verifier

Documentation

Overview

Package verifier provides offline EvidencePack verification.

This package is intentionally minimal with ZERO server, proxy, or network dependencies. It is designed to be buildable and auditable as a standalone verification tool that an adversarial third party can trust.

Trust model: the verifier trusts only the cryptographic primitives (Ed25519, SHA-256, JCS) and the EvidencePack format specification. It does NOT trust the HELM server, proxy, or any network service.

Index

• Constants
• type CheckResult
• type VerifyOptions
• type VerifyReport
  • func VerifyBundle(bundlePath string) (*VerifyReport, error)
  • func VerifyBundleWithOptions(bundlePath string, opts VerifyOptions) (*VerifyReport, error)
  • func VerifyLocallyProducedBundle(bundlePath string) (*VerifyReport, error)
• type VerifyRoots

Constants

const VerifierVersion = "0.2.0"

Types

type CheckResult

type CheckResult struct {
	Name   string `json:"name"`
	Pass   bool   `json:"pass"`
	Detail string `json:"detail,omitempty"`
	Reason string `json:"reason,omitempty"` // failure reason
}

CheckResult represents a single verification check.

type VerifyOptions

type VerifyOptions struct {
	Profile            evidencepkg.EvidenceTrustProfile
	TrustConfig        *evidencepkg.EvidencePackTrustConfig
	DataDir            string
	ConfigPath         string
	StorageReceiptPath string
	StorageObjectPath  string
	ExternalHostKeyHex string
	// ManagedAgentReceiptPublicKeyHex is the trusted Ed25519 public key used
	// to verify embedded managed-agent execution receipts. The verifier never
	// trusts public keys declared inside the bundle unless they match this root.
	ManagedAgentReceiptPublicKeyHex string
	// WitnessPublicKeysHex maps witness IDs to trusted Ed25519 public keys
	// for verifying receipt witness_signatures (the k-of-n witness overlay).
	// Witness signatures whose witness_id has no configured key are skipped —
	// they anchor to the witness registry, not to embedded presence, so an
	// unconfigured verifier neither trusts nor fails them. A configured key
	// demands a valid signature over the receipt hash (fail-closed).
	WitnessPublicKeysHex map[string]string
	Now                  time.Time
	// AllowVerifiedConformanceSignature permits 07_ATTESTATIONS/conformance_report.sig
	// to remain outside 00_INDEX.json only for callers that have already
	// verified it against an external trusted key. Standalone library callers
	// should leave this false so the seal verifier remains fail-closed.
	AllowVerifiedConformanceSignature bool
	// AllowSelfAttested accepts a dev-local seal whose verification key comes
	// from inside the pack. Only set this when verifying a pack this process
	// just produced; never when verifying one that arrived from elsewhere.
	AllowSelfAttested bool
}

type VerifyReport

type VerifyReport struct {
	Bundle              string                                    `json:"bundle"`
	Verified            bool                                      `json:"verified"`
	Timestamp           time.Time                                 `json:"timestamp"`
	Roots               VerifyRoots                               `json:"roots,omitempty"`
	Checks              []CheckResult                             `json:"checks"`
	Summary             string                                    `json:"summary"`
	IssueCount          int                                       `json:"issue_count"`
	VerifierVer         string                                    `json:"verifier_version"`
	EnvelopeID          string                                    `json:"envelope_id,omitempty"`
	SealedAt            string                                    `json:"sealed_at,omitempty"`
	SignatureValidCount int                                       `json:"signature_valid_count,omitempty"`
	SignatureTotalCount int                                       `json:"signature_total_count,omitempty"`
	AnchorIndex         *uint64                                   `json:"anchor_index,omitempty"`
	MerkleRoot          string                                    `json:"merkle_root,omitempty"`
	Seal                *evidencepkg.EvidencePackSealVerification `json:"seal,omitempty"`
	TrustLevel          string                                    `json:"trust_level,omitempty"`
	SealState           string                                    `json:"seal_state,omitempty"`
	SealSignatureValid  bool                                      `json:"seal_signature_valid,omitempty"`
	AnchorStatus        string                                    `json:"anchor_status,omitempty"`
	StorageStatus       string                                    `json:"storage_status,omitempty"`
	SealSubjectRoot     string                                    `json:"seal_subject_root,omitempty"`
	SealID              string                                    `json:"seal_id,omitempty"`
}

VerifyReport is the structured output of offline verification. Designed for auditor consumption — every field is evidence-grade.

func VerifyBundle

func VerifyBundle(bundlePath string) (*VerifyReport, error)

VerifyBundle performs offline verification of an EvidencePack directory. No network access. No server dependency. Pure filesystem + crypto.

Provenance is NOT assumed: a dev-local seal that carries its own verification key is rejected. Use VerifyLocallyProducedBundle when the caller created the pack itself and only wants the structural and chain checks.

func VerifyBundleWithOptions

func VerifyBundleWithOptions(bundlePath string, opts VerifyOptions) (*VerifyReport, error)

VerifyBundleWithOptions performs offline verification with an explicit trust profile.

func VerifyLocallyProducedBundle

func VerifyLocallyProducedBundle(bundlePath string) (*VerifyReport, error)

VerifyLocallyProducedBundle verifies a pack that this process just created.

It accepts the self-attested dev-local seal, because the caller already knows which key signed it — there is no provenance question to answer. Never use it on a pack received from elsewhere: that is exactly the case where the seal's embedded key proves nothing (F-02).

type VerifyRoots

type VerifyRoots struct {
	ManifestRootHash string `json:"manifest_root_hash,omitempty"`
	MerkleRoot       string `json:"merkle_root,omitempty"`
	EntryCount       int    `json:"entry_count,omitempty"`
}

VerifyRoots contains deterministic roots derived from 00_INDEX.json.