executionchannelbundle

package

v0.40.0 Latest Latest Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kombifyio/stackkits

Links

Open Source Insights

Documentation ¶

Overview ¶

Package executionchannelbundle verifies the short-lived, offline-authorized handoff into one exact StackKits execution channel. It owns no transport, credentials, provider lifecycle, discovery, retry, or execution behavior.

Index ¶

Constants
type ChannelBinding
type Envelope
type Verified
- func DecodeAndVerify(bundleRaw []byte, trust *advancedcapability.TrustBundle, now time.Time) (Verified, error)

Constants ¶

View Source

const (
	SchemaVersion  = "stackkit.execution-channel-bundle/v1"
	Kind           = "ExecutionChannelBundle"
	Audience       = "stackkit-runtime"
	MaxBundleBytes = 64 * 1024 * 1024
	MaxLifetime    = 5 * time.Minute
	MaxClockSkew   = 30 * time.Second
)

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type ChannelBinding ¶

type ChannelBinding struct {
	ChannelRef string `json:"channelRef"`
	SiteRef    string `json:"siteRef"`
	NodeRef    string `json:"nodeRef"`
}

type Envelope ¶

type Envelope struct {
	SchemaVersion string                           `json:"schemaVersion"`
	Kind          string                           `json:"kind"`
	Audience      string                           `json:"audience"`
	IssuerID      string                           `json:"issuerId"`
	KeyID         string                           `json:"keyId"`
	IssuedAt      string                           `json:"issuedAt"`
	ExpiresAt     string                           `json:"expiresAt"`
	Channel       ChannelBinding                   `json:"channel"`
	Request       runtimeexecutor.ExecutionRequest `json:"request"`
	Signature     string                           `json:"signature,omitempty"`
}

type Verified ¶

type Verified struct {
	Request      runtimeexecutor.ExecutionRequest
	Channel      ChannelBinding
	IssuerID     string
	KeyID        string
	IssuedAt     time.Time
	ExpiresAt    time.Time
	BundleDigest string
}

func DecodeAndVerify ¶

func DecodeAndVerify(
	bundleRaw []byte,
	trust *advancedcapability.TrustBundle,
	now time.Time,
) (Verified, error)

DecodeAndVerify rejects a noncanonical, expired, substituted, unsealed, or cross-channel bundle before the caller constructs a mutating runtime. Trust is injected from the existing Owner-approved Advanced trust record.

Source Files ¶

View all Source files

bundle.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL