Documentation
¶
Overview ¶
Package upgrade downloads plexd release binaries from the GitHub release channel and verifies their Sigstore bundles before they are trusted.
Index ¶
Constants ¶
const DefaultReleaseBaseURL = "https://github.com/plexsphere/plexd/releases/download"
DefaultReleaseBaseURL is the base URL of the GitHub release download channel.
const DefaultSigningIdentityRegexp = `^https://github\.com/plexsphere/plexd/\.github/workflows/release\.yml@refs/tags/v.+$`
DefaultSigningIdentityRegexp is the certificate SAN regexp that a release bundle's signing identity must match: the plexd release workflow signed for a tagged version.
const DefaultSigningIssuer = "https://token.actions.githubusercontent.com"
DefaultSigningIssuer is the expected OIDC issuer of the signing certificate.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// ReleaseBaseURL is the base URL of the GitHub release download channel.
// Release assets are fetched from {ReleaseBaseURL}/{tag}/{asset}.
// Default: https://github.com/plexsphere/plexd/releases/download
ReleaseBaseURL string `yaml:"release_base_url"`
// SigningIdentityRegexp is the regexp the signing certificate's SAN must
// match. It is compiled by Validate.
// Default: ^https://github\.com/plexsphere/plexd/\.github/workflows/release\.yml@refs/tags/v.+$
SigningIdentityRegexp string `yaml:"signing_identity_regexp"`
// SigningIssuer is the exact OIDC issuer the signing certificate must carry.
// Default: https://token.actions.githubusercontent.com
SigningIssuer string `yaml:"signing_issuer"`
// TrustedRootPath is the path to a Sigstore trusted root JSON file. When
// empty the embedded public-good trusted root is used.
// Default: "" (use the embedded trusted root)
TrustedRootPath string `yaml:"trusted_root_path"`
}
Config holds the configuration for release download and Sigstore verification.
func (*Config) ApplyDefaults ¶
func (c *Config) ApplyDefaults()
ApplyDefaults sets default values for empty fields. TrustedRootPath is left empty by design so the embedded trusted root remains the default.
type Fetcher ¶
type Fetcher struct {
// contains filtered or unexported fields
}
Fetcher downloads plexd release assets from the GitHub release channel.
func NewFetcher ¶
NewFetcher creates a Fetcher for the given configuration.
func (*Fetcher) FetchBinary ¶
FetchBinary downloads the plexd binary for the given version and returns its body, capped at maxBinaryBytes so a hostile mirror cannot fill the disk before the checksum is verified. The caller must close the returned reader.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks a plexd release Sigstore bundle against a trusted root and a required signing identity. It performs no network I/O.
func NewVerifier ¶
NewVerifier builds a Verifier from the given configuration. The trusted root is read from cfg.TrustedRootPath when set, otherwise the embedded public-good root is used. The signing-identity regexp is compiled here so a malformed pattern is rejected at construction.
func (*Verifier) Verify ¶
Verify checks that bundleJSON is a valid Sigstore bundle for an artifact with the given hex-encoded SHA-256 digest, signed by the configured identity and chaining to the trusted root. Any failure (unparsable bundle, digest or identity mismatch, untrusted chain) is returned as a wrapped error rather than a panic.
Source Files