selfupdate

package

v2.17.1 Latest Latest Go to latest Published: Oct 25, 2026 License: BSD-3-Clause Imports: 17 Imported by: 0

Details

Package selfupdate verifies release checksums. Valid signatures do not prevent replay of older releases.

This section is empty.

This section is empty.

This section is empty.

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier authenticates checksum bytes against the configured release keys and Sigstore infrastructure.

func New(ctx context.Context) (*Verifier, error)

New loads Sigstore infrastructure trust from TUF, using unexpired cached metadata offline.

func NewVerifier(infrastructure root.TrustedMaterial, publicKeys [][]byte) (*Verifier, error)

NewVerifier uses injected infrastructure trust and PEM release keys, ignoring bundle public-key hints.

func (v *Verifier) Verify(checksums, bundleJSON []byte) error

Verify requires a release-key signature, transparency-log inclusion, and an observer timestamp.