stage

package
v0.1.18 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 26, 2026 License: Apache-2.0, MIT Imports: 14 Imported by: 0

Documentation

Overview

Package stage verifies a GoReleaser dist bundle against its checksum claim.

ParseChecksums turns checksums.txt into a validated ChecksumSet. VerifyBundle streams each claimed payload through SHA-256 and requires a nonempty regular checksums.txt.sigstore.json. Callers supply io/fs.FS; the CLI composition edge is os.OpenRoot.

Index

Constants

View Source
const (
	// ImageInputsName is the projection filename written into the dist directory.
	ImageInputsName = "oci-build-inputs.json"
	// ImageInputsSchema is the versioned projection identifier.
	ImageInputsSchema = "release.dev/oci-build-inputs/v2"
)

Variables

This section is empty.

Functions

func EncodeImageInputs

func EncodeImageInputs(w io.Writer, inputs ImageInputs) error

EncodeImageInputs writes compact JSON plus a trailing newline.

func VerifyBundle

func VerifyBundle(fsys fs.FS, claim ChecksumSet) error

VerifyBundle streams every claimed payload through SHA-256 and requires a nonempty regular checksums.txt.sigstore.json.

The first offending asset is named in the error. Payloads are hashed with io.Copy into sha256.New; they are never buffered whole. A nil filesystem is rejected.

Types

type AssetName

type AssetName string

AssetName is a flat payload filename from checksums.txt.

The only constructor is ParseAssetName, which rejects empty names, path separators, and names outside the ASCII release-payload grammar. The zero value is invalid.

func ParseAssetName

func ParseAssetName(raw string) (AssetName, error)

ParseAssetName constructs an AssetName from a flat checksums.txt filename.

Names must be nonempty ASCII matching `[A-Za-z0-9][A-Za-z0-9._+-]*` and must not contain a path separator.

func (AssetName) String

func (n AssetName) String() string

String returns the payload filename.

type Binary

type Binary struct {
	// Arch is the GOARCH of the selected binary.
	Arch string
	// Path is the original GoReleaser path, including the --dist basename prefix.
	Path string
	// RelativePath is Path with the leading dist root name stripped.
	RelativePath string
	// Name is the binary filename for this architecture.
	Name string
	// Digest is the SHA-256 digest of the staged binary.
	Digest Digest
	// Mode is the observed permission bits.
	Mode fs.FileMode
}

Binary is a verified canonical Linux binary observed on disk.

type ChecksumEntry

type ChecksumEntry struct {
	// Name is the claimed payload filename.
	Name AssetName
	// Digest is the claimed SHA-256 digest.
	Digest Digest
}

ChecksumEntry is one validated claim from checksums.txt.

type ChecksumSet

type ChecksumSet struct {
	// contains filtered or unexported fields
}

ChecksumSet is a validated checksums.txt claim.

Values are produced only by ParseChecksums. The zero value has no entries and is rejected by VerifyBundle.

func ParseChecksums

func ParseChecksums(r io.Reader) (ChecksumSet, error)

ParseChecksums parses a GNU coreutils sha256sum claim.

Accepted lines are `<64 hex><two spaces><name>` or the binary-marker form `<64 hex><space><asterisk><name>`. CRLF is tolerated. Uppercase hex is normalized. Empty input, duplicate names, path separators in names, names outside the ParseAssetName grammar, malformed digests, and a self-listed checksums.txt are rejected.

func (ChecksumSet) Entries

func (s ChecksumSet) Entries() []ChecksumEntry

Entries returns the claimed payloads in file order.

func (ChecksumSet) Len

func (s ChecksumSet) Len() int

Len returns the number of claimed payloads.

type Digest

type Digest string

Digest is a lowercase SHA-256 hex digest.

The only constructor is ParseDigest, which normalizes uppercase hex and rejects any other length or charset. The zero value is invalid.

func ParseDigest

func ParseDigest(raw string) (Digest, error)

ParseDigest constructs a Digest from a 64-digit hexadecimal string.

Uppercase hex is normalized to lowercase. Any other length or charset is rejected.

func (Digest) String

func (d Digest) String() string

String returns the lowercase hex digest.

type ImageInputBinary

type ImageInputBinary struct {
	// Platform is the os/architecture pair, either linux/amd64 or linux/arm64.
	Platform string `json:"platform"`
	// Name is the binary filename for this platform.
	Name string `json:"name"`
	// Path is the artifact-root-relative confined path.
	Path string `json:"path"`
	// Digest is the canonical sha256:<hex> digest of the staged binary.
	Digest string `json:"digest"`
}

ImageInputBinary is one canonical Linux binary fact.

type ImageInputs

type ImageInputs struct {
	// Schema identifies the projection version and is always [ImageInputsSchema].
	Schema string `json:"schema"`
	// Profile is the release profile that produced the staged binaries.
	Profile string `json:"profile"`
	// Binaries are the canonical Linux binary facts, sorted platform-major
	// then name-ascending.
	Binaries []ImageInputBinary `json:"binaries"`
}

ImageInputs is the neutral projection of staged facts an image build needs.

func DecodeImageInputs

func DecodeImageInputs(r io.Reader) (ImageInputs, error)

DecodeImageInputs decodes one projection document from r and validates it.

Decoding rejects unknown fields. The document must contain no trailing content. Input is bounded to [jsonLimitBytes].

func NewImageInputs

func NewImageInputs(profile string, report Report) (ImageInputs, error)

NewImageInputs builds a projection from the profile name and staged binaries.

Entries are sorted platform-major (linux/amd64, then linux/arm64), then name-ascending, before validation.

func (ImageInputs) Validate

func (i ImageInputs) Validate() error

Validate reports whether i is a well-formed projection document.

It is lexical only: it rejects a schema other than ImageInputsSchema, an empty profile, an empty binary list, a platform other than linux/amd64 or linux/arm64, a duplicate (platform, name) pair, a name present on only one architecture, an empty name, a name containing a path separator, a path that is not filepath.IsLocal, and a digest that rel.ParseDigest rejects.

type Report

type Report struct {
	// Assets is the number of checksummed payloads that matched.
	Assets int
	// Binaries are the selected canonical Linux binaries after verification.
	Binaries []Binary
}

Report is the successful outcome of staging a Go dist bundle.

func Stage

func Stage(fsys fs.FS, root goprof.RootName) (Report, error)

Stage verifies a Go profile dist directory whose basename is root.

It parses checksums.txt, streams every claimed payload through SHA-256, requires a nonempty regular checksums.txt.sigstore.json, selects every linux/{amd64,arm64} Binary from artifacts.json, and confirms each selected path is a confined regular executable. Each selected binary is then streamed through SHA-256 so the report can carry its digest and filename. A nil filesystem is rejected.

Directories

Path Synopsis
Package image stages Linux binaries into signed APK repositories and a locked OCI layout, and verifies that layout against the release contract.
Package image stages Linux binaries into signed APK repositories and a locked OCI layout, and verifies that layout against the release contract.
Package pkgrepo validates native packages and builds deterministic static APT, RPM/DNF, and APK repository trees.
Package pkgrepo validates native packages and builds deterministic static APT, RPM/DNF, and APK repository trees.
Package pubbrew reconciles one generated Homebrew cask into a protected tap through a reviewable GitHub pull request.
Package pubbrew reconciles one generated Homebrew cask into a protected tap through a reviewable GitHub pull request.
Package pubgh verifies GitHub Actions artifact handoff metadata, signed release bundles, and the draft GitHub Release publication state machine.
Package pubgh verifies GitHub Actions artifact handoff metadata, signed release bundles, and the draft GitHub Release publication state machine.
Package puboci reads a local OCI layout and publishes digest-addressed content and tags.
Package puboci reads a local OCI layout and publishes digest-addressed content and tags.
Package pubscoop reconciles one generated Scoop manifest into a protected bucket through a reviewable GitHub pull request.
Package pubscoop reconciles one generated Scoop manifest into a protected bucket through a reviewable GitHub pull request.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL