submission

package
v2026.0.153 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 27, 2026 License: MPL-2.0 Imports: 13 Imported by: 0

Documentation

Overview

Package submission authenticates one evidence declaration from an installed product and binds one authority-issued upload capability to that exact declaration, request, lifetime, and retention promise.

Submission does not decide product plans, inspect evidence, create cloud objects, or perform transfers. The product owns the evidence projection, the authority owns the commercial decision and capability issuance, Objectstore owns the transfer, and Receipt owns accepted-object evidence after custody.

Index

Constants

View Source 
const (
	// CompletionPayloadJSONMaximumBytes bounds one provider-evidence completion.
	CompletionPayloadJSONMaximumBytes = 64 << 10
	// CompletionDocumentJSONMaximumBytes bounds the signed completion document.
	CompletionDocumentJSONMaximumBytes = 96 << 10
)
View Source 
const (
	// SigningDomainRequestV1Token is the exact namespace for a device's
	// evidence-submission request.
	SigningDomainRequestV1Token = "primitive-submission-request-2026-1"
	// SigningDomainGrantV1Token is the exact namespace for an authority's
	// evidence-submission grant.
	SigningDomainGrantV1Token = "primitive-submission-grant-2026-1"
	// SigningDomainCompletionV1Token is the exact namespace for a device's
	// provider-confirmed upload completion.
	SigningDomainCompletionV1Token = "primitive-submission-completion-2026-1"
)
View Source 
const (
	// GrantPayloadJSONMaximumBytes bounds the authority-signed authorization.
	GrantPayloadJSONMaximumBytes = 32 << 10
	// GrantDocumentJSONMaximumBytes bounds one received grant including bearer.
	GrantDocumentJSONMaximumBytes = 128 << 10
)
View Source 
const (
	// RequestPayloadJSONMaximumBytes bounds the device-signed declaration.
	RequestPayloadJSONMaximumBytes = 32 << 10
	// RequestDocumentJSONMaximumBytes bounds one signed request document.
	RequestDocumentJSONMaximumBytes = 64 << 10
)
View Source 
const (
	DecisionDocumentJSONMaximumBytes uint64 = uint64(
		GrantDocumentJSONMaximumBytes + receipt.EvidenceDocumentJSONMaximumBytes,
	)
)

Variables

This section is empty.

Functions

This section is empty.

Types

type CompletionDocument added in v2026.0.56 

type CompletionDocument struct {
	Payload     CompletionPayload              `json:"payload"`
	Attestation attest.Envelope[SigningDomain] `json:"attestation"`
}

CompletionDocument carries the installed device's signature over one exact provider result and the grant facts that authorized it.

func (CompletionDocument) MarshalJSON added in v2026.0.56 

func (d CompletionDocument) MarshalJSON() ([]byte, error)

func (*CompletionDocument) UnmarshalJSON added in v2026.0.56 

func (d *CompletionDocument) UnmarshalJSON(data []byte) error

func (CompletionDocument) Validate added in v2026.0.56 

func (d CompletionDocument) Validate() error

type CompletionExpectation added in v2026.0.56 

type CompletionExpectation struct {
	Request        RequestPayload
	Grant          GrantDocument
	Document       CompletionDocument
	GrantKeys      attest.TrustedKeys
	CompletionKeys attest.TrustedKeys
}

CompletionExpectation supplies the original request, exact signed grant, and the two independently selected trust sets used by an authority.

func (CompletionExpectation) Validate added in v2026.0.56 

func (e CompletionExpectation) Validate() error

type CompletionIssuance added in v2026.0.56 

type CompletionIssuance struct {
	Signer   crypto.Signer
	Transfer objectstore.Transfer
	Request  RequestPayload
	Grant    VerifiedGrant
}

CompletionIssuance binds an actual confirmed transfer to the authenticated request and grant that produced its bearer.

func (CompletionIssuance) Validate added in v2026.0.56 

func (i CompletionIssuance) Validate() error

type CompletionPayload added in v2026.0.56 

type CompletionPayload struct {
	Build         core.BuildIdentity                     `json:"build"`
	Evidence      objectstore.TransferEvidence           `json:"evidence"`
	Nonce         controlwire.RequestNonce               `json:"request_nonce"`
	Request       RequestCommitment                      `json:"request_commitment"`
	Capability    objectstore.UploadCapabilityCommitment `json:"capability_commitment"`
	Authorization controlwire.AuthorityNonce             `json:"authorization_nonce"`
}

CompletionPayload is the receive-side statement that one exact granted upload completed. Evidence contains no bearer, URL, path, or object bytes.

func (CompletionPayload) AttestationDomain added in v2026.0.56 

func (CompletionPayload) AttestationDomain() SigningDomain

func (CompletionPayload) MarshalJSON added in v2026.0.56 

func (p CompletionPayload) MarshalJSON() ([]byte, error)

func (*CompletionPayload) UnmarshalJSON added in v2026.0.56 

func (p *CompletionPayload) UnmarshalJSON(data []byte) error

func (CompletionPayload) Validate added in v2026.0.56 

func (p CompletionPayload) Validate() error

func (CompletionPayload) WriteCanonical added in v2026.0.56 

func (p CompletionPayload) WriteCanonical(destination io.Writer) error

type CompletionProjection added in v2026.0.56 

type CompletionProjection struct {
	// contains filtered or unexported fields
}

CompletionProjection is the issue-only form. Objectstore transfer evidence remains issue-only until this explicit external projection is encoded.

func IssueCompletion added in v2026.0.56 

func IssueCompletion(issuance CompletionIssuance) (CompletionProjection, error)

IssueCompletion signs one exact confirmed provider result against its grant.

func (CompletionProjection) Build added in v2026.0.80 

func (p CompletionProjection) Build() (core.BuildIdentity, error)

Build returns the signed installed-build fact so an outer credential envelope can bind the projection without decoding its own wire output.

func (CompletionProjection) MarshalJSON added in v2026.0.56 

func (p CompletionProjection) MarshalJSON() ([]byte, error)

func (CompletionProjection) Validate added in v2026.0.56 

func (p CompletionProjection) Validate() error

func (CompletionProjection) ValidateJSONProjection added in v2026.0.127 

func (p CompletionProjection) ValidateJSONProjection(encoded []byte, limits core.StrictJSONLimits) error

type DecisionDocument added in v2026.0.55 

type DecisionDocument struct {
	Grant    *GrantDocument            `json:"grant,omitempty"`
	Evidence *receipt.EvidenceDocument `json:"evidence,omitempty"`
	Kind     DecisionKind              `json:"kind"`
}

DecisionDocument is the receive-only union. Upload carries a bearer grant; reuse carries the authority's already-accepted object evidence.

func (*DecisionDocument) UnmarshalJSON added in v2026.0.55 

func (d *DecisionDocument) UnmarshalJSON(data []byte) error

func (DecisionDocument) Validate added in v2026.0.55 

func (d DecisionDocument) Validate() error

type DecisionExpectation added in v2026.0.55 

type DecisionExpectation struct {
	Decision    DecisionDocument
	Offering    core.Offering
	Request     RequestPayload
	TrustedKeys attest.TrustedKeys
	ObservedAt  temporal.Instant
	Account     receipt.AccountIdentity
}

DecisionExpectation supplies the authenticated tenant scope separately from the content declaration, preventing dedup from becoming a cross-tenant existence oracle.

func (DecisionExpectation) Validate added in v2026.0.55 

func (e DecisionExpectation) Validate() error

type DecisionKind added in v2026.0.55 

type DecisionKind uint8

DecisionKind closes the only two authority outcomes for one declaration. 

const (
	DecisionUnknown DecisionKind = iota
	DecisionUpload
	DecisionReuse
)

func (DecisionKind) IsValid added in v2026.0.55 

func (k DecisionKind) IsValid() bool

IsValid reports whether k is one published submission decision kind.

func (DecisionKind) MarshalJSON added in v2026.0.55 

func (k DecisionKind) MarshalJSON() ([]byte, error)

func (DecisionKind) String added in v2026.0.55 

func (k DecisionKind) String() string

func (*DecisionKind) UnmarshalJSON added in v2026.0.55 

func (k *DecisionKind) UnmarshalJSON(data []byte) error

func (DecisionKind) Validate added in v2026.0.55 

func (k DecisionKind) Validate() error

type DecisionProjection added in v2026.0.55 

type DecisionProjection struct {
	// contains filtered or unexported fields
}

DecisionProjection is the issue-only union matching DecisionDocument.

func ReuseDecision added in v2026.0.55 

func ReuseDecision(request ReuseDecisionRequest) (DecisionProjection, error)

func UploadDecision added in v2026.0.55 

func UploadDecision(grant GrantProjection) (DecisionProjection, error)

func (DecisionProjection) MarshalJSON added in v2026.0.55 

func (p DecisionProjection) MarshalJSON() ([]byte, error)

func (DecisionProjection) Validate added in v2026.0.55 

func (p DecisionProjection) Validate() error

func (DecisionProjection) ValidateJSONProjection added in v2026.0.96 

func (p DecisionProjection) ValidateJSONProjection(encoded []byte, limits core.StrictJSONLimits) error

type Declaration 

type Declaration struct {
	ContentType core.HTTPMediaType `json:"content_type"`
	Extent      core.ByteLength    `json:"extent_bytes"`
	SHA256      core.SHA256Digest  `json:"sha256"`
	CRC32C      core.CRC32C        `json:"crc32c"`
}

Declaration is the exact immutable object an installation asks the authority to accept. It carries integrity and media type only; customer names, paths, source, output, and other product data have no protocol slot.

func (Declaration) Integrity 

func (d Declaration) Integrity() objectstore.Integrity

Integrity returns the exact Objectstore transfer declaration.

func (Declaration) Validate 

func (d Declaration) Validate() error

Validate closes the media type and delegates the integrity rule to Objectstore, which owns the transfer-side interpretation.

type GrantDocument 

type GrantDocument struct {
	Capability  objectstore.UploadCapability   `json:"capability"`
	Payload     GrantPayload                   `json:"payload"`
	Attestation attest.Envelope[SigningDomain] `json:"attestation"`
}

GrantDocument is the receive-only authority response. Its capability is a bearer and therefore cannot be marshalled back out.

func (*GrantDocument) UnmarshalJSON 

func (d *GrantDocument) UnmarshalJSON(data []byte) error

UnmarshalJSON accepts the receive-only grant wire and preserves the receiver on every rejection.

func (GrantDocument) Validate 

func (d GrantDocument) Validate() error

Validate binds the separately transported bearer to the signed commitment and expiry.

type GrantExpectation 

type GrantExpectation struct {
	Request     RequestPayload
	Document    GrantDocument
	TrustedKeys attest.TrustedKeys
	ObservedAt  temporal.Instant
}

GrantExpectation binds an untrusted response to one request and observation instant under caller-selected authority keys.

func (GrantExpectation) Validate 

func (e GrantExpectation) Validate() error

Validate closes every caller-supplied verification fact.

type GrantIssuance 

type GrantIssuance struct {
	Signer     crypto.Signer
	Capability objectstore.UploadCapabilityProjection
	Payload    GrantPayload
}

GrantIssuance carries all authority-side grant inputs.

func (GrantIssuance) Validate 

func (i GrantIssuance) Validate() error

Validate closes every issuance input without producing a signature or wire document.

type GrantPayload 

type GrantPayload struct {
	Request       RequestCommitment                      `json:"request_commitment"`
	Authorization controlwire.AuthorityNonce             `json:"authorization_nonce"`
	Capability    objectstore.UploadCapabilityCommitment `json:"capability_commitment"`
	IssuedAt      temporal.Instant                       `json:"issued_at"`
	ExpiresAt     temporal.Instant                       `json:"expires_at"`
	RetainUntil   temporal.Instant                       `json:"retain_until"`
}

GrantPayload is the complete authority-signed permission for one exact request and bearer capability.

func (GrantPayload) AttestationDomain 

func (GrantPayload) AttestationDomain() SigningDomain

AttestationDomain returns the authority grant namespace.

func (GrantPayload) MarshalJSON 

func (p GrantPayload) MarshalJSON() ([]byte, error)

MarshalJSON emits one bounded canonical grant payload.

func (*GrantPayload) UnmarshalJSON 

func (p *GrantPayload) UnmarshalJSON(data []byte) error

UnmarshalJSON strictly decodes without mutating the receiver on rejection.

func (GrantPayload) Validate 

func (p GrantPayload) Validate() error

Validate closes all signed permission facts and their temporal ordering.

func (GrantPayload) WriteCanonical 

func (p GrantPayload) WriteCanonical(destination io.Writer) error

WriteCanonical writes the exact compact signed payload.

type GrantProjection 

type GrantProjection struct {
	Capability  objectstore.UploadCapabilityProjection
	Payload     GrantPayload
	Attestation attest.Envelope[SigningDomain]
}

GrantProjection is the issue-only authority response carrying the same wire shape as GrantDocument through Objectstore's encode-only bearer projection.

func IssueGrant 

func IssueGrant(issuance GrantIssuance) (GrantProjection, error)

IssueGrant signs one exact grant and returns its encode-only bearer projection.

func (GrantProjection) MarshalJSON 

func (p GrantProjection) MarshalJSON() ([]byte, error)

MarshalJSON emits the sole boundary at which the authority discloses the upload bearer.

func (GrantProjection) Validate 

func (p GrantProjection) Validate() error

Validate closes the issue-only response and binds its bearer projection.

func (GrantProjection) ValidateJSONProjection added in v2026.0.127 

func (p GrantProjection) ValidateJSONProjection(encoded []byte, limits core.StrictJSONLimits) error

type ManifestIntent added in v2026.0.55 

type ManifestIntent struct {
	Name       chit.EntryName     `json:"name"`
	Sequence   chit.EntrySequence `json:"sequence"`
	Objects    chit.ObjectCount   `json:"objects"`
	Collection chit.CollectionID  `json:"collection_id"`
	Partition  chit.Partition     `json:"partition"`
	Upload     UploadID           `json:"upload_id"`
}

ManifestIntent binds one declared object to its portable customer-visible name and exact position in one opaque collection version. It carries no local path, repository identity, or product-specific metadata.

func (ManifestIntent) MarshalJSON added in v2026.0.140 

func (i ManifestIntent) MarshalJSON() ([]byte, error)

MarshalJSON validates the complete intent before any external bytes escape.

func (ManifestIntent) Validate added in v2026.0.55 

func (i ManifestIntent) Validate() error

type RequestCommitment 

type RequestCommitment struct {
	// contains filtered or unexported fields
}

RequestCommitment is the non-secret domain-separated closure of one exact request payload.

func CommitRequest 

func CommitRequest(payload RequestPayload) (RequestCommitment, error)

CommitRequest closes one exact validated request payload.

func (RequestCommitment) MarshalJSON 

func (c RequestCommitment) MarshalJSON() ([]byte, error)

MarshalJSON emits canonical lowercase hexadecimal.

func (*RequestCommitment) UnmarshalJSON 

func (c *RequestCommitment) UnmarshalJSON(data []byte) error

UnmarshalJSON accepts one canonical SHA-256 commitment without mutating on refusal.

func (RequestCommitment) Validate 

func (c RequestCommitment) Validate() error

Validate rejects an unset commitment.

type RequestDocument 

type RequestDocument struct {
	Payload     RequestPayload                 `json:"payload"`
	Attestation attest.Envelope[SigningDomain] `json:"attestation"`
}

RequestDocument carries one device-signed declaration. Which device key is trusted is supplied separately by the authentication layer.

func IssueRequest 

func IssueRequest(issuance RequestIssuance) (RequestDocument, error)

IssueRequest signs one exact declaration with the installed device key.

func (RequestDocument) MarshalJSON 

func (d RequestDocument) MarshalJSON() ([]byte, error)

MarshalJSON emits one bounded canonical request.

func (*RequestDocument) UnmarshalJSON 

func (d *RequestDocument) UnmarshalJSON(data []byte) error

UnmarshalJSON strictly decodes without mutating the receiver on rejection.

func (RequestDocument) Validate 

func (d RequestDocument) Validate() error

Validate closes the payload and exact request-signature namespace.

type RequestIssuance 

type RequestIssuance struct {
	Signer  crypto.Signer
	Payload RequestPayload
}

RequestIssuance carries all inputs for device-side request signing.

func (RequestIssuance) Validate 

func (i RequestIssuance) Validate() error

Validate closes every issuance input without signing.

type RequestPayload 

type RequestPayload struct {
	Build       core.BuildIdentity       `json:"build"`
	Manifest    ManifestIntent           `json:"manifest"`
	Declaration Declaration              `json:"declaration"`
	Nonce       controlwire.RequestNonce `json:"request_nonce"`
	Revision    controlwire.Revision     `json:"revision"`
}

RequestPayload is the exact declaration one installed build signs.

func (RequestPayload) AttestationDomain 

func (RequestPayload) AttestationDomain() SigningDomain

AttestationDomain returns the device request namespace.

func (RequestPayload) MarshalJSON 

func (p RequestPayload) MarshalJSON() ([]byte, error)

MarshalJSON emits one bounded canonical payload.

func (*RequestPayload) UnmarshalJSON 

func (p *RequestPayload) UnmarshalJSON(data []byte) error

UnmarshalJSON strictly decodes without mutating the receiver on rejection.

func (RequestPayload) Validate 

func (p RequestPayload) Validate() error

Validate closes every signed request fact.

func (RequestPayload) WriteCanonical 

func (p RequestPayload) WriteCanonical(destination io.Writer) error

WriteCanonical writes the exact compact signed payload.

type RequestVerification 

type RequestVerification struct {
	Document    RequestDocument
	TrustedKeys attest.TrustedKeys
}

RequestVerification carries caller-selected device keys and an untrusted request into authentication.

func (RequestVerification) Validate 

func (v RequestVerification) Validate() error

Validate closes the complete authority verification input.

type ReuseDecisionRequest added in v2026.0.105 

type ReuseDecisionRequest struct {
	Offering    core.Offering
	Declaration Declaration
	Evidence    receipt.EvidenceDocument
	TrustedKeys attest.TrustedKeys
	Account     receipt.AccountIdentity
}

ReuseDecisionRequest supplies the exact authenticated tenant scope and declaration an authority must prove before it may disclose accepted-object evidence instead of issuing a fresh upload grant.

func (ReuseDecisionRequest) Validate added in v2026.0.105 

func (r ReuseDecisionRequest) Validate() error

type SigningDomain 

type SigningDomain uint8

SigningDomain is the closed set of evidence-submission signature namespaces. 

const (
	SigningDomainUnknown SigningDomain = iota
	SigningDomainRequestV1
	SigningDomainGrantV1
	SigningDomainCompletionV1
)

func ParseSigningDomain 

func ParseSigningDomain(value string) (SigningDomain, error)

ParseSigningDomain accepts one exact published namespace.

func (SigningDomain) IsValid 

func (d SigningDomain) IsValid() bool

IsValid reports whether d is one of the published namespaces.

func (SigningDomain) MarshalJSON 

func (d SigningDomain) MarshalJSON() ([]byte, error)

MarshalJSON emits the same canonical namespace MarshalText signs.

func (SigningDomain) MarshalText 

func (d SigningDomain) MarshalText() ([]byte, error)

MarshalText emits the exact signed namespace.

func (SigningDomain) ParseCanonicalText 

func (SigningDomain) ParseCanonicalText(text []byte) (SigningDomain, error)

ParseCanonicalText accepts only one exact published namespace.

func (SigningDomain) String 

func (d SigningDomain) String() string

String returns the exact signed namespace, or empty text when invalid.

func (*SigningDomain) UnmarshalJSON 

func (d *SigningDomain) UnmarshalJSON(data []byte) error

UnmarshalJSON accepts only a published namespace and preserves the receiver on every refusal.

func (SigningDomain) Validate 

func (d SigningDomain) Validate() error

Validate rejects the unset domain and every unpublished domain.

type UploadCallRequest added in v2026.0.55 

type UploadCallRequest struct {
	Source   io.Reader
	Observer objectstore.ProgressObserver
	Request  RequestPayload
	Policy   objectstore.Policy
}

UploadCallRequest binds a caller-owned source and transfer policy to the exact declaration that obtained an authenticated upload decision.

func (UploadCallRequest) Validate added in v2026.0.55 

func (r UploadCallRequest) Validate() error

Validate closes all caller-owned upload inputs without reading the source.

type UploadID added in v2026.0.55 

type UploadID struct {
	// contains filtered or unexported fields
}

UploadID is a caller-created UUIDv7 joining every object in one logical uploaded version without disclosing a repository or project identity.

func NewUploadID added in v2026.0.55 

func NewUploadID(value id.UUIDv7) (UploadID, error)

NewUploadID closes a generated UUIDv7 into the submission namespace.

func ParseUploadID added in v2026.0.55 

func ParseUploadID(value string) (UploadID, error)

ParseUploadID admits one canonical UUIDv7 spelling.

func (UploadID) MarshalJSON added in v2026.0.55 

func (i UploadID) MarshalJSON() ([]byte, error)

func (UploadID) String added in v2026.0.55 

func (i UploadID) String() string

func (*UploadID) UnmarshalJSON added in v2026.0.55 

func (i *UploadID) UnmarshalJSON(data []byte) error

func (UploadID) Validate added in v2026.0.55 

func (i UploadID) Validate() error

type VerifiedCompletion added in v2026.0.56 

type VerifiedCompletion struct {
	// contains filtered or unexported fields
}

VerifiedCompletion is the authenticated exact provider evidence safe for an authority to reconcile against its own object and custody records.

func VerifyCompletion added in v2026.0.56 

func VerifyCompletion(expectation CompletionExpectation) (VerifiedCompletion, error)

VerifyCompletion authenticates the grant and device completion, then binds the provider evidence to the exact request and capability commitment.

func (VerifiedCompletion) Payload added in v2026.0.56 

func (v VerifiedCompletion) Payload() (CompletionPayload, error)

func (VerifiedCompletion) Validate added in v2026.0.56 

func (v VerifiedCompletion) Validate() error

type VerifiedDecision added in v2026.0.55 

type VerifiedDecision struct {
	// contains filtered or unexported fields
}

VerifiedDecision is a sealed upload-or-reuse proof.

func VerifyDecision added in v2026.0.55 

func VerifyDecision(expectation DecisionExpectation) (VerifiedDecision, error)

func (VerifiedDecision) Evidence added in v2026.0.55 

func (v VerifiedDecision) Evidence() (receipt.VerifiedEvidence, bool)

func (VerifiedDecision) Grant added in v2026.0.55 

func (v VerifiedDecision) Grant() (VerifiedGrant, bool)

func (VerifiedDecision) Kind added in v2026.0.55 

func (v VerifiedDecision) Kind() (DecisionKind, error)

func (VerifiedDecision) UploadCall added in v2026.0.55 

func (v VerifiedDecision) UploadCall(
	request UploadCallRequest,
) (objectstore.UploadCapabilityRequest, error)

UploadCall projects one authenticated upload decision into the blind Objectstore operation it authorized. It neither reads nor transfers bytes.

func (VerifiedDecision) Validate added in v2026.0.55 

func (v VerifiedDecision) Validate() error

type VerifiedGrant 

type VerifiedGrant struct {
	// contains filtered or unexported fields
}

VerifiedGrant proves an exact, current grant authenticated and bound.

func VerifyGrant 

func VerifyGrant(expectation GrantExpectation) (VerifiedGrant, error)

VerifyGrant authenticates the authority signature, binds the exact request, and refuses a grant observed outside its signed capability lifetime.

func (VerifiedGrant) Capability 

func (v VerifiedGrant) Capability() (objectstore.UploadCapability, error)

Capability returns the authenticated, current upload bearer.

func (VerifiedGrant) Payload 

func (v VerifiedGrant) Payload() (GrantPayload, error)

Payload returns the authenticated permission and retention promise.

func (VerifiedGrant) Validate 

func (v VerifiedGrant) Validate() error

Validate revalidates the authenticated grant proof.

type VerifiedRequest 

type VerifiedRequest struct {
	// contains filtered or unexported fields
}

VerifiedRequest can only be obtained by authenticating the device signature.

func VerifyRequest 

func VerifyRequest(verification RequestVerification) (VerifiedRequest, error)

VerifyRequest authenticates the exact request with only the caller-selected device keys. Submissionauth owns how an installation certificate nominates that set.

func (VerifiedRequest) Document 

func (v VerifiedRequest) Document() (RequestDocument, error)

Document returns the authenticated request.

func (VerifiedRequest) Validate 

func (v VerifiedRequest) Validate() error

Validate revalidates the authenticated request proof.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.