canonical

Documentation

Overview

Package canonical is the canonical form an evidence digest commits to: RFC 8785 (JSON Canonicalization Scheme) as the Proof-of-Control standard pins it down in schema/canonicalization.md. Keys sorted by UTF-16 code unit, no whitespace, minimal escapes, non-ASCII literal, digests tagged with their algorithm, and no floating point in a claim set: a float is refused, not formatted, because number formatting is where canonical forms go wrong quietly.

Index

• Constants
• Variables
• func Digest(v any) (string, error)
• func Encode(v any) ([]byte, error)
• func SHA256(b []byte) string
• func Tag(hex string) string
• func Untag(digest string) (string, error)
• func UntagAny(digest string) (alg, value string, err error)

Constants

const Algorithm = "sha-256"

Variables

var ErrFloat = errors.New("the claim set forbids floating point; see canonicalization.md")

ErrFloat is returned for a non-integer number: the claim set forbids it.

Functions

func Digest

func Digest(v any) (string, error)

Digest is the lowercase hex sha256 of the canonical form of a value.

func Encode

func Encode(v any) ([]byte, error)

Encode returns the canonical bytes of a value. Maps become objects, slices arrays; json.Number and integers are written as integers; float64 is accepted only when it is a whole number within the safe range.

func SHA256

func SHA256(b []byte) string

SHA256 of raw bytes, lowercase hex.

func Tag

func Tag(hex string) string

Tag is the wire form of a digest: algorithm-tagged, so evidence written before a hash migration is still interpretable after one.

func Untag

func Untag(digest string) (string, error)

Untag refuses an untagged, foreign or malformed sha-256 digest rather than guessing.

func UntagAny

func UntagAny(digest string) (alg, value string, err error)

UntagAny accepts any digest the schema admits and returns its algorithm and hex. A measurement from a TDX quote is sha-384; the chain and snapshot digests stay sha-256.