applyevidence

package
v0.43.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Overview

Package applyevidence defines the provider-neutral producer wire contract for StackKits Architecture-v2 pre-Apply evidence. Product authorization, trust enrollment, observation policy, and runtime execution stay with the consuming control plane.

Index

Constants

View Source 
const (
	RequestAPIVersion           = "stackkit.apply-requirements/v1"
	CollectionRequestAPIVersion = "stackkit.apply-evidence-collection/v1"
	CollectionRequestKind       = "ApplyEvidenceCollectionRequest"
	CollectionRequestMaxBytes   = 4 << 20
	BundleAPIVersion            = "stackkit.apply-evidence/v1"
	BundleKind                  = "ApplyEvidenceBundle"
	ReceiptAPIVersion           = "stackkit.apply-evidence-receipt/v1"
	ReceiptKind                 = "ApplyEvidenceReceipt"
	MaxValidity                 = 15 * time.Minute
)

Variables

This section is empty.

Functions

func MarshalCanonical 

func MarshalCanonical(bundle Bundle) ([]byte, error)

MarshalCanonical returns the byte representation consumed by StackKits.

func MarshalCollectionRequest 

func MarshalCollectionRequest(collection CollectionRequest) ([]byte, error)

MarshalCollectionRequest returns the exact canonical JSON wire bytes.

func ProducerKeyID 

func ProducerKeyID(publicKey ed25519.PublicKey) string

ProducerKeyID derives the public, provider-neutral identity of an Ed25519 producer key.

func ValidateCollectionRequest 

func ValidateCollectionRequest(collection CollectionRequest) error

ValidateCollectionRequest verifies the complete canonical collection closure. Freshness and authenticated transport remain consumer policy; an evaluatedAt value supplied by an unauthenticated caller is never proof of current time.

Types

type Bundle 

type Bundle struct {
	APIVersion       string           `json:"apiVersion"`
	Kind             string           `json:"kind"`
	Binding          PlanBinding      `json:"binding"`
	ManifestHash     string           `json:"manifestHash"`
	Executor         ExecutorIdentity `json:"executor"`
	RequirementsHash string           `json:"requirementsHash"`
	Receipts         []Receipt        `json:"receipts"`
	BundleHash       string           `json:"bundleHash"`
}

func SealBundle 

func SealBundle(request Request, manifestHash string, executor ExecutorIdentity, receipts []Receipt) (Bundle, error)

SealBundle exact-matches signed receipts to the producer request and returns the canonical hash-bound envelope. It never reads a key or performs I/O.

type CollectionRequest 

type CollectionRequest struct {
	APIVersion       string           `json:"apiVersion"`
	Kind             string           `json:"kind"`
	Request          Request          `json:"request"`
	ManifestHash     string           `json:"manifestHash"`
	Executor         ExecutorIdentity `json:"executor"`
	EvaluatedAt      time.Time        `json:"evaluatedAt"`
	CollectionDigest string           `json:"collectionDigest"`
}

CollectionRequest is the canonical provider-neutral handoff from a Product Apply authority to an authenticated evidence producer. The producer owns observation and signing custody; this request grants no execution, provider, endpoint, credential, transport, or key authority.

func CloneCollectionRequest 

func CloneCollectionRequest(collection CollectionRequest) CollectionRequest

CloneCollectionRequest returns a defensive value copy.

func DecodeCollectionRequest 

func DecodeCollectionRequest(data []byte) (CollectionRequest, error)

DecodeCollectionRequest strictly decodes one canonical bounded request.

func NewCollectionRequest 

func NewCollectionRequest(request Request, manifestHash string, executor ExecutorIdentity, evaluatedAt time.Time) (CollectionRequest, error)

NewCollectionRequest binds an exact Apply evidence request to the generated manifest, executor identity, and one caller-captured UTC evaluation instant. The request is value-only and defensively copies its expectation set.

type Collector 

type Collector interface {
	CollectApplyEvidence(context.Context, CollectionRequest) ([]byte, error)
}

Collector is the provider-neutral producer SPI for one exact collection request. Implementations privately own observation, enrollment, signing, endpoint, credential, and transport behavior. The consumer validates and bounds the returned canonical evidence bundle.

type ExecutorIdentity 

type ExecutorIdentity struct {
	ID      string `json:"id"`
	Version string `json:"version"`
	Digest  string `json:"digest"`
}

type Expectation 

type Expectation struct {
	ReceiptID       string  `json:"receiptId"`
	RequirementKind string  `json:"requirementKind"`
	RequirementID   string  `json:"requirementId"`
	RequirementHash string  `json:"requirementHash"`
	Subject         Subject `json:"subject"`
}

type PlanAuthority 

type PlanAuthority struct {
	Class                string `json:"class"`
	Document             string `json:"document"`
	GraduationEligible   bool   `json:"graduationEligible"`
	Issuer               string `json:"issuer"`
	AuthorityFingerprint string `json:"authorityFingerprint,omitempty"`
	CatalogHash          string `json:"catalogHash,omitempty"`
}

type PlanBinding 

type PlanBinding struct {
	PlanHash        string           `json:"planHash"`
	SpecHash        string           `json:"specHash"`
	InventoryHash   string           `json:"inventoryHash"`
	DefinitionHash  string           `json:"definitionHash"`
	CompilerVersion string           `json:"compilerVersion"`
	Renderer        RendererIdentity `json:"renderer"`
	Authority       PlanAuthority    `json:"authority"`
}

type Producer 

type Producer struct {
	ID      string `json:"id"`
	Version string `json:"version"`
	KeyID   string `json:"keyId"`
}

type Receipt 

type Receipt struct {
	APIVersion      string           `json:"apiVersion"`
	Kind            string           `json:"kind"`
	ID              string           `json:"id"`
	RequirementKind string           `json:"requirementKind"`
	RequirementID   string           `json:"requirementId"`
	RequirementHash string           `json:"requirementHash"`
	Binding         PlanBinding      `json:"binding"`
	ManifestHash    string           `json:"manifestHash"`
	Executor        ExecutorIdentity `json:"executor"`
	Subject         Subject          `json:"subject"`
	Result          string           `json:"result"`
	Producer        Producer         `json:"producer"`
	ObservationRef  string           `json:"observationRef"`
	ObservedAt      string           `json:"observedAt"`
	ValidUntil      string           `json:"validUntil"`
	Signature       string           `json:"signature"`
	ReceiptDigest   string           `json:"receiptDigest"`
}

func SignReceipt 

func SignReceipt(input ReceiptInput, privateKey ed25519.PrivateKey) (Receipt, error)

SignReceipt creates one exact satisfied receipt for an expectation already issued by the product authority. Observation collection remains caller-owned.

type ReceiptInput 

type ReceiptInput struct {
	Request        Request
	Expectation    Expectation
	ManifestHash   string
	Executor       ExecutorIdentity
	Producer       Producer
	ObservationRef string
	ObservedAt     time.Time
	ValidUntil     time.Time
}

type RendererIdentity 

type RendererIdentity struct {
	ID      string `json:"id"`
	Version string `json:"version"`
}

type Request 

type Request struct {
	APIVersion       string        `json:"apiVersion"`
	Binding          PlanBinding   `json:"binding"`
	RequirementsHash string        `json:"requirementsHash"`
	Expectations     []Expectation `json:"expectations"`
}

type Subject 

type Subject struct {
	OwnerKind    string `json:"ownerKind"`
	OwnerRef     string `json:"ownerRef"`
	ProviderRef  string `json:"providerRef,omitempty"`
	ModuleRef    string `json:"moduleRef,omitempty"`
	UnitRef      string `json:"unitRef,omitempty"`
	InstanceRef  string `json:"instanceRef,omitempty"`
	NodeRef      string `json:"nodeRef,omitempty"`
	GateRef      string `json:"gateRef,omitempty"`
	ContractHash string `json:"contractHash,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.