archiveio

Documentation

Index

• Constants
• func EncodeManifest(w io.Writer, manifest Manifest) error
• func ValidateManifest(manifest Manifest) error
• func WriteManifest(filename string, manifest Manifest) error
• type BehaviorChange
• type ChangedPath
• type Comparison
  • func Compare(before, after Snapshot) Comparison
• type Entry
• type ExecutableChange
• type Manifest
  • func CreateManifest(snapshot Snapshot, wrapperPolicy string) (Manifest, error)
  • func DecodeManifest(r io.Reader) (Manifest, error)
  • func ReadManifest(filename string) (Manifest, error)
• type ManifestEntry
• type ManifestNormalization
• type ManifestSource
• type MetadataChange
• type PackOptions
• type Snapshot
  • func Inspect(filename string) (Snapshot, error)
  • func Pack(sourceDir, output, format string) (Snapshot, error)
  • func PackWithOptions(sourceDir, output string, options PackOptions) (Snapshot, error)
• type Verification
  • func VerifyManifest(manifest Manifest, snapshot Snapshot) (Verification, error)
• type VerifiedPath

Constants

const (
	ManifestFormat     = "samepack-manifest"
	ManifestVersion    = 1
	ManifestAlgorithm  = "samepack-portable-v1"
	WrapperNone        = "none"
	WrapperStripSingle = "strip-single-directory"
)

Functions

func EncodeManifest

func EncodeManifest(w io.Writer, manifest Manifest) error

EncodeManifest writes deterministic, indented JSON with no timestamps or local paths.

func ValidateManifest

func ValidateManifest(manifest Manifest) error

ValidateManifest treats the document as untrusted input and recomputes both identities.

func WriteManifest

func WriteManifest(filename string, manifest Manifest) error

WriteManifest publishes a complete manifest without replacing an existing path.

Types

type BehaviorChange

type BehaviorChange struct {
	Path             string `json:"path"`
	BeforeExecutable bool   `json:"before_executable"`
	AfterExecutable  bool   `json:"after_executable"`
}

type ChangedPath

type ChangedPath struct {
	Path         string `json:"path"`
	BeforeKind   string `json:"before_kind"`
	AfterKind    string `json:"after_kind"`
	BeforeSHA256 string `json:"before_sha256"`
	AfterSHA256  string `json:"after_sha256"`
	BeforeSize   int64  `json:"before_size"`
	AfterSize    int64  `json:"after_size"`
}

type Comparison

type Comparison struct {
	Classification     string           `json:"classification"`
	ByteIdentical      bool             `json:"byte_identical"`
	ContentIdentical   bool             `json:"content_identical"`
	PortableIdentical  bool             `json:"portable_identical"`
	Before             Snapshot         `json:"before"`
	After              Snapshot         `json:"after"`
	Reasons            []string         `json:"reasons"`
	Added              []string         `json:"added"`
	Removed            []string         `json:"removed"`
	Modified           []ChangedPath    `json:"modified"`
	Metadata           []MetadataChange `json:"metadata"`
	BehaviorModified   []BehaviorChange `json:"behavior_modified"`
	OrderChanged       bool             `json:"order_changed"`
	DirectoriesChanged bool             `json:"directory_entries_changed"`
	StrippedRoots      []string         `json:"stripped_roots"`
}

func Compare

func Compare(before, after Snapshot) Comparison

type Entry

type Entry struct {
	Path    string `json:"path"`
	Kind    string `json:"kind"`
	Size    int64  `json:"size"`
	SHA256  string `json:"sha256"`
	Mode    uint32 `json:"mode"`
	ModTime string `json:"mod_time"`
}

Entry is the content and portable metadata Samepack observes for one path.

type ExecutableChange

type ExecutableChange struct {
	Path               string `json:"path"`
	ExpectedExecutable bool   `json:"expected_executable"`
	ObservedExecutable bool   `json:"observed_executable"`
}

type Manifest

type Manifest struct {
	Format        string                `json:"format"`
	Version       int                   `json:"version"`
	Algorithm     string                `json:"algorithm"`
	RootSHA256    string                `json:"root_sha256"`
	PayloadSHA256 string                `json:"payload_sha256"`
	Normalization ManifestNormalization `json:"normalization"`
	Source        ManifestSource        `json:"source"`
	Entries       []ManifestEntry       `json:"entries"`
}

Manifest is a deterministic, reviewable record of an archive payload. RootSHA256 additionally commits to executable-file semantics, while PayloadSHA256 intentionally ignores archive metadata and permissions.

func CreateManifest

func CreateManifest(snapshot Snapshot, wrapperPolicy string) (Manifest, error)

CreateManifest records one inspected archive using an explicit wrapper policy.

func DecodeManifest

func DecodeManifest(r io.Reader) (Manifest, error)

DecodeManifest reads exactly one strictly validated manifest document.

func ReadManifest

func ReadManifest(filename string) (Manifest, error)

type ManifestEntry

type ManifestEntry struct {
	Path       string `json:"path"`
	Kind       string `json:"kind"`
	Size       int64  `json:"size"`
	SHA256     string `json:"sha256"`
	Executable bool   `json:"executable"`
}

type ManifestNormalization

type ManifestNormalization struct {
	Wrapper string `json:"wrapper"`
}

type ManifestSource

type ManifestSource struct {
	Format         string `json:"format"`
	ArtifactSHA256 string `json:"artifact_sha256"`
	StrippedRoot   string `json:"stripped_root,omitempty"`
}

type MetadataChange

type MetadataChange struct {
	Path   string   `json:"path"`
	Fields []string `json:"fields"`
}

type PackOptions

type PackOptions struct {
	Format             string
	PreserveExecutable bool
}

type Snapshot

type Snapshot struct {
	Archive       string   `json:"archive"`
	Format        string   `json:"format"`
	ByteSHA256    string   `json:"byte_sha256"`
	ContentSHA256 string   `json:"content_sha256"`
	Entries       []Entry  `json:"entries"`
	Order         []string `json:"order"`
}

Snapshot is a safe, extraction-free view of an archive.

func Inspect

func Inspect(filename string) (Snapshot, error)

Inspect reads archive metadata and hashes content without extracting anything.

func Pack

func Pack(sourceDir, output, format string) (Snapshot, error)

Pack creates a canonical archive from a directory and returns its inspected snapshot.

func PackWithOptions

func PackWithOptions(sourceDir, output string, options PackOptions) (Snapshot, error)

PackWithOptions creates a canonical archive with an explicit mode policy.

type Verification

type Verification struct {
	Classification      string             `json:"classification"`
	Match               bool               `json:"match"`
	PayloadIdentical    bool               `json:"payload_identical"`
	PortableIdentical   bool               `json:"portable_identical"`
	Archive             string             `json:"archive"`
	Format              string             `json:"format"`
	ArtifactSHA256      string             `json:"artifact_sha256"`
	RecordedArtifactSHA string             `json:"recorded_artifact_sha256"`
	ExpectedRootSHA256  string             `json:"expected_root_sha256"`
	ObservedRootSHA256  string             `json:"observed_root_sha256"`
	ExpectedPayloadSHA  string             `json:"expected_payload_sha256"`
	ObservedPayloadSHA  string             `json:"observed_payload_sha256"`
	WrapperPolicy       string             `json:"wrapper_policy"`
	StrippedRoot        string             `json:"stripped_root,omitempty"`
	PayloadPaths        int                `json:"payload_paths"`
	PayloadBytes        int64              `json:"payload_bytes"`
	Added               []string           `json:"added"`
	Removed             []string           `json:"removed"`
	Modified            []VerifiedPath     `json:"modified"`
	ExecutableChanged   []ExecutableChange `json:"executable_changed"`
}

Verification is the complete, untruncated result for one archive.

func VerifyManifest

func VerifyManifest(manifest Manifest, snapshot Snapshot) (Verification, error)

VerifyManifest compares an inspected archive to a validated baseline.

type VerifiedPath

type VerifiedPath struct {
	Path           string `json:"path"`
	ExpectedKind   string `json:"expected_kind"`
	ObservedKind   string `json:"observed_kind"`
	ExpectedSize   int64  `json:"expected_size"`
	ObservedSize   int64  `json:"observed_size"`
	ExpectedSHA256 string `json:"expected_sha256"`
	ObservedSHA256 string `json:"observed_sha256"`
}