controls

type Catalog ¶

type Catalog struct {
	Controls        map[Category][]*Control
	PredicateTracks map[string][]Track
}

Catalog is a loaded set of controls grouped by category.

PredicateTracks is a predicate-type to track mapping assembled at load time by walking every control's checks. A predicate type may appear under more than one track (because a VSA applicable to both build and source) when that happens, the verifier requires the caller to disambiguate via VerificationOptions.ForceTrack.

This need to be exported for tests can construct synthetic catalogs.

func LoadEmbedded() (*Catalog, error)

func (c *Catalog) Get(cat Category) []*Control

func (c *Catalog) ResolveCore(track Track, spec string) (Category, string, error)

func (c *Catalog) TracksOf(predicateType string) []Track

type Category ¶

type Category string

Category groups controls by their location in the embedded catalog tree. The string value matches the relative directory under catalogRoot. Core categories carry the SLSA spec version whose criteria they implement as their middle path segment (track/version/core). buildType categories are unversioned: they hold builder-specific custom controls, not spec-defined criteria.

const (
	// BuildCore groups SLSA spec-defined controls applied to build
	// provenance, as defined since SLSA v1.0 (the criteria are unchanged
	// through v1.2). Prefer ResolveCore over naming the category directly.
	BuildCore Category = "build/1.0/core"

	// BuildType groups custom controls keyed to specific build types.
	BuildType Category = "build/buildType"

	// SourceCore groups SLSA spec-defined controls applied to SLSA source
	// attestations, introduced with the SLSA v1.2 source track. Prefer
	// ResolveCore over naming the category directly.
	SourceCore Category = "source/1.2/core"
)

type Check ¶

type Check struct {
	PredicateType      string   `yaml:"predicateType"`
	Expression         string   `yaml:"expression"`
	Parameters         []string `yaml:"parameters,omitempty"`
	OptionalParameters []string `yaml:"optionalParameters,omitempty"`
	BuildTypes         []string `yaml:"buildTypes,omitempty"`
}

Check binds a CEL expression to a specific in-toto predicate type along with the names of parameters the expression expects to find on `params`.

Parameters lists params the expression requires: evaluating the check without one of them is an error. OptionalParameters lists params the expression needs to run but that the caller may legitimately omit: when one is missing the check is skipped instead of erroring, so the control drops out of the roster without failing verification.

BuildTypes, when set, narrows the check further to only fire when the statement's build provenance buildType is one of the listed URIs (OR-matched, exact). It is intended for controls under the build/buildType catalog category that are specific to one or more builders. Leaving it empty makes the check apply to any buildType whose predicateType matches.

func (c *Check) Validate() error

type Control ¶

type Control struct {
	ID          string  `yaml:"id"`
	Title       string  `yaml:"title"`
	Description string  `yaml:"description,omitempty"`
	Track       string  `yaml:"track"`
	SLSALevel   int     `yaml:"slsaLevel,omitempty"`
	Checks      []Check `yaml:"checks"`
}

Control models a single verification control: a labelled bundle of CEL checks, each pinned to a specific predicate type.

Track names the SLSA spec track this control targets ("build" or "source"). Every check's predicateType must belong to a predicate type registered under the same track — the load-time cross-validation in the embed loader rejects misclassified controls.

func Load(path string) ([]*Control, error)

func (c *Control) Validate() error

type Track ¶

type Track string

Track names a SLSA spec track. Every control declares the track it targets via its `track` field; the catalog assembles the predicate-type → track mapping from those declarations rather than a hard-coded list.

const (
	TrackBuild  Track = "build"
	TrackSource Track = "source"
)