provenance

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 14, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Overview

Package provenance provides deterministic local attestations. It does not assign Registry trust labels; those are derived by an independent policy.

Index

Constants

View Source 
const (
	JournalSchema        = "urn:agentapi-doctor:run-journal-event:v1alpha1"
	MaxJournalEventBytes = 1 << 20
)
View Source 
const EnvelopeVersion = "dsse-envelope-v1"

Variables

This section is empty.

Functions

func KeyID 

func KeyID(publicKey ed25519.PublicKey) string

func Verify 

func Verify(envelope Envelope, trusted map[string]ed25519.PublicKey, threshold int) ([]byte, error)

Verify requires threshold distinct trusted signatures and returns a copy of the canonical statement. Unknown keys do not count; malformed signatures fail closed rather than being ignored.

Types

type Envelope 

type Envelope struct {
	Version     string      `json:"version"`
	PayloadType string      `json:"payloadType"`
	Payload     string      `json:"payload"`
	Signatures  []Signature `json:"signatures"`
}

func AddSignature 

func AddSignature(envelope Envelope, privateKey ed25519.PrivateKey) (Envelope, error)

AddSignature signs the same immutable payload with another key. Duplicate key IDs are rejected so threshold verification counts independent keys.

func Sign 

func Sign(payloadType string, statement []byte, privateKey ed25519.PrivateKey) (Envelope, error)

Sign canonicalizes a JSON statement, signs DSSE pre-authentication bytes, and returns an envelope containing exactly one signature.

type EventInput 

type EventInput struct {
	EventType         string
	Status            RunStatus
	OccurredAt        schema.UTCTime
	MonotonicOffsetNS int64
	PayloadDigest     schema.Digest
}

type Journal 

type Journal struct {
	// contains filtered or unexported fields
}

func DecodeJournal 

func DecodeJournal(reader io.Reader) (*Journal, error)

func NewJournal 

func NewJournal(runID schema.InstanceID) (*Journal, error)

func (*Journal) Append 

func (journal *Journal) Append(input EventInput) (JournalEvent, error)

func (*Journal) EncodeJSONL 

func (journal *Journal) EncodeJSONL() ([]byte, error)

func (*Journal) Events 

func (journal *Journal) Events() []JournalEvent

func (*Journal) Verify 

func (journal *Journal) Verify() error

type JournalEvent 

type JournalEvent struct {
	SchemaVersion       string            `json:"schema_version"`
	RunID               schema.InstanceID `json:"run_id"`
	Sequence            uint64            `json:"sequence"`
	PreviousEventDigest schema.Digest     `json:"previous_event_digest"`
	EventType           string            `json:"event_type"`
	Status              RunStatus         `json:"status"`
	OccurredAt          schema.UTCTime    `json:"occurred_at"`
	MonotonicOffsetNS   int64             `json:"monotonic_offset_ns"`
	PayloadDigest       schema.Digest     `json:"payload_digest"`
	EventDigest         schema.Digest     `json:"event_digest"`
}

type RunStatus 

type RunStatus string
const (
	RunPlanned   RunStatus = "planned"
	RunRunning   RunStatus = "running"
	RunCompleted RunStatus = "completed"
	RunCancelled RunStatus = "cancelled"
	RunErrored   RunStatus = "errored"
)

type Signature 

type Signature struct {
	KeyID string `json:"keyid"`
	Sig   string `json:"sig"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.