Documentation
¶
Overview ¶
Package trust is the trust store for package signing keys (ADR-0043): it answers "is this public key approved to sign this package id?" — nothing about whether a signature is cryptographically valid in the first place, that's internal/packaging.Verify's job. Trust is bound to the pair (package id, public key), not the key alone.
Index ¶
- Variables
- func Add(ctx context.Context, db *sql.DB, id string, pub ed25519.PublicKey, ...) error
- func IsTrusted(ctx context.Context, db *sql.DB, id string, pub ed25519.PublicKey) (bool, error)
- func Remove(ctx context.Context, db *sql.DB, id string, pub ed25519.PublicKey) error
- type PolicyResult
- type TrustedKey
Constants ¶
This section is empty.
Variables ¶
var ErrNotFound = errors.New("trusted key not found")
ErrNotFound is returned by Remove when no trusted key matches the given id and public key.
var ErrSignatureRequired = errors.New("package requires a trusted signature")
ErrSignatureRequired is returned by CheckPolicy when requireSignature is true and the package is not signed by a key trusted for id.
Functions ¶
func Add ¶
Add records pub as trusted for id. Re-adding the same (id, pub) pair updates its label and trusted_at instead of failing — approving a key twice is not an error.
Types ¶
type PolicyResult ¶
type PolicyResult struct {
Outcome packaging.VerificationOutcome
Trusted bool
}
PolicyResult is what CheckPolicy found for one package install: its raw verification outcome (internal/packaging.Verify), plus whether its signer (if any) is trusted for its id. Callers (internal/apps, internal/plugins, internal/bundles InstallPackage) return this to their own caller so the CLI can print an accurate warning even when requireSignature is false and the install proceeds anyway.
func CheckPolicy ¶
func CheckPolicy(ctx context.Context, db *sql.DB, id string, outcome packaging.VerificationOutcome, requireSignature bool) (PolicyResult, error)
CheckPolicy decides whether an InstallPackage call should proceed, given a package's already-computed verification outcome: it looks up whether outcome.PublicKey is trusted for id (only meaningful when the package is signed at all), then — if requireSignature is true — fails unless the package is both signed and trusted.
It never second-guesses outcome itself: a checksum mismatch or an invalid signature already aborted the install before CheckPolicy is ever called (see internal/packaging.Verify) — this function only decides what to do about a package that is cryptographically sound but possibly unsigned or signed by a key nobody has approved yet.
type TrustedKey ¶
TrustedKey is one approved (package id, public key) pair, as recorded in the database.
Source Files