Documentation
¶
Index ¶
- Constants
- Variables
- func BuildTypeOf(predicate proto.Message) string
- func BuilderIDOf(predicate proto.Message) string
- func FillNilMessages(m proto.Message)
- func IsKnownPredicateType(uri string) bool
- func KnownPredicateTypes() []string
- func NewPredicate(predicateType string) (proto.Message, bool)
- func RepoMatches(expected, actual string) (bool, error)
- func VersionedTagMatches(expected, tag string) bool
- type Evaluator
- type PredicateFactory
Constants ¶
const ( PredicateProvenanceV01 = "https://slsa.dev/provenance/v0.1" PredicateProvenanceV02 = "https://slsa.dev/provenance/v0.2" PredicateProvenanceV1 = "https://slsa.dev/provenance/v1" PredicateSourceProvenance = sourceprovenance.SourceProvPredicateType PredicateTagProvenance = sourceprovenance.TagProvPredicateType // The final (non-draft) source predicate types, published under the // project's new name (source-tool, formerly slsa-source-poc). They // carry the same payload as the v1-draft versions and parse into // the same protos. PredicateSourceProvenanceV1 = "https://github.com/slsa-framework/source-tool/source-provenance/v1" PredicateTagProvenanceV1 = "https://github.com/slsa-framework/source-tool/tag-provenance/v1" )
SLSA predicate type URIs supported by the verifier. VSA predicate types live in pkg/slsa/vsa; they're parsed by adapters there rather than via the protojson path used here, so they're not registered in this map.
Variables ¶
var ErrExpectedRepoHasRef = errors.New("expected source repository must not carry a ref (@...)")
ErrExpectedRepoHasRef is returned when an expected source repository carries a git ref (…@refs/heads/main): the repository expectation is about where the source lives, and the ref belongs to the branch and tag expectations.
var ErrNonBooleanResult = errors.New("eval: expression did not return a boolean")
ErrNonBooleanResult is returned when a CEL expression produces a value that is not a boolean.
var ErrUnsupportedPredicate = errors.New("eval: unsupported predicate type")
ErrUnsupportedPredicate is returned when an evaluator is asked to run against a predicate type it does not have a CEL environment for.
Functions ¶
func BuildTypeOf ¶
BuildTypeOf extracts the build provenance buildType URI from a parsed SLSA build predicate, normalising across versions:
- v0.1 → Provenance.Recipe.Type
- v0.2 → Provenance.BuildType
- v1.0 → Provenance.BuildDefinition.BuildType
Returns "" for the SLSA source predicate or any non-build predicate (which carry no buildType concept).
func BuilderIDOf ¶
BuilderIDOf extracts the builder id from a parsed SLSA build predicate, normalising across versions:
- v0.1 → Provenance.Builder.Id
- v0.2 → Provenance.Builder.Id
- v1.0 → Provenance.RunDetails.Builder.Id
Returns "" for predicates that carry no builder (the source track).
func FillNilMessages ¶
FillNilMessages walks a protobuf message tree and ensures every singular message-typed field is allocated (zero-valued if the parsed payload omitted it). This makes CEL expressions like
predicate.runDetails.builder.id
safe to evaluate when intermediate fields are absent: the chain resolves to the zero value of the leaf field instead of erroring on a nil intermediate message.
Lists and maps of messages are walked so their entries are filled recursively. Oneof cases are not auto-allocated (a oneof selects at most one variant — automatically materialising one is wrong). Well-known google.protobuf.* types (Struct, Value, Timestamp, …) are left untouched: their own runtime semantics would conflict with naive zero-filling, CEL resolves them to their defaults when unset, and allocating them would make has() report an absent field as present.
func IsKnownPredicateType ¶
IsKnownPredicateType reports whether the given URI matches a SLSA predicate type the verifier supports.
func KnownPredicateTypes ¶
func KnownPredicateTypes() []string
KnownPredicateTypes returns the list of supported predicate-type URIs.
func NewPredicate ¶
NewPredicate returns an empty proto.Message for the given predicate type or false if the type is unknown.
func RepoMatches ¶
RepoMatches reports whether the source URI recorded in a provenance denotes the expected repository. Provenance generators spell the source in several ways — git+https://github.com/org/repo@refs/tags/v1, https://github.com/org/repo, github.com/org/repo — and so do users, so both sides are normalized the way the original slsa-verifier did before comparing:
- a leading git+ is dropped; a scheme in expected must match the recorded one, while a scheme-less expected (github.com/org/repo) accepts any scheme;
- the ref (@…) is dropped from the recorded URI; expected must not carry one, which returns ErrExpectedRepoHasRef;
- a trailing / or .git is dropped and the host compares case-insensitively. The path keeps its case.
An empty recorded URI never matches.
func VersionedTagMatches ¶
VersionedTagMatches reports whether tag satisfies the versioned expectation expected, following semantic versioning the way the original slsa-verifier's --source-versioned-tag did:
- expected must be valid semver with a leading v (v1, v1.2, v1.2.3);
- the tag is canonicalized (v1.2 reads as v1.2.0) and must be valid semver too; a leading refs/tags/ is accepted and dropped;
- the major version must match;
- the minor and patch versions are compared only when expected states them, so v1 accepts every v1.x.y and v1.2 every v1.2.y;
- a prerelease is compared as part of the patch (v1.2.3-rc1 is not v1.2.3), while build metadata is ignored, as semver requires.
Anything that is not semver on either side does not match.
Types ¶
type Evaluator ¶
type Evaluator struct {
// contains filtered or unexported fields
}
Evaluator compiles and runs CEL expressions against SLSA predicates. One cel.Env is built per supported predicate type so expressions can reference predicate fields by their typed proto descriptor.
func NewEvaluator ¶
NewEvaluator builds an Evaluator with one cel.Env for every predicate type registered in the package registry.
func (*Evaluator) Evaluate ¶
func (e *Evaluator) Evaluate( predicateType, expression string, predicate proto.Message, subjects []*intoto.ResourceDescriptor, params map[string]any, ) (bool, error)
Evaluate compiles and runs expression for predicateType, returning the boolean result. params is exposed to the expression as the `params` variable; predicate as `predicate`; subjects as `subjects`.
type PredicateFactory ¶
PredicateFactory returns an empty proto.Message of the matching predicate type.
Source Files