store

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 14, 2026 License: Apache-2.0 Imports: 21 Imported by: 0

Documentation

Overview

Package store defines persistence boundaries for the Registry HTTP layer. The in-memory implementation is intentionally ephemeral and is intended for offline tests and explicitly enabled local development only.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrNotFound       = errors.New("registry store object not found")
	ErrAlreadyExists  = errors.New("registry store object already exists")
	ErrTokenExpired   = errors.New("registry bearer token expired")
	ErrInvalidCursor  = errors.New("registry list cursor is invalid")
	ErrNotImplemented = errors.New("registry persistent hosted capability is not implemented")
)

Functions

func HashBearerToken 

func HashBearerToken(token string) [32]byte

Types

type Artifact 

type Artifact struct {
	Kind     ArtifactKind  `json:"kind"`
	Name     string        `json:"name"`
	Version  string        `json:"version"`
	Digest   schema.Digest `json:"digest"`
	Document []byte        `json:"-"`
}

type ArtifactKind 

type ArtifactKind string
const (
	ArtifactPack    ArtifactKind = "pack"
	ArtifactProfile ArtifactKind = "profile"
)

type Capabilities 

type Capabilities struct {
	DurablePersistence    bool `json:"durable_persistence"`
	HostedVerification    bool `json:"hosted_verification"`
	OwnershipVerification bool `json:"ownership_verification"`
}

type IngestRecord 

type IngestRecord struct {
	Session       *domain.IngestSession
	DeclaredBytes int64
	UploadDigest  schema.Digest
	ChallengeHash [32]byte
}

type Memory 

type Memory struct {
	// contains filtered or unexported fields
}

Memory is concurrency-safe but deliberately non-durable. Its use in a running binary must be explicitly acknowledged by the operator.

func NewMemory 

func NewMemory() *Memory

func (*Memory) AddBearerToken 

func (memory *Memory) AddBearerToken(token string, principal domain.Principal, expiresAt time.Time) error

AddBearerToken hashes the token before retaining it. The plaintext is not stored and is never exposed by the Store interface.

func (*Memory) Capabilities 

func (memory *Memory) Capabilities() Capabilities

func (*Memory) CreateIngest 

func (memory *Memory) CreateIngest(_ context.Context, record IngestRecord) error

func (*Memory) CurrentOwnership 

func (memory *Memory) CurrentOwnership(_ context.Context, subject domain.SubjectNamespace, now time.Time) (*domain.Ownership, error)

func (*Memory) EnqueueVerification 

func (memory *Memory) EnqueueVerification(_ context.Context, _ schema.InstanceID) error

func (*Memory) GetArtifact 

func (memory *Memory) GetArtifact(_ context.Context, kind ArtifactKind, name, version string) (Artifact, error)

func (*Memory) GetDispute 

func (memory *Memory) GetDispute(_ context.Context, id schema.InstanceID) (*domain.Dispute, error)

func (*Memory) GetIngest 

func (memory *Memory) GetIngest(_ context.Context, id schema.InstanceID) (IngestRecord, error)

func (*Memory) GetObservation 

func (memory *Memory) GetObservation(_ context.Context, id schema.Digest) (registryapi.Observation, error)

func (*Memory) GetStagedObservation 

func (memory *Memory) GetStagedObservation(_ context.Context, id schema.InstanceID) (registryapi.Observation, error)

func (*Memory) ListObservations 

func (memory *Memory) ListObservations(_ context.Context, filter ObservationFilter, cursor string, limit int) (ObservationPage, error)

func (*Memory) LookupBearerToken 

func (memory *Memory) LookupBearerToken(_ context.Context, hash [32]byte, now time.Time) (domain.Principal, error)

func (*Memory) PutArtifact 

func (memory *Memory) PutArtifact(artifact Artifact) error

PutArtifact installs a signed/digest-checked fixture or a result from a higher-level artifact verifier. The HTTP layer has no endpoint that can call it with user-controlled content.

func (*Memory) PutDispute 

func (memory *Memory) PutDispute(_ context.Context, dispute *domain.Dispute) error

func (*Memory) PutOwnership 

func (memory *Memory) PutOwnership(_ context.Context, ownership *domain.Ownership) error

func (*Memory) PutOwnershipChallenge 

func (memory *Memory) PutOwnershipChallenge(_ context.Context, challenge *domain.OwnershipChallenge) error

func (*Memory) PutPublishedObservation 

func (memory *Memory) PutPublishedObservation(_ context.Context, observation registryapi.Observation) error

func (*Memory) PutStagedObservation 

func (memory *Memory) PutStagedObservation(_ context.Context, id schema.InstanceID, observation registryapi.Observation) error

func (*Memory) SetBearerToken 

func (memory *Memory) SetBearerToken(token string, principal domain.Principal, expiresAt time.Time) error

SetBearerToken installs or refreshes an operator-configured credential. It is intentionally outside the Store request interface: callers must already control process configuration, and only the SHA-256 token hash is retained.

func (*Memory) UpdateIngest 

func (memory *Memory) UpdateIngest(_ context.Context, record IngestRecord) error

type ObservationFilter 

type ObservationFilter struct {
	Subject string
	Version string
	Pack    string
	Profile string
	Trust   string
	Fresh   string
}

type ObservationIndex 

type ObservationIndex struct {
	Subject     string
	Version     string
	Pack        string
	PackVersion string
	Profile     string
	TrustLabels []string
	Freshness   string
}

func IndexObservation 

func IndexObservation(observation registryapi.Observation) (ObservationIndex, error)

type ObservationPage 

type ObservationPage struct {
	Items      []registryapi.Observation
	NextCursor string
}

type SQLite 

type SQLite struct {
	// contains filtered or unexported fields
}

SQLite is the durable single-node self-hosted Registry store. Hosted verification remains a separate service and is not implied by durability.

func OpenSQLite 

func OpenSQLite(path string) (*SQLite, error)

func (*SQLite) AddBearerToken 

func (store *SQLite) AddBearerToken(token string, principal domain.Principal, expiresAt time.Time) error

func (*SQLite) Backup 

func (store *SQLite) Backup(ctx context.Context, destination string) error

Backup creates a transactionally consistent standalone SQLite copy using VACUUM INTO. The destination must not already exist.

func (*SQLite) Capabilities 

func (store *SQLite) Capabilities() Capabilities

func (*SQLite) Close 

func (store *SQLite) Close() error

func (*SQLite) CreateIngest 

func (store *SQLite) CreateIngest(ctx context.Context, record IngestRecord) error

func (*SQLite) CurrentOwnership 

func (store *SQLite) CurrentOwnership(ctx context.Context, subject domain.SubjectNamespace, now time.Time) (*domain.Ownership, error)

func (*SQLite) EnqueueVerification 

func (store *SQLite) EnqueueVerification(context.Context, schema.InstanceID) error

func (*SQLite) GetArtifact 

func (store *SQLite) GetArtifact(ctx context.Context, kind ArtifactKind, name, version string) (Artifact, error)

func (*SQLite) GetDispute 

func (store *SQLite) GetDispute(ctx context.Context, id schema.InstanceID) (*domain.Dispute, error)

func (*SQLite) GetIngest 

func (store *SQLite) GetIngest(ctx context.Context, id schema.InstanceID) (IngestRecord, error)

func (*SQLite) GetObservation 

func (store *SQLite) GetObservation(ctx context.Context, id schema.Digest) (registryapi.Observation, error)

func (*SQLite) GetStagedObservation 

func (store *SQLite) GetStagedObservation(ctx context.Context, id schema.InstanceID) (registryapi.Observation, error)

func (*SQLite) InspectSchema 

func (store *SQLite) InspectSchema(ctx context.Context) (int, error)

InspectSchema is used by backup/restore smoke tests without exposing SQL.

func (*SQLite) ListObservations 

func (store *SQLite) ListObservations(ctx context.Context, filter ObservationFilter, cursor string, limit int) (ObservationPage, error)

func (*SQLite) LookupBearerToken 

func (store *SQLite) LookupBearerToken(ctx context.Context, hash [32]byte, now time.Time) (domain.Principal, error)

func (*SQLite) PutArtifact 

func (store *SQLite) PutArtifact(artifact Artifact) error

func (*SQLite) PutDispute 

func (store *SQLite) PutDispute(ctx context.Context, dispute *domain.Dispute) error

func (*SQLite) PutOwnership 

func (store *SQLite) PutOwnership(ctx context.Context, ownership *domain.Ownership) error

func (*SQLite) PutOwnershipChallenge 

func (store *SQLite) PutOwnershipChallenge(ctx context.Context, challenge *domain.OwnershipChallenge) error

func (*SQLite) PutPublishedObservation 

func (store *SQLite) PutPublishedObservation(ctx context.Context, observation registryapi.Observation) error

func (*SQLite) PutStagedObservation 

func (store *SQLite) PutStagedObservation(ctx context.Context, id schema.InstanceID, observation registryapi.Observation) error

func (*SQLite) SetBearerToken 

func (store *SQLite) SetBearerToken(token string, principal domain.Principal, expiresAt time.Time) error

SetBearerToken atomically installs or refreshes a credential supplied by process configuration. The plaintext token is never written to SQLite.

func (*SQLite) UpdateIngest 

func (store *SQLite) UpdateIngest(ctx context.Context, record IngestRecord) error

type Store 

type Store interface {
	Capabilities() Capabilities
	LookupBearerToken(context.Context, [32]byte, time.Time) (domain.Principal, error)

	CreateIngest(context.Context, IngestRecord) error
	GetIngest(context.Context, schema.InstanceID) (IngestRecord, error)
	UpdateIngest(context.Context, IngestRecord) error
	PutStagedObservation(context.Context, schema.InstanceID, registryapi.Observation) error
	GetStagedObservation(context.Context, schema.InstanceID) (registryapi.Observation, error)
	EnqueueVerification(context.Context, schema.InstanceID) error

	PutPublishedObservation(context.Context, registryapi.Observation) error
	GetObservation(context.Context, schema.Digest) (registryapi.Observation, error)
	ListObservations(context.Context, ObservationFilter, string, int) (ObservationPage, error)

	PutOwnershipChallenge(context.Context, *domain.OwnershipChallenge) error
	PutOwnership(context.Context, *domain.Ownership) error
	CurrentOwnership(context.Context, domain.SubjectNamespace, time.Time) (*domain.Ownership, error)

	PutDispute(context.Context, *domain.Dispute) error
	GetDispute(context.Context, schema.InstanceID) (*domain.Dispute, error)

	GetArtifact(context.Context, ArtifactKind, string, string) (Artifact, error)
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.