Documentation
¶
Overview ¶
Package advancedchangeset owns the immutable, owner-signed description of one already-rendered advanced change. It deliberately does not resolve, render, execute, or discover anything.
Index ¶
Constants ¶
const ( SchemaVersion = "stackkit.advanced-change-set/v1" MaxLifetime = 24 * time.Hour )
const ( StatusAdded = "added" StatusModified = "modified" StatusRemoved = "removed" )
const GenerationTargetTerramate = "terramate"
Variables ¶
This section is empty.
Functions ¶
func RenderSHA256 ¶
func RenderSHA256(result architecturev2renderer.RenderResult) (string, error)
RenderSHA256 exposes the exact canonical render identity used by Record. Apply uses it to prove that freshly rendered candidate bytes are the bytes the Owner approved, before any snapshot or runtime side effect is started.
Types ¶
type ArtifactChange ¶
type ArtifactChange struct {
Path string `json:"path"`
Status string `json:"status"`
BeforeSHA256 string `json:"beforeSha256,omitempty"`
AfterSHA256 string `json:"afterSha256,omitempty"`
MetadataChanged bool `json:"metadataChanged,omitempty"`
}
ArtifactChange is a deterministic path-keyed transition. Equal hashes with MetadataChanged=true represent a governed metadata-only modification.
type CreateRequest ¶
type CreateRequest struct {
Baseline architecturev2renderer.RenderResult
Candidate architecturev2renderer.RenderResult
CapabilityID string
CapabilitySHA256 string
KeyID string
StackID string
OwnerRef string
UIManagerRef string
RILRef string
BaselinePlanHash string
CandidatePlanHash string
CreatedAt time.Time
ExpiresAt time.Time
CapabilityExpiresAt time.Time
Sign OwnerSigner
VerifyOwnerSignature OwnerVerifier
}
type OwnerSignature ¶
type OwnerSignature struct {
OwnerRef string `json:"ownerRef"`
KeyID string `json:"keyId"`
Value string `json:"value"`
}
OwnerSignature is supplied by the local owner-custody composition seam. The private key and signing implementation never enter this package.
type OwnerSigner ¶
type OwnerSigner func(canonicalUnsigned []byte) (OwnerSignature, error)
OwnerSigner signs the canonical unsigned bytes using current local custody.
type OwnerVerifier ¶
type OwnerVerifier func(canonicalUnsigned []byte, signature OwnerSignature) error
OwnerVerifier verifies an owner signature and its binding to current local custody. Implementations are injected by the composition root.
type Record ¶
type Record struct {
SchemaVersion string `json:"schemaVersion"`
ChangeSetID string `json:"changeSetId"`
CapabilityID string `json:"capabilityId"`
CapabilitySHA256 string `json:"capabilitySha256"`
KeyID string `json:"keyId"`
StackID string `json:"stackId"`
OwnerRef string `json:"ownerRef"`
UIManagerRef string `json:"uiManagerRef"`
RILRef string `json:"rilRef"`
GenerationTarget string `json:"generationTarget"`
CreatedAt string `json:"createdAt"`
ExpiresAt string `json:"expiresAt"`
CapabilityExpiresAt string `json:"capabilityExpiresAt"`
BaselinePlanHash string `json:"baselinePlanHash"`
CandidatePlanHash string `json:"candidatePlanHash"`
BaselineRenderSHA256 string `json:"baselineRenderSha256"`
CandidateRenderSHA256 string `json:"candidateRenderSha256"`
Changes []ArtifactChange `json:"changes"`
OwnerSignature OwnerSignature `json:"ownerSignature"`
}
Record is content-addressed by all unsigned claims except ChangeSetID itself. OwnerSignature then authenticates the complete unsigned record, including that derived ID.
func Create ¶
func Create(request CreateRequest) (Record, error)
Create computes a pure diff from two already-authorized RenderResults and obtains an owner signature through the injected custody seam.
func Verify ¶
func Verify(raw []byte, request VerificationRequest) (Record, error)
Verify rejects non-canonical, malformed, stale, scope-substituted, or owner-signature-invalid records without performing side effects.
func (Record) MarshalCanonical ¶
MarshalCanonical returns the strict persisted representation.
func (Record) UnsignedCanonical ¶
UnsignedCanonical returns the exact bytes authenticated by OwnerSignature.
type Store ¶
type Store struct {
WorkspaceRoot string
}
Source Files