Documentation
¶
Index ¶
- Constants
- Variables
- func CheckKeys() error
- func FloorRequires(tier, slug, version string) bool
- func Pinned(tier string) bool
- func SigningInput(slug, version, sha256hex string) []byte
- func UnsignedAllowed(tier, slug, version, sha256 string) bool
- func Verify(tier, slug, version, sha256hex string, rel *Release) error
- type Input
- type Key
- type Outcome
- type PresigningRelease
- type Release
Constants ¶
const ( TierFree = "free" TierLicensed = "licensed" )
The two plugin tiers. A key serves exactly one of them.
const Alg = "ed25519"
Alg is the only signature algorithm the contract defines.
Variables ¶
var Floor, _ = loadFloor(signedSinceJSON)
Floor maps tier -> slug -> first signed version. Tests swap it with signaturetest.UseFloor.
var Keys = []Key{}
Keys is the trust root. Empty until P7-PLUG-71 (free) and P7-PLUG-72 (licensed).
var Presigning, _ = loadPresigning(signedSinceJSON)
Presigning maps tier -> slug -> pre-signing releases. Tests swap it with signaturetest.UsePresigning.
var Revoked = []string{}
Revoked lists key ids that no longer verify anything, whatever Keys holds.
Functions ¶
func CheckKeys ¶
func CheckKeys() error
CheckKeys reports whether the key table is usable: ids derived from the keys, no id or public key repeated, no key listed under two tiers, no malformed or small-order key. A broken table fails every Verify closed; TestKeyTable runs this over the committed table.
func FloorRequires ¶
FloorRequires reports whether an entry of tier/slug/version must carry a release_signature because of the floor.
func Pinned ¶
Pinned reports whether the key table holds at least one key for tier. A revoked key still counts: a tier that once pinned a key never falls back to treating signatures as absent.
func SigningInput ¶
SigningInput returns the bytes the release pipeline signs: "nself-plugin-v1\n<slug>\n<version>\n<sha256 hex>\n".
func UnsignedAllowed ¶
UnsignedAllowed reports whether an unsigned release of tier/slug/version with archive digest sha256 may proceed to the ordinary unsigned rule. It is false when the floor or the pre-signing list names the slug (in any tier) and this exact (tier, slug, version, sha256) is not on the list.
Types ¶
type Input ¶
type Input struct {
Tier, Slug, Version, SHA256 string
Release *Release // nil when the entry has none
V15 bool // compat.V15() at the call site
Strict bool // refuse a missing signature even in v1.4 mode (NSELF_PLUGIN_REQUIRE_CHECKSUM on a stable plugin)
AllowUnsigned bool // --allow-unsigned; the caller passes true only for local path or link installs
}
Input is one install decision.
type Key ¶
type Key struct {
ID string // derived: plugins-<first 16 hex of sha256(PublicKey)>
Tier string // TierFree or TierLicensed
PublicKey ed25519.PublicKey
}
Key is one trusted release-signing public key.
type Outcome ¶
type Outcome struct {
Verified bool // a signature was checked and is good
Warning string // non-empty: print once and proceed
}
Outcome reports a passing decision.
type PresigningRelease ¶
PresigningRelease is one release that existed before signing began.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package signaturetest gives tests a throwaway release key and swaps the compiled-in key table and floor, restoring both on t.Cleanup.
|
Package signaturetest gives tests a throwaway release key and swaps the compiled-in key table and floor, restoring both on t.Cleanup. |