Documentation
¶
Overview ¶
Package advancedtrust imports and owns the local, Owner-approved trust roots used by offline Advanced capability verification.
Index ¶
Constants ¶
const (
BundleSchemaVersion = "stackkit.advanced-trust-bundle/v1"
)
const (
RecordSchemaVersion = "stackkit.local-advanced-trust/v1"
)
Variables ¶
var ErrMissing = errors.New("advancedtrust: no local Advanced trust bundle")
ErrMissing reports that no local Advanced trust bundle has been imported.
Functions ¶
func Decode ¶
func Decode(raw []byte) (advancedcapability.TrustBundle, error)
Decode strictly decodes the canonical public trust-bundle wire contract. The returned bundle is detached from raw and contains public verification keys only.
Types ¶
type Inspection ¶
type Inspection struct {
SchemaVersion string `json:"schemaVersion"`
BundleSHA256 string `json:"bundleSHA256"`
ImportedAt time.Time `json:"importedAt"`
OwnerRef string `json:"ownerRef"`
OwnerKeyID string `json:"ownerKeyId"`
Keys []KeyReference `json:"keys"`
}
Inspection is a secret- and key-material-free view suitable for CLI output.
func Inspect ¶
func Inspect(workspace string) (Inspection, error)
Inspect returns only issuer/key identifiers and verified record metadata. It never returns raw public-key or signature material.
type KeyReference ¶
KeyReference identifies a trusted public key without returning its bytes.
type Record ¶
type Record struct {
SchemaVersion string `json:"schemaVersion"`
Kind string `json:"kind"`
BundleSHA256 string `json:"bundleSHA256"`
ImportedAt time.Time `json:"importedAt"`
OwnerRef string `json:"ownerRef"`
OwnerKeyID string `json:"ownerKeyId"`
KeyCount int `json:"keyCount"`
// contains filtered or unexported fields
}
Record is the verified, Owner-bound local trust record. Raw public key material is deliberately not exported or JSON-serializable; callers must explicitly request a detached verifier bundle.
func Import ¶
Import verifies an exact SHA-256 pin before creating any trust-store state, binds the canonical bundle to current Owner custody, and atomically installs the private local record.
func Load ¶
Load returns only after strict wire, SHA-256, local Owner binding, signature, private permission, and stable-read verification succeeds.
func (Record) TrustBundle ¶
func (record Record) TrustBundle() advancedcapability.TrustBundle
TrustBundle returns a detached public-key bundle for offline capability verification. Mutating it cannot alter the loaded record.
Source Files