Documentation
¶
Overview ¶
Package evidence defines immutable, scoped artifacts used by result checks.
Index ¶
- Constants
- Variables
- func DeletionActor(ctx context.Context) string
- func Digest(data []byte) string
- func ValidDigest(value string) bool
- func WithDeletionActor(ctx context.Context, actor string) context.Context
- type Action
- type Artifact
- type Authorizer
- type Ref
- type Repository
- type Sensitivity
- type Storage
- type Tombstone
- type TombstoneReader
Constants ¶
const PrefixArtifact id.Prefix = "evi"
PrefixArtifact identifies immutable evidence objects.
Variables ¶
var ( ErrInvalid = cortex.ErrInvalidEvidence ErrDigestMismatch = cortex.ErrEvidenceDigestMismatch ErrDenied = cortex.ErrEvidenceAccessDenied ErrTooLarge = cortex.ErrEvidenceTooLarge ErrNotFound = cortex.ErrEvidenceNotFound ErrDeleted = cortex.ErrEvidenceDeleted ErrConflict = cortex.ErrEvidenceConflict )
Error aliases preserve the shared Cortex sentinel identities.
Functions ¶
func DeletionActor ¶
DeletionActor returns the host-supplied actor, or empty when absent.
func ValidDigest ¶
ValidDigest accepts only canonical lowercase SHA-256 encodings.
Types ¶
type Artifact ¶
Artifact is the bounded content supplied by a trusted capture adapter.
type Authorizer ¶
Authorizer rechecks the current principal, source grants, sensitivity and retention policy. Delete policy may allow an explicit privacy revocation before retention expires. A nil authorizer never grants access.
type Ref ¶
type Ref struct {
SchemaVersion int `json:"schema_version"`
ID id.ID `json:"id"`
SHA256 string `json:"sha256"`
MediaType string `json:"media_type"`
Bytes int64 `json:"bytes"`
Scope cortex.Scope `json:"scope"`
Version string `json:"version"`
Producer string `json:"producer"`
SourceURI string `json:"source_uri,omitempty"`
Sensitivity Sensitivity `json:"sensitivity"`
CreatedAt time.Time `json:"created_at"`
RetainUntil time.Time `json:"retain_until"`
}
Ref binds content and its identity. SourceURI is an opaque host resource reference, not a download URL. It must not contain credentials.
func (Ref) BindingDigest ¶
BindingDigest hashes the complete versioned reference, including scope, retention and producer. Content hashes alone do not identify authority.
type Repository ¶
type Repository interface {
Put(context.Context, Artifact) (Ref, error)
Open(context.Context, Ref) (io.ReadCloser, error)
Delete(context.Context, Ref, string) error
}
Repository provides authorized evidence access. Delete retains a tombstone.
func NewRepository ¶
func NewRepository(storage Storage, authorizer Authorizer, maxBytes int64) (Repository, error)
NewRepository wraps an injected backend with bounded, digest-checked access. Large artifacts need a separately configured repository. No fallback exists.
type Sensitivity ¶
type Sensitivity string
Sensitivity is a host-enforced classification, never an access grant.
const ( SensitivityPublic Sensitivity = "public" SensitivityInternal Sensitivity = "internal" SensitivityRestricted Sensitivity = "restricted" )
type Storage ¶
type Storage interface {
SaveEvidence(context.Context, Artifact) error
LoadEvidence(context.Context, Ref) (Artifact, error)
TombstoneEvidence(context.Context, Ref, string) error
}
Storage is an optional persistence capability, not an authorization boundary. SaveEvidence is immutable and idempotent only for identical artifacts. LoadEvidence returns ErrDeleted for tombstones. TombstoneEvidence atomically removes bytes and retains the original reference, actor, time and reason. For an absent identity it records the tombstone before any bytes arrive, so delayed uploads cannot resurrect content. All saves must honor that fence. Every operation must match the exact context scope, including reads.
type Tombstone ¶
type Tombstone struct {
Ref Ref `json:"ref"`
Actor string `json:"actor"`
Reason string `json:"reason"`
DeletedAt time.Time `json:"deleted_at"`
}
Tombstone retains immutable identity after content removal. Deletion reasons are audit data, not public output. The host supplies a stable actor reference.
Source Files