executionreceipt

Documentation

Overview

Package executionreceipt validates, digests, signs, and verifies Codefly's product-neutral execution receipt contract.

Index

• Constants
• Variables
• func Attest(receipt *executionv1.ExecutionReceiptV1, signerID string, keyID string, ...) (*executionv1.ExecutionAttestationV1, error)
• func Prepare(receipt *executionv1.ExecutionReceiptV1) (*executionv1.ExecutionReceiptV1, error)
• func Verify(attestation *executionv1.ExecutionAttestationV1, publicKey ed25519.PublicKey) (*executionv1.ExecutionReceiptV1, error)

Constants

const (
	// SchemaV1 is the only receipt schema accepted by this package.
	SchemaV1 = "codefly.execution-receipt/v1"
	// SignatureAlgorithm is the attestation signature algorithm.
	SignatureAlgorithm = "Ed25519"
)

Variables

var (
	// ErrInvalid is returned for a malformed or internally inconsistent receipt.
	ErrInvalid = errors.New("invalid Codefly execution receipt")
)

Functions

func Attest

func Attest(
	receipt *executionv1.ExecutionReceiptV1,
	signerID string,
	keyID string,
	privateKey ed25519.PrivateKey,
) (*executionv1.ExecutionAttestationV1, error)

Attest prepares receipt and signs its deterministic protobuf bytes with one registered Gateway key. The input message is never mutated.

func Prepare

func Prepare(receipt *executionv1.ExecutionReceiptV1) (*executionv1.ExecutionReceiptV1, error)

Prepare clones receipt, validates its immutable facts, and populates the deterministic payload digest. A non-empty caller-supplied digest must already match; Prepare never silently repairs conflicting immutable bytes.

func Verify

func Verify(
	attestation *executionv1.ExecutionAttestationV1,
	publicKey ed25519.PublicKey,
) (*executionv1.ExecutionReceiptV1, error)

Verify validates every receipt invariant, recomputes its payload digest, and verifies the Gateway signature. The returned receipt is a defensive clone.