Documentation
¶
Overview ¶
Package stage verifies a GoReleaser dist bundle against its checksum claim.
ParseChecksums turns checksums.txt into a validated ChecksumSet. VerifyBundle streams each claimed payload through SHA-256 and requires a nonempty regular checksums.txt.sigstore.json. Callers supply io/fs.FS; the CLI composition edge is os.OpenRoot.
Index ¶
Constants ¶
const ( // ImageInputsName is the projection filename written into the dist directory. ImageInputsName = "oci-build-inputs.json" // ImageInputsSchema is the versioned projection identifier. ImageInputsSchema = "release.dev/oci-build-inputs/v2" )
Variables ¶
This section is empty.
Functions ¶
func EncodeImageInputs ¶
func EncodeImageInputs(w io.Writer, inputs ImageInputs) error
EncodeImageInputs writes compact JSON plus a trailing newline.
func VerifyBundle ¶
func VerifyBundle(fsys fs.FS, claim ChecksumSet) error
VerifyBundle streams every claimed payload through SHA-256 and requires a nonempty regular checksums.txt.sigstore.json.
The first offending asset is named in the error. Payloads are hashed with io.Copy into sha256.New; they are never buffered whole. A nil filesystem is rejected.
Types ¶
type AssetName ¶
type AssetName string
AssetName is a flat payload filename from checksums.txt.
The only constructor is ParseAssetName, which rejects empty names, path separators, and names outside the ASCII release-payload grammar. The zero value is invalid.
func ParseAssetName ¶
ParseAssetName constructs an AssetName from a flat checksums.txt filename.
Names must be nonempty ASCII matching `[A-Za-z0-9][A-Za-z0-9._+-]*` and must not contain a path separator.
type Binary ¶
type Binary struct {
// Arch is the GOARCH of the selected binary.
Arch string
// Path is the original GoReleaser path, including the --dist basename prefix.
Path string
// RelativePath is Path with the leading dist root name stripped.
RelativePath string
// Name is the binary filename for this architecture.
Name string
// Digest is the SHA-256 digest of the staged binary.
Digest Digest
// Mode is the observed permission bits.
Mode fs.FileMode
}
Binary is a verified canonical Linux binary observed on disk.
type ChecksumEntry ¶
type ChecksumEntry struct {
// Name is the claimed payload filename.
Name AssetName
// Digest is the claimed SHA-256 digest.
Digest Digest
}
ChecksumEntry is one validated claim from checksums.txt.
type ChecksumSet ¶
type ChecksumSet struct {
// contains filtered or unexported fields
}
ChecksumSet is a validated checksums.txt claim.
Values are produced only by ParseChecksums. The zero value has no entries and is rejected by VerifyBundle.
func ParseChecksums ¶
func ParseChecksums(r io.Reader) (ChecksumSet, error)
ParseChecksums parses a GNU coreutils sha256sum claim.
Accepted lines are `<64 hex><two spaces><name>` or the binary-marker form `<64 hex><space><asterisk><name>`. CRLF is tolerated. Uppercase hex is normalized. Empty input, duplicate names, path separators in names, names outside the ParseAssetName grammar, malformed digests, and a self-listed checksums.txt are rejected.
func (ChecksumSet) Entries ¶
func (s ChecksumSet) Entries() []ChecksumEntry
Entries returns the claimed payloads in file order.
type Digest ¶
type Digest string
Digest is a lowercase SHA-256 hex digest.
The only constructor is ParseDigest, which normalizes uppercase hex and rejects any other length or charset. The zero value is invalid.
func ParseDigest ¶
ParseDigest constructs a Digest from a 64-digit hexadecimal string.
Uppercase hex is normalized to lowercase. Any other length or charset is rejected.
type ImageInputBinary ¶
type ImageInputBinary struct {
// Platform is the os/architecture pair, either linux/amd64 or linux/arm64.
Platform string `json:"platform"`
// Name is the binary filename for this platform.
Name string `json:"name"`
// Path is the artifact-root-relative confined path.
Path string `json:"path"`
// Digest is the canonical sha256:<hex> digest of the staged binary.
Digest string `json:"digest"`
}
ImageInputBinary is one canonical Linux binary fact.
type ImageInputs ¶
type ImageInputs struct {
// Schema identifies the projection version and is always [ImageInputsSchema].
Schema string `json:"schema"`
// Profile is the release profile that produced the staged binaries.
Profile string `json:"profile"`
// Binaries are the canonical Linux binary facts, sorted platform-major
// then name-ascending.
Binaries []ImageInputBinary `json:"binaries"`
}
ImageInputs is the neutral projection of staged facts an image build needs.
func DecodeImageInputs ¶
func DecodeImageInputs(r io.Reader) (ImageInputs, error)
DecodeImageInputs decodes one projection document from r and validates it.
Decoding rejects unknown fields. The document must contain no trailing content. Input is bounded to [jsonLimitBytes].
func NewImageInputs ¶
func NewImageInputs(profile string, report Report) (ImageInputs, error)
NewImageInputs builds a projection from the profile name and staged binaries.
Entries are sorted platform-major (linux/amd64, then linux/arm64), then name-ascending, before validation.
func (ImageInputs) Validate ¶
func (i ImageInputs) Validate() error
Validate reports whether i is a well-formed projection document.
It is lexical only: it rejects a schema other than ImageInputsSchema, an empty profile, an empty binary list, a platform other than linux/amd64 or linux/arm64, a duplicate (platform, name) pair, a name present on only one architecture, an empty name, a name containing a path separator, a path that is not filepath.IsLocal, and a digest that rel.ParseDigest rejects.
type Report ¶
type Report struct {
// Assets is the number of checksummed payloads that matched.
Assets int
// Binaries are the selected canonical Linux binaries after verification.
Binaries []Binary
}
Report is the successful outcome of staging a Go dist bundle.
func Stage ¶
Stage verifies a Go profile dist directory whose basename is root.
It parses checksums.txt, streams every claimed payload through SHA-256, requires a nonempty regular checksums.txt.sigstore.json, selects every linux/{amd64,arm64} Binary from artifacts.json, and confirms each selected path is a confined regular executable. Each selected binary is then streamed through SHA-256 so the report can carry its digest and filename. A nil filesystem is rejected.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package image stages Linux binaries into signed APK repositories and a locked OCI layout, and verifies that layout against the release contract.
|
Package image stages Linux binaries into signed APK repositories and a locked OCI layout, and verifies that layout against the release contract. |
|
Package pkgrepo validates native packages and builds deterministic static APT, RPM/DNF, and APK repository trees.
|
Package pkgrepo validates native packages and builds deterministic static APT, RPM/DNF, and APK repository trees. |
|
Package pubbrew reconciles one generated Homebrew cask into a protected tap through a reviewable GitHub pull request.
|
Package pubbrew reconciles one generated Homebrew cask into a protected tap through a reviewable GitHub pull request. |
|
Package pubgh verifies GitHub Actions artifact handoff metadata, signed release bundles, and the draft GitHub Release publication state machine.
|
Package pubgh verifies GitHub Actions artifact handoff metadata, signed release bundles, and the draft GitHub Release publication state machine. |
|
Package puboci reads a local OCI layout and publishes digest-addressed content and tags.
|
Package puboci reads a local OCI layout and publishes digest-addressed content and tags. |
|
Package pubscoop reconciles one generated Scoop manifest into a protected bucket through a reviewable GitHub pull request.
|
Package pubscoop reconciles one generated Scoop manifest into a protected bucket through a reviewable GitHub pull request. |