              `json:"epoch,omitempty"`
}

func DecodeSigningSubject 

func DecodeSigningSubject(raw []byte) (SigningSubjectV1, error)

type SigningUsage 

type SigningUsage string
const (
	SigningUsageRootDelegation      SigningUsage = "redevplugin.release-signing.root-delegation.v1"
	SigningUsagePackage             SigningUsage = "redevplugin.release-signing.package.v1"
	SigningUsageReleaseMetadata     SigningUsage = "redevplugin.release-signing.release-metadata.v1"
	SigningUsageSourcePolicy        SigningUsage = "redevplugin.release-signing.source-policy-document.v1"
	SigningUsageSourcePolicyPointer SigningUsage = "redevplugin.release-signing.source-policy-pointer.v1"
	SigningUsageRevocation          SigningUsage = "redevplugin.release-signing.revocation-document.v1"
	SigningUsageRevocationPointer   SigningUsage = "redevplugin.release-signing.revocation-pointer.v1"
	SigningUsageLedgerCheckpoint    SigningUsage = "redevplugin.release-signing.ledger-checkpoint.v1"
	SigningUsageLedgerReceipt       SigningUsage = "redevplugin.release-signing.ledger-receipt.v1"
)

type SourcePolicyActiveKeys 

type SourcePolicyActiveKeys struct {
	Package                []string `json:"package"`
	ReleaseMetadata        []string `json:"release_metadata"`
	HostCapabilityContract []string `json:"host_capability_contract"`
	SourcePolicyPointer    []string `json:"source_policy_pointer"`
	Revocation             []string `json:"revocation_document"`
	RevocationPointer      []string `json:"revocation_pointer"`
}

type SourcePolicyCapabilityPublisherScope 

type SourcePolicyCapabilityPublisherScope struct {
	KeyID             string   `json:"key_id"`
	AllowedPublishers []string `json:"allowed_publishers"`
}

type SourcePolicyInput 

type SourcePolicyInput struct {
	SourceID                  string
	Channel                   string
	Epoch                     string
	PreviousEpoch             string
	PreviousDocumentSHA256    string
	RootEpoch                 string
	SourceType                string
	SourceClass               string
	AllowedPublishers         []string
	AllowedArtifactHosts      []string
	ActiveKeys                SourcePolicyActiveKeys
	CapabilityPublisherScopes []SourcePolicyCapabilityPublisherScope
	RequireSignature          bool
	InstallPolicy             string
	UnsignedPolicy            string
	DowngradePolicy           string
	MinimumRevocationEpoch    string
	Limits                    SourcePolicyLimits
	GeneratedAt               string
	ExpiresAt                 string
	KeyID                     string
}

type SourcePolicyLimits 

type SourcePolicyLimits struct {
	DocumentMaxLifetimeSeconds     int `json:"document_max_lifetime_seconds"`
	FutureSkewSeconds              int `json:"future_skew_seconds"`
	ActivationLeaseMaxSeconds      int `json:"activation_lease_max_seconds"`
	RefreshIntervalMaxSeconds      int `json:"refresh_interval_max_seconds"`
	FailureTeardownDeadlineSeconds int `json:"failure_teardown_deadline_seconds"`
}

func DefaultSourcePolicyLimits 

func DefaultSourcePolicyLimits() SourcePolicyLimits

type SourcePolicyPointerV1 

type SourcePolicyPointerV1 struct {
	SchemaVersion          string `json:"schema_version"`
	SourceID               string `json:"source_id"`
	Channel                string `json:"channel"`
	Epoch                  string `json:"epoch"`
	PreviousEpoch          string `json:"previous_epoch"`
	PreviousDocumentSHA256 string `json:"previous_document_sha256"`
	Ref                    string `json:"ref"`
	DocumentSHA256         string `json:"document_sha256"`
	GeneratedAt            string `json:"generated_at"`
	ExpiresAt              string `json:"expires_at"`
	KeyID                  string `json:"key_id"`
	Signature              string `json:"signature"`
}

func BuildSourcePolicyPointer 

func BuildSourcePolicyPointer(input ReleasePointerInput, signature []byte) (SourcePolicyPointerV1, error)

func DecodeSourcePolicyPointer 

func DecodeSourcePolicyPointer(raw []byte) (SourcePolicyPointerV1, error)

type SourcePolicyV2 

type SourcePolicyV2 struct {
	SchemaVersion             string                                 `json:"schema_version"`
	SourceID                  string                                 `json:"source_id"`
	Channel                   string                                 `json:"channel"`
	Epoch                     string                                 `json:"epoch"`
	PreviousEpoch             string                                 `json:"previous_epoch"`
	PreviousDocumentSHA256    string                                 `json:"previous_document_sha256"`
	RootEpoch                 string                                 `json:"root_epoch"`
	SourceType                string                                 `json:"source_type"`
	SourceClass               string                                 `json:"source_class"`
	AllowedPublishers         []string                               `json:"allowed_publishers"`
	AllowedArtifactHosts      []string                               `json:"allowed_artifact_hosts"`
	ActiveKeys                SourcePolicyActiveKeys                 `json:"active_keys"`
	CapabilityPublisherScopes []SourcePolicyCapabilityPublisherScope `json:"capability_publisher_scopes"`
	RequireSignature          bool                                   `json:"require_signature"`
	InstallPolicy             string                                 `json:"install_policy"`
	UnsignedPolicy            string                                 `json:"unsigned_policy"`
	DowngradePolicy           string                                 `json:"downgrade_policy"`
	MinimumRevocationEpoch    string                                 `json:"minimum_revocation_epoch"`
	Limits                    SourcePolicyLimits                     `json:"limits"`
	GeneratedAt               string                                 `json:"generated_at"`
	ExpiresAt                 string                                 `json:"expires_at"`
	KeyID                     string                                 `json:"key_id"`
	Signature                 string                                 `json:"signature"`
}

func BuildSourcePolicy 

func BuildSourcePolicy(input SourcePolicyInput, signature []byte) (SourcePolicyV2, error)

func DecodeSourcePolicy 

func DecodeSourcePolicy(raw []byte) (SourcePolicyV2, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.