Documentation
¶
Overview ¶
Package trust supplies the estate's artefact artifacts.Verifier: a signature is accepted only when the key embedded in the calling binary and the key published over WKD agree.
It is a separate package so that gitlab.com/phpboyscout/go/artifacts itself keeps no dependencies. Importing the root package to resolve an artefact should not pull in an OpenPGP implementation; importing this one is the point at which you have asked for cryptography.
Why fail-closed here ¶
go/signing's CompositeResolver defaults to fail-OPEN: if the WKD fetch errors, it logs a warning and proceeds on the embedded key alone. That is the right default for self-update, where a tool behind a broken proxy should still be able to patch itself, and the wrong one here. An attacker who can make openpgpkey.phpboyscout.uk unreachable — a captive portal, a poisoned resolver, a firewall rule — would silently downgrade dual verification to single, and the only evidence would be a log line nobody reads.
Artefact resolution has no such pressure to continue. An unreachable WKD endpoint means try again later, not proceed on one anchor. So Estate sets RequireExternalCrosscheck, and this package exists largely so that decision is made once rather than by each consumer writing their own resolver config.
Index ¶
Constants ¶
const ReleaseEmail = "artifacts-release@phpboyscout.uk"
ReleaseEmail is the WKD identity the channel's signing key is published under.
The local part of the uid on the key that signs every manifest (Artifacts Release Signing). Changing it changes which key is trusted, so it is a constant rather than an option.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*config)
Option configures the estate verifier.
func WithHTTPClient ¶
WithHTTPClient supplies the client used for the WKD fetch, for callers needing a proxy, custom TLS, or instrumentation. Without one, go/signing's default (30s timeout) is used.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks manifest signatures against the estate's dual trust anchors.
The zero value is not usable; construct with Estate. Safe for concurrent use.
func Estate ¶
Estate returns a Verifier that requires the embedded key and the WKD-published key to agree, and fails closed if either is unavailable.
embeddedKey is the ASCII-armored public key compiled into the calling binary — conventionally via go:embed of a copy of keys/artifacts-release-signing.asc. It is a required argument rather than an option because of a sharp edge in go/signing: BuildKeyResolver with key_source=both silently DEGRADES to a WKD-only resolver when no embedded keys are supplied, and discards RequireExternalCrosscheck when it does. A caller who forgot to embed a key would get single-anchor verification that reported success. Refusing an empty key here turns that into an error at construction.
func (*Verifier) Fingerprints ¶
Fingerprints reports the trusted key fingerprints, resolving them if needed.
For diagnostics — a tool that wants to log or display which key it is trusting before it resolves anything.
Source Files