sourcetool

package
v0.7.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 3, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ControlConfigurations = []models.ControlConfiguration{
	models.CONFIG_POLICY, models.CONFIG_GEN_PROVENANCE, models.CONFIG_BRANCH_RULES, models.CONFIG_TAG_RULES,
}

Functions

This section is empty.

Types

type AttOpFn added in v0.7.0 

type AttOpFn func(*AttestOptions) error

func WithLocalPolicy added in v0.7.0 

func WithLocalPolicy(p string) AttOpFn

func WithOutputPath added in v0.7.0 

func WithOutputPath(p string) AttOpFn

func WithProvenance added in v0.7.1 

func WithProvenance(s bool) AttOpFn

func WithPush added in v0.7.0 

func WithPush(s bool) AttOpFn

func WithSign added in v0.7.0 

func WithSign(s bool) AttOpFn

func WithUseStdout added in v0.7.0 

func WithUseStdout(s bool) AttOpFn

func WithVSA added in v0.7.1 

func WithVSA(s bool) AttOpFn

type AttestOptions added in v0.7.0 

type AttestOptions struct {
	LocalPolicy string
	Sign        bool
	OutputPath  string
	UseStdOut   bool
	Push        bool

	// Provenance and VSA select which attestations are written to the output.
	// VSA also gates policy evaluation: when false, the policy is not consulted
	// and only the provenance is produced.
	Provenance bool
	VSA        bool
}

type AttestationResult added in v0.7.0 

type AttestationResult struct {
	VerifiedLevels slsa.SourceVerifiedLevels
	Shortfall      *policy.PolicyShortfall
}

AttestationResult is the outcome of attesting a revision. Both attestations are always produced (and optionally pushed) regardless of whether the policy's target level was achieved. Shortfall will be not nil when the achieved SLSA level is below the policy's target.

type ConfigFn 

type ConfigFn func(*Tool) error

func WithAllowMergeCommits added in v0.7.0 

func WithAllowMergeCommits(allow bool) ConfigFn

func WithAuthenticator 

func WithAuthenticator(a *auth.Authenticator) ConfigFn

func WithCreatePolicyPR 

func WithCreatePolicyPR(yesno bool) ConfigFn

func WithEnforce 

func WithEnforce(enforce bool) ConfigFn

func WithExpectedIdentity added in v0.7.0 

func WithExpectedIdentity(issuer, san string) ConfigFn

WithExpectedIdentity overrides the identity (OIDC issuer and SAN) expected to have signed the attestations the tool verifies. Empty values keep the corresponding default.

func WithGithubCollector added in v0.7.0 

func WithGithubCollector(yesno bool) ConfigFn

func WithGithubStorer added in v0.7.0 

func WithGithubStorer(yesno bool) ConfigFn

func WithNotesCollector added in v0.7.0 

func WithNotesCollector(yesno bool) ConfigFn

func WithNotesStorer added in v0.7.0 

func WithNotesStorer(yesno bool) ConfigFn

func WithPolicyRepo 

func WithPolicyRepo(slug string) ConfigFn

func WithStorageLocation added in v0.7.0 

func WithStorageLocation(l ...string) ConfigFn

func WithUserForkOrg 

func WithUserForkOrg(org string) ConfigFn

type Tool 

type Tool struct {
	Authenticator *auth.Authenticator

	Options options.Options
	// contains filtered or unexported fields
}

Tool is the main object intended to expose sourcetool's functionality as a public API. Some of the logic is still implemented on the CLI commands but we want to slowly move it to public function under this struct.

func New 

func New(funcs ...ConfigFn) (*Tool, error)

New initializes a new source tool instance.

func (*Tool) AttestRevision added in v0.7.0 

func (t *Tool) AttestRevision(
	ctx context.Context, branch *models.Branch, rev models.Revision, funcs ...AttOpFn,
) (*AttestationResult, error)

AttestRevision checks the source control system status, the repository policy and generates the repository attestations (provenance & VSA) for a revision

func (*Tool) Attester added in v0.7.0 

func (t *Tool) Attester() *attest.Attester

Attester returns an attester object with the tool configuration

func (*Tool) Backend added in v0.7.0 

func (t *Tool) Backend() models.VcsBackend

Backend returns the VCS backend

func (*Tool) CheckPolicyRepoFork 

func (t *Tool) CheckPolicyRepoFork(_ context.Context) (bool, error)

CheckPolicyRepoFork checks that the logged in user has a fork of the configured policy repo.

func (*Tool) ConfigureControls 

func (t *Tool) ConfigureControls(ctx context.Context, repo *models.Repository, branches []*models.Branch, configs []models.ControlConfiguration) error

ConfigureControls sets up a control in the repo

func (*Tool) ControlConfigurationDescr 

func (t *Tool) ControlConfigurationDescr(branch *models.Branch, config models.ControlConfiguration) string

ControlConfigurationDescr returns a description of the controls

func (*Tool) ControlPrecheck 

func (t *Tool) ControlPrecheck(
	_ context.Context, r *models.Repository, branches []*models.Branch, config models.ControlConfiguration,
) (ok bool, remediationMessage string, remediateFn models.ControlPreRemediationFn, err error)

ControlPrecheck performs a prerequisite check before enabling a contrlol Backend may optionally return a remediation function to correct the prerequisite which the CLI can before attempting to enable the control.

func (*Tool) CreateBranchPolicy 

func (t *Tool) CreateBranchPolicy(ctx context.Context, r *models.Repository, branches []*models.Branch) (*policy.RepoPolicy, error)

CreateBranchPolicy creates a repository policy

func (*Tool) CreatePolicyRepoFork 

func (t *Tool) CreatePolicyRepoFork(ctx context.Context) error

CreatePolicyRepoFork creates a fork of the policy repository in the user's GitHub org

func (*Tool) CreateRepositoryPolicy 

func (t *Tool) CreateRepositoryPolicy(ctx context.Context, r *models.Repository, branches []*models.Branch) (*policy.RepoPolicy, *models.PullRequest, error)

CreateRepositoryPolicy creates a policy for a repository

func (*Tool) FindPolicyPR 

func (t *Tool) FindPolicyPR(ctx context.Context, repo *models.Repository) (*models.PullRequest, error)

func (*Tool) FindProvenanceWorkflows added in v0.7.1 

func (t *Tool) FindProvenanceWorkflows(ctx context.Context, branch *models.Branch) ([]*models.ProvenanceWorkflow, error)

FindProvenanceWorkflows returns the workflows in the branch that call the SLSA source actions to generate provenance. Workflows still calling the actions from a legacy repository are flagged so they can be updated.

func (*Tool) GetBranchControls 

func (t *Tool) GetBranchControls(ctx context.Context, branch *models.Branch) (*slsa.ControlSet, error)

GetRepoControls returns the controls that are enabled in a repository branch.

func (*Tool) GetBranchControlsAtCommit added in v0.7.0 

func (t *Tool) GetBranchControlsAtCommit(ctx context.Context, branch *models.Branch, commit *models.Commit) (*slsa.ControlSet, error)

GetRepoControls returns the controls that are enabled in a repository branch.

func (*Tool) GetPreviousCommit added in v0.7.0 

func (t *Tool) GetPreviousCommit(ctx context.Context, branch *models.Branch, commit *models.Commit) (*models.Commit, error)

GetPreviousCommit returns the previous commit of the passed commit

func (*Tool) GetRepositoryPolicy 

func (t *Tool) GetRepositoryPolicy(ctx context.Context, r *models.Repository) (*policy.RepoPolicy, error)

GetRepositoryPolicy retrieves the policy of repo from the community

func (*Tool) GetRevisionAttestations added in v0.7.1 

func (t *Tool) GetRevisionAttestations(ctx context.Context, branch *models.Branch, rev models.Revision, includeProvenance, includeVSA bool) ([]attest.FetchedEnvelope, error)

GetRevisionAttestations fetches the stored attestations for a revision. The includeProvenance and includeVSA flags select which predicate types are requested. The returned envelopes carry their verification result and are not filtered by it, so callers can print or inspect attestations that fail to verify.

func (*Tool) OnboardRepository 

func (t *Tool) OnboardRepository(ctx context.Context, repo *models.Repository, branches []*models.Branch) error

OnboardRepository configures a repository to set up the required controls to meet SLSA Source L3.

Source Files

View all Source files

Directories

Path Synopsis
backends
vcs/github
modelsfakes
Code generated by counterfeiter.
 Code generated by counterfeiter.
Code generated by counterfeiter.
 Code generated by counterfeiter.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.