releasepublisher

package
v0.7.21 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 10, 2026 License: MIT Imports: 22 Imported by: 0

Documentation

Overview

Package releasepublisher implements host-neutral, private-key-agnostic release publication workflows.

Index

Constants

View Source 
const (
	ExternalSignerRequestSchemaVersion  = "redevplugin.external_signer_request.v1"
	ExternalSignerResponseSchemaVersion = "redevplugin.external_signer_response.v1"
)
View Source 
const (
	ConfigSchemaVersion                   = "redevplugin.release_publisher_config.v1"
	WorkspaceSchemaVersion                = "redevplugin.release_publisher_workspace.v1"
	ReleaseRefSchemaVersion               = "redevplugin.publisher_release_ref.v1"
	PresentationIconEvidenceSchemaVersion = "redevplugin.presentation_icon_evidence.v1"
)

Variables

View Source 
var (
	ErrInvalidSignerRequest  = errors.New("external signer request is invalid")
	ErrInvalidSignerResponse = errors.New("external signer response is invalid")
)
View Source 
var (
	ErrInvalidPublisherConfig       = errors.New("release publisher config is invalid")
	ErrWorkspaceConflict            = errors.New("release publisher workspace conflicts with the requested input")
	ErrWorkspaceIncomplete          = errors.New("release publisher workspace is incomplete")
	ErrInvalidWorkspace             = errors.New("release publisher workspace is invalid")
	ErrPresentationIconUnavailable  = errors.New("release publisher presentation icon is unavailable")
	ErrPresentationIconOutputExists = errors.New("release publisher presentation icon output already exists")
)

Functions

func CanonicalExternalSignerRequest 

func CanonicalExternalSignerRequest(request ExternalSignerRequestV1) ([]byte, error)

func CanonicalExternalSignerResponse 

func CanonicalExternalSignerResponse(response ExternalSignerResponseV1) ([]byte, error)

func VerifyExternalSignerResponse 

func VerifyExternalSignerResponse(
	request ExternalSignerRequestV1,
	response ExternalSignerResponseV1,
	publicKey ed25519.PublicKey,
) ([]byte, error)

func VerifyOutput 

func VerifyOutput(ctx context.Context, output string) error

Types

type ConfigV1 

type ConfigV1 struct {
	SchemaVersion         string                                   `json:"schema_version"`
	SourceID              string                                   `json:"source_id"`
	Channel               string                                   `json:"channel"`
	SourceType            string                                   `json:"source_type"`
	SourceClass           string                                   `json:"source_class"`
	GeneratedAt           string                                   `json:"generated_at"`
	ExpiresAt             string                                   `json:"expires_at"`
	Root                  PublicKeyV1                              `json:"root"`
	Signing               PublicKeyV1                              `json:"signing"`
	SigningLedger         SigningLedgerConfigV1                    `json:"signing_ledger"`
	AllowedArtifactHosts  []string                                 `json:"allowed_artifact_hosts"`
	MinReDevPluginVersion string                                   `json:"min_redevplugin_version"`
	Distribution          string                                   `json:"distribution"`
	HostRequirements      []releasecontract.ReleaseHostRequirement `json:"host_requirements"`
}

func DecodeConfig 

func DecodeConfig(raw []byte) (ConfigV1, error)

type ExternalSignerRequestV1 

type ExternalSignerRequestV1 struct {
	SchemaVersion         string                           `json:"schema_version"`
	RequestID             string                           `json:"request_id"`
	Usage                 releasecontract.SigningUsage     `json:"usage"`
	KeyID                 string                           `json:"key_id"`
	Subject               releasecontract.SigningSubjectV1 `json:"subject"`
	SubjectIdentitySHA256 string                           `json:"subject_identity_sha256"`
	SigningPreimageSHA256 string                           `json:"signing_preimage_sha256"`
}

ExternalSignerRequestV1 contains only public signing inputs. It deliberately carries no signer invocation, credential, storage, account, or lookup data.

func DecodeExternalSignerRequest 

func DecodeExternalSignerRequest(raw []byte) (ExternalSignerRequestV1, error)

func NewExternalSignerRequest 

func NewExternalSignerRequest(
	usage releasecontract.SigningUsage,
	keyID string,
	subject releasecontract.SigningSubjectV1,
	signingPreimage []byte,
) (ExternalSignerRequestV1, error)

type ExternalSignerResponseV1 

type ExternalSignerResponseV1 struct {
	SchemaVersion         string                       `json:"schema_version"`
	RequestID             string                       `json:"request_id"`
	Usage                 releasecontract.SigningUsage `json:"usage"`
	KeyID                 string                       `json:"key_id"`
	SubjectIdentitySHA256 string                       `json:"subject_identity_sha256"`
	SigningPreimageSHA256 string                       `json:"signing_preimage_sha256"`
	Algorithm             string                       `json:"algorithm"`
	Signature             string                       `json:"signature"`
}

ExternalSignerResponseV1 is the minimal public result accepted from an external Ed25519 signer.

func DecodeExternalSignerResponse 

func DecodeExternalSignerResponse(raw []byte) (ExternalSignerResponseV1, error)

type PackageHashSetV1 

type PackageHashSetV1 struct {
	PackageSHA256  string `json:"package_sha256"`
	ManifestSHA256 string `json:"manifest_sha256"`
	EntriesSHA256  string `json:"entries_sha256"`
}

type PluginReleaseRefV1 

type PluginReleaseRefV1 struct {
	SourceID              string           `json:"source_id"`
	Channel               string           `json:"channel"`
	ReleaseMetadataRef    string           `json:"release_metadata_ref"`
	ReleaseMetadataSHA256 string           `json:"release_metadata_sha256"`
	PublisherID           string           `json:"publisher_id"`
	PluginID              string           `json:"plugin_id"`
	Version               string           `json:"version"`
	ExpectedHashes        PackageHashSetV1 `json:"expected_hashes"`
}

type PresentationIconEvidenceV1 added in v0.7.13 

type PresentationIconEvidenceV1 struct {
	SchemaVersion string `json:"schema_version"`
	Path          string `json:"path"`
	MediaType     string `json:"media_type"`
	Width         int    `json:"width"`
	Height        int    `json:"height"`
	SHA256        string `json:"sha256"`
	Size          int64  `json:"size"`
}

PresentationIconEvidenceV1 describes exactly one verified package-local presentation image from a fully verified release output.

func ExtractPresentationIcon added in v0.7.13 

func ExtractPresentationIcon(ctx context.Context, output, destination string) (PresentationIconEvidenceV1, error)

ExtractPresentationIcon writes the exact package-local image only after the complete release output has been re-verified. Existing targets are never replaced so a caller cannot mistake stale bytes for current evidence.

type PublicKeyV1 

type PublicKeyV1 struct {
	Algorithm string `json:"algorithm"`
	KeyID     string `json:"key_id"`
	PublicKey string `json:"public_key"`
}

type PublishedFileV1 

type PublishedFileV1 struct {
	Locator   string `json:"locator"`
	AssetName string `json:"asset_name"`
	SHA256    string `json:"sha256"`
	Size      int64  `json:"size"`
}

type PublisherReleaseRefV1 

type PublisherReleaseRefV1 struct {
	SchemaVersion string                `json:"schema_version"`
	ReleaseRef    PluginReleaseRefV1    `json:"release_ref"`
	Root          PublicKeyV1           `json:"root"`
	SigningLedger SigningLedgerConfigV1 `json:"signing_ledger"`
	Files         []PublishedFileV1     `json:"files"`
}

type SigningLedgerConfigV1 

type SigningLedgerConfigV1 struct {
	LogID string `json:"log_id"`
	PublicKeyV1
}

type VerifiedOutputV1 added in v0.7.0 

type VerifiedOutputV1 struct {
	Presentation       manifest.PresentationCatalog `json:"presentation"`
	PresentationIcon   *PresentationIconEvidenceV1  `json:"presentation_icon,omitempty"`
	ManifestSHA256     string                       `json:"manifest_sha256"`
	PresentationSHA256 string                       `json:"presentation_sha256"`
}

func VerifyAndInspectOutput added in v0.7.0 

func VerifyAndInspectOutput(ctx context.Context, output string) (VerifiedOutputV1, error)

type WorkspaceStatusV1 

type WorkspaceStatusV1 struct {
	OK              bool   `json:"ok"`
	Phase           string `json:"phase"`
	PendingRequests int    `json:"pending_requests"`
	Workspace       string `json:"workspace"`
	Output          string `json:"output,omitempty"`
}

func ApplySignature 

func ApplySignature(ctx context.Context, workspace string, responseRaw []byte) (WorkspaceStatusV1, error)

func Finalize 

func Finalize(ctx context.Context, workspace, output string) (WorkspaceStatusV1, error)

func Prepare 

func Prepare(ctx context.Context, config ConfigV1, packageFile, workspace string) (WorkspaceStatusV1, error)

func PrepareWithPrevious added in v0.7.14 

func PrepareWithPrevious(ctx context.Context, config ConfigV1, packageFile, workspace, previousOutput string) (WorkspaceStatusV1, error)

PrepareWithPrevious starts or resumes a release publisher workspace. When a previous output is supplied, it must be a complete verified release for the same source, channel, publisher, and plugin. The next signing ledger extends that immutable public history and same-epoch trust documents are reused.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.