Documentation
¶
Overview ¶
Package subject binds the artifacts a caller holds to the subjects an attestation is about. An Expected subject comes from a digest the caller states (algo:digest) or from hashing a file with the algorithms the attestation's subjects use; MatchAll then reports, per expected subject, whether the attestation covers it.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Algorithms ¶
func Algorithms(subjects []attestation.Subject) (hashable []intoto.HashAlgorithm, other []string)
Algorithms returns the digest algorithms the subjects use, split into those files can be hashed with and those that cannot (gitCommit, dirHash and other digests that are not a hash of the file contents, or algorithms the hasher does not implement). Both lists are sorted and de-duplicated.
func AllMatched ¶
AllMatched reports whether every match succeeded. An empty list is trivially matched: nothing was asked.
Types ¶
type Expected ¶
type Expected struct {
// Name is how the artifact is reported back: the file path it was
// hashed from, or the algo:digest spec it was given as.
Name string
// Digests holds the artifact's digests keyed by in-toto algorithm
// name (sha256, sha512, gitCommit, …).
Digests map[string]string
}
Expected is an artifact the caller holds, identified by its digests. It implements attestation.Subject so it can be compared with the subjects of a statement directly.
func HashFiles ¶
func HashFiles(paths []string, algos []intoto.HashAlgorithm) ([]*Expected, error)
HashFiles hashes each path with every algorithm given, in parallel, and returns one Expected per path in the same order, named by path.
type Match ¶
type Match struct {
// Expected is the subject the caller asked about.
Expected *Expected
// Subject is the attestation subject it matched, nil when none did.
Subject attestation.Subject
// Matched reports whether an attestation subject covers Expected:
// the two share at least one digest algorithm and agree on every
// algorithm they share.
Matched bool
// Message says why there was no match. Empty when Matched.
Message string
}
Match is the outcome of looking for one expected subject among an attestation's subjects.
func MatchAll ¶
func MatchAll(expected []*Expected, subjects []attestation.Subject, opts ...MatchOption) []Match
MatchAll looks for every expected subject among subjects and reports each outcome in order. Matching follows attestation.SubjectsMatch: a subject matches when it shares at least one digest algorithm with the expected subject and every shared digest is equal.
type MatchOption ¶
type MatchOption func(*matchOptions)
MatchOption tunes how expected subjects are compared with the attestation's.
func WithGitDigestAliases ¶
func WithGitDigestAliases(enabled bool) MatchOption
WithGitDigestAliases controls whether the git object digests (gitCommit, gitTree, gitBlob, gitTag) are interchangeable with the hash they are: a 40-character git digest is also a sha1 digest and a 64-character one is also a sha256 digest, on both sides of the comparison, so sha1:<sha> matches an attestation subject carrying gitCommit:<sha> and the other way around. An algorithm a subject already states is never overridden. On by default; pass false to require the exact algorithm names.
Source Files