root

package

v0.30.0 Latest Latest Go to latest Published: Jun 25, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/liatrio/autogov

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func FetchTrustedRoot() ([]byte, error)
func GetGitHubTrustedRoot() []byte
func GetPublicTrustedRoot() []byte
func GetTrustedRoot() ([]byte, error)
type TrustedRootSource
- func DetectTrustedRootFromCert(certPEM []byte) (TrustedRootSource, error)
- func SelectTrustedRoot(source TrustedRootSource, certPEM []byte) ([]byte, TrustedRootSource, error)

Constants ¶

View Source

const (
	GitHubActionsIssuer = "https://token.actions.githubusercontent.com"
	GoogleOIDCIssuer    = "https://accounts.google.com"
	GitHubOAuthIssuer   = "https://github.com/login/oauth"
	GitLabIssuer        = "https://gitlab.com"
)

known OIDC issuers for auto-detection

Variables ¶

View Source

var GithubTrustedRoot []byte

View Source

var PublicSigstoreTrustedRoot []byte

static snapshot of the public-good Sigstore trusted root. unlike the GitHub root (refreshed live via FetchTrustedRoot), this has no refresh path, so a future Sigstore key rotation requires re-vendoring this file; longer term it should be fetched live from the Sigstore TUF repo.

Functions ¶

func FetchTrustedRoot ¶

func FetchTrustedRoot() ([]byte, error)

fetches gh trusted root

func GetGitHubTrustedRoot ¶

func GetGitHubTrustedRoot() []byte

returns embedded github trusted root

func GetPublicTrustedRoot ¶

func GetPublicTrustedRoot() []byte

returns embedded public sigstore trusted root

func GetTrustedRoot ¶

func GetTrustedRoot() ([]byte, error)

returns the GitHub trusted root with fallback mechanism. first attempts to fetch the latest root dynamically, and falls back to the embedded root if the dynamic fetch fails.

Types ¶

type TrustedRootSource ¶

type TrustedRootSource string

trusted root source selection

const (
	TrustedRootSourceGitHub TrustedRootSource = "github"
	TrustedRootSourcePublic TrustedRootSource = "public"
	TrustedRootSourceAuto   TrustedRootSource = "auto"
)

func DetectTrustedRootFromCert ¶

func DetectTrustedRootFromCert(certPEM []byte) (TrustedRootSource, error)

detects trusted root from certificate's OIDC issuer

func SelectTrustedRoot ¶

func SelectTrustedRoot(source TrustedRootSource, certPEM []byte) ([]byte, TrustedRootSource, error)

selects trusted root based on source and optional certificate

Source Files ¶

View all Source files

root.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL