Documentation
¶
Overview ¶
Package cosign implements puboci.Signer and pubgh.BlobVerifier by invoking the pinned cosign binary.
New builds a signer that shells out to `cosign sign --yes --recursive` against image@digest. Signing is keyless and recursive: the index and every referenced platform manifest are signed. NewVerifier builds a verifier that shells out to `cosign verify-blob` against a detached Sigstore bundle. The adapter performs no registry or policy reasoning of its own: identity and issuer come from the request. Keyless credentials use the ambient OIDC environment; this package never reads, stores, or logs a key or token.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// Path is the cosign executable. An empty path resolves "cosign" from
// PATH with [exec.LookPath] when signing.
Path string
// Environ is the child process environment. A nil value inherits
// [os.Environ]. The slice is used as-is and is never logged.
Environ []string
// Stderr receives cosign diagnostics while the process runs. A nil
// value discards them. A nonzero exit still captures a bounded tail
// for the returned error.
Stderr io.Writer
}
Options configures a Signer.
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer invokes the cosign CLI to attach signatures.
It implements puboci.Signer. It performs no registry reads or tag mutation. Keyless credentials come from the process environment.
func New ¶
New constructs a Signer from options.
Path resolution is deferred until Signer.SignRecursive so a missing binary is reported when signing, not at construction.
func (*Signer) SignRecursive ¶
SignRecursive implements puboci.Signer.
It runs `cosign sign --yes --recursive` against ref as an explicit argument slice through execx.Run. A nil context, a nil receiver, or a zero-value ref is rejected before any process starts. A nonzero exit returns an error that names the exit code and includes a bounded tail of stderr.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier invokes the cosign CLI to verify a detached Sigstore bundle.
It implements pubgh.BlobVerifier. It performs no policy decisions of its own: identity and issuer come from the request.
func NewVerifier ¶
func NewVerifier(options VerifierOptions) *Verifier
NewVerifier constructs a Verifier from options.
Path resolution is deferred until Verifier.Verify so a missing binary is reported when verifying, not at construction.
func (*Verifier) Verify ¶
Verify implements pubgh.BlobVerifier.
It runs `cosign verify-blob --bundle --certificate-identity --certificate-oidc-issuer` as an explicit argument slice through execx.Run, with the configured distribution directory as the child working directory. A nil context, a nil receiver, an empty Dir, or an empty payload, bundle, identity, or issuer is rejected before any process starts. A nonzero exit returns an error that names the exit code and includes a bounded tail of stderr. Cosign's stdout is discarded.
type VerifierOptions ¶
type VerifierOptions struct {
// Path is the cosign executable. An empty path resolves "cosign" from
// PATH with [exec.LookPath] when verifying.
Path string
// Dir is the child working directory and must be the resolved
// distribution directory. An empty Dir is rejected before any process
// starts.
Dir string
// Environ is the child process environment. A nil value inherits
// [os.Environ]. The slice is used as-is and is never logged.
Environ []string
// Stderr receives cosign diagnostics while the process runs. A nil
// value discards them. A nonzero exit still captures a bounded tail
// for the returned error.
Stderr io.Writer
}
VerifierOptions configures a Verifier.
Source Files
Directories