provenance

package

v0.18.2 Latest Latest Go to latest Published: Jul 27, 2026 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/git-pkgs/git-pkgs

Links

Open Source Insights

Documentation ¶

Overview ¶

Package provenance checks registry-provided provenance signals for exact package versions without depending on CLI or database concerns.

Index ¶

type Checker
type Client
- func NewClient(userAgent string) *Client
- func NewClientWithHTTPClient(userAgent string, httpClient HTTPClient) *Client
- func (c *Client) Lookup(ctx context.Context, dep Dependency) Result
type Dependency
type HTTPClient
type Result
type Status

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Checker ¶

type Checker interface {
	Lookup(context.Context, Dependency) Result
}

Checker checks provenance for exact dependency versions.

type Client ¶

type Client struct {
	// contains filtered or unexported fields
}

Client dispatches provenance lookups to ecosystem-specific checkers.

func NewClient ¶

func NewClient(userAgent string) *Client

NewClient creates a provenance client with a bounded request timeout.

func NewClientWithHTTPClient ¶

func NewClientWithHTTPClient(userAgent string, httpClient HTTPClient) *Client

NewClientWithHTTPClient creates a provenance client using the provided HTTP client.

func (*Client) Lookup ¶

func (c *Client) Lookup(ctx context.Context, dep Dependency) Result

Lookup retrieves the available provenance signal for a dependency release.

type Dependency ¶

type Dependency struct {
	Ecosystem string
	Name      string
	Version   string
}

Dependency identifies one exact package version to inspect.

type HTTPClient ¶

type HTTPClient interface {
	Do(*http.Request) (*http.Response, error)
}

HTTPClient is the subset of http.Client used for registry requests.

type Result ¶

type Result struct {
	Status             Status
	TrustedPublishing  bool
	RegistrySignatures int
	Evidence           []string
	Error              string
}

Result contains the registry signal and any supporting evidence.

type Status ¶

type Status string

Status describes the provenance signal available for a dependency release.

const (
	StatusTrustedPublishing Status = "trusted_publishing"
	StatusAttested          Status = "attested"
	StatusSigned            Status = "signed"
	StatusMissing           Status = "missing"
	StatusUnsupported       Status = "unsupported"
	StatusError             Status = "error"
)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL