Help us shape the future of Go! Take the 2026 Go Developer Survey

extension

package
v0.4.26 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 26, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	InTotoStatementV1    = "https://in-toto.io/Statement/v1"
	SLSAProvenanceV1     = "https://slsa.dev/provenance/v1"
	SPDXPredicateV2      = "https://spdx.dev/Document"
	CycloneDXPredicateV1 = "https://cyclonedx.org/bom"
)
View Source 
const DescriptorVersion = "baseharbor.extension/v1"
View Source 
const JSONSchema202012 = "https://json-schema.org/draft/2020-12/schema"
View Source 
const TrustVersion = "baseharbor.extension-trust/v1"

Variables

This section is empty.

Functions

This section is empty.

Types

type Artifact 

type Artifact struct {
	OCIReference string `json:"oci_reference,omitempty"`
	Digest       string `json:"digest,omitempty"`
	MediaType    string `json:"media_type,omitempty"`
}

func (Artifact) Validate 

func (a Artifact) Validate() error

type ArtifactReader added in v0.4.22 

type ArtifactReader interface {
	Open(context.Context, string) (io.ReadCloser, error)
}

ArtifactReader resolves immutable OCI manifest bytes and public evidence references. Authentication belongs to the operator's transport, never metadata. The verifier always recomputes the manifest digest before trusting evidence.

type Catalog 

type Catalog struct {
	// contains filtered or unexported fields
}

func NewCatalog 

func NewCatalog(entries ...Metadata) (Catalog, error)

func (Catalog) Resolve 

func (c Catalog) Resolve(request ResolveRequest, policy TrustPolicy) (Resolution, error)

func (Catalog) ResolveVerified added in v0.4.22 

func (c Catalog) ResolveVerified(ctx context.Context, request ResolveRequest, policy TrustPolicy, verifier Verifier) (Resolution, error)

ResolveVerified keeps descriptor identity, verifier evidence and policy separate. A nil verifier produces an explicit unverifiable result, never a verified one.

type Compatibility 

type Compatibility struct {
	BaseHarbor string     `json:"baseharbor,omitempty"`
	Contracts  []string   `json:"contracts,omitempty"`
	Platforms  []Platform `json:"platforms,omitempty"`
}

func (Compatibility) Validate 

func (c Compatibility) Validate() error

type Family 

type Family string
const (
	FamilyProvider       Family = "provider"
	FamilyDevelopment    Family = "development"
	FamilyRuntime        Family = "runtime"
	FamilyDelivery       Family = "delivery"
	FamilyWorkloadSource Family = "workload-source"
	FamilyTargetAccess   Family = "target-access"
)

type JWSVerifier added in v0.4.22 

type JWSVerifier struct {
	Reader ArtifactReader
	Keys   map[string]PublisherKey
}

JWSVerifier supports asymmetric RFC 7515 signatures over in-toto v1 statements. Keys and publisher identities are supplied by the operator. Neither embedded keys nor remote key URLs grant publisher trust.

func (JWSVerifier) Verify added in v0.4.22 

func (v JWSVerifier) Verify(ctx context.Context, metadata Metadata) (Verification, error)

type Metadata 

type Metadata struct {
	SchemaVersion       string          `json:"schema_version"`
	ID                  string          `json:"id"`
	Family              Family          `json:"family"`
	Version             string          `json:"version"`
	Compatibility       Compatibility   `json:"compatibility,omitempty"`
	Artifact            Artifact        `json:"artifact,omitempty"`
	ConfigurationSchema SchemaReference `json:"configuration_schema,omitempty"`
	Provenance          Provenance      `json:"provenance,omitempty"`
}

func (Metadata) Validate 

func (m Metadata) Validate() error

type Platform 

type Platform struct {
	OS   string `json:"os"`
	Arch string `json:"arch"`
}

type Provenance 

type Provenance struct {
	Publisher      string `json:"publisher,omitempty"`
	SignatureRef   string `json:"signature_ref,omitempty"`
	SBOMRef        string `json:"sbom_ref,omitempty"`
	AttestationRef string `json:"attestation_ref,omitempty"`
}

type PublisherKey added in v0.4.22 

type PublisherKey struct {
	Publisher string
	PublicKey any
}

type Resolution 

type Resolution struct {
	Metadata     Metadata      `json:"metadata"`
	Trusted      bool          `json:"trusted"`
	Verification Verification  `json:"verification"`
	Decision     TrustDecision `json:"trust_decision"`
}

type ResolveRequest 

type ResolveRequest struct {
	ID      string `json:"id"`
	Version string `json:"version,omitempty"`
	Digest  string `json:"digest,omitempty"`
}

type SchemaReference 

type SchemaReference struct {
	Dialect string `json:"dialect,omitempty"`
	URI     string `json:"uri,omitempty"`
}

func (SchemaReference) Validate 

func (s SchemaReference) Validate() error

type TrustDecision added in v0.4.22 

type TrustDecision struct {
	SchemaVersion   string      `json:"schema_version"`
	Status          TrustStatus `json:"status"`
	PolicyReference string      `json:"policy_reference,omitempty"`
	Code            string      `json:"code,omitempty"`
	Next            string      `json:"next,omitempty"`
}

type TrustError added in v0.4.22 

type TrustError struct {
	Code string `json:"code"`
	Next string `json:"next"`
}

func (*TrustError) Error added in v0.4.22 

func (e *TrustError) Error() string

type TrustPolicy 

type TrustPolicy struct {
	RequireDigest       bool     `json:"require_digest,omitempty"`
	RequireSignature    bool     `json:"require_signature,omitempty"`
	RequireSBOM         bool     `json:"require_sbom,omitempty"`
	RequireAttestation  bool     `json:"require_attestation,omitempty"`
	RequireVerification bool     `json:"require_verification,omitempty"`
	AllowedPublishers   []string `json:"allowed_publishers,omitempty"`
	Reference           string   `json:"reference,omitempty"`
}

func (TrustPolicy) Evaluate added in v0.4.22 

func (p TrustPolicy) Evaluate(metadata Metadata, verification Verification) TrustDecision

func (TrustPolicy) Validate 

func (p TrustPolicy) Validate(metadata Metadata) error

Validate checks metadata requirements only. Evaluate applies verified evidence and publisher policy; presence of a reference does not establish artifact trust.

type TrustStatus added in v0.4.22 

type TrustStatus string
const (
	TrustTrusted TrustStatus = "trusted"
	TrustDenied  TrustStatus = "denied"
)

type Verification added in v0.4.22 

type Verification struct {
	SchemaVersion       string             `json:"schema_version"`
	Status              VerificationStatus `json:"status"`
	Digest              string             `json:"digest,omitempty"`
	Publisher           string             `json:"publisher,omitempty"`
	SignatureVerified   bool               `json:"signature_verified"`
	SBOMVerified        bool               `json:"sbom_verified"`
	AttestationVerified bool               `json:"attestation_verified"`
	Code                string             `json:"code,omitempty"`
	Next                string             `json:"next,omitempty"`
}

func VerifyArtifact added in v0.4.22 

func VerifyArtifact(ctx context.Context, metadata Metadata, verifier Verifier) Verification

type VerificationStatus added in v0.4.22 

type VerificationStatus string
const (
	VerificationVerified     VerificationStatus = "verified"
	VerificationUnverifiable VerificationStatus = "unverifiable"
	VerificationInvalid      VerificationStatus = "invalid"
)

type Verifier added in v0.4.22 

type Verifier interface {
	Verify(context.Context, Metadata) (Verification, error)
}

Verifier is an operator-configured verification backend, not descriptor data. Implementations verify fetched bytes/evidence against the immutable digest. A publisher returned here must come from verified evidence, never a claim.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.