releasecontract

package
v2.0.10 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 17, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Overview

Package releasecontract defines the host-neutral canonical wire and signing preimages for plugin release trust documents. It does not select trusted keys or read the system clock; callers provide timestamps, signatures, and the verifier that enforces their source policy.

Index

Constants

View Source 
const (
	RootDelegationSchemaVersion        = "redevplugin.release_root_delegation.v1"
	PackageSignatureSchemaVersion      = "redevplugin.package_signature.v1"
	ReleaseMetadataSchemaVersionV8     = "redevplugin.release_metadata.v8"
	ReleaseMetadataSchemaVersion       = ReleaseMetadataSchemaVersionV8
	SourcePolicySchemaVersionV3        = "redevplugin.release_source_policy.v3"
	SourcePolicySchemaVersion          = SourcePolicySchemaVersionV3
	SourcePolicyPointerSchemaVersionV1 = "redevplugin.release_source_policy_pointer.v1"
	SourcePolicyPointerSchemaVersionV2 = "redevplugin.release_source_policy_pointer.v2"
	SourcePolicyPointerSchemaVersion   = SourcePolicyPointerSchemaVersionV2
	RevocationSchemaVersionV2          = "redevplugin.release_revocation.v2"
	RevocationSchemaVersionV3          = "redevplugin.release_revocation.v3"
	RevocationSchemaVersion            = RevocationSchemaVersionV3
	RevocationPointerSchemaVersionV1   = "redevplugin.release_revocation_pointer.v1"
	RevocationPointerSchemaVersionV2   = "redevplugin.release_revocation_pointer.v2"
	RevocationPointerSchemaVersion     = RevocationPointerSchemaVersionV2

	SignatureAlgorithmEd25519 = "ed25519"
)

Variables

View Source 
var (
	ErrInvalidDocument  = errors.New("release contract document is invalid")
	ErrInvalidSignature = errors.New("release contract signature is invalid")
	ErrVerifierRequired = errors.New("release contract signature verifier is required")
	ErrUnsupportedUsage = errors.New("release contract signing usage is unsupported")
)

Functions

func CanonicalJSON 

func CanonicalJSON(raw []byte) ([]byte, error)

CanonicalJSON validates and canonicalizes an arbitrary JSON document while retaining every field. It is used by forward-compatible package formats; closed typed contracts should continue to use their typed canonicalizers.

func CanonicalPackageSignature 

func CanonicalPackageSignature(context PackageVerificationContext, document PackageSignatureV1) ([]byte, error)

func CanonicalReleaseMetadata 

func CanonicalReleaseMetadata(document ReleaseMetadataV8) ([]byte, error)

func CanonicalRevocation 

func CanonicalRevocation(document RevocationV2) ([]byte, error)

func CanonicalRevocationPointer 

func CanonicalRevocationPointer(document RevocationPointerV1) ([]byte, error)

func CanonicalRootDelegation 

func CanonicalRootDelegation(document RootDelegationV1) ([]byte, error)

func CanonicalSourcePolicy 

func CanonicalSourcePolicy(document SourcePolicyV2) ([]byte, error)

func CanonicalSourcePolicyPointer 

func CanonicalSourcePolicyPointer(document SourcePolicyPointerV1) ([]byte, error)

func PackageSigningPreimage 

func PackageSigningPreimage(input PackageSigningInput) ([]byte, error)

func ReleaseMetadataSigningPreimage 

func ReleaseMetadataSigningPreimage(channel string, document ReleaseMetadataV8) ([]byte, error)

func RevocationPointerSigningPreimage 

func RevocationPointerSigningPreimage(input ReleasePointerInput) ([]byte, error)

func RevocationSigningPreimage 

func RevocationSigningPreimage(input RevocationInput) ([]byte, error)

func RootDelegationSigningPreimage 

func RootDelegationSigningPreimage(input RootDelegationInput) ([]byte, error)

func SourcePolicyPointerSigningPreimage 

func SourcePolicyPointerSigningPreimage(input ReleasePointerInput) ([]byte, error)

func SourcePolicySigningPreimage 

func SourcePolicySigningPreimage(input SourcePolicyInput) ([]byte, error)

func VerifyPackageSignature 

func VerifyPackageSignature(context PackageVerificationContext, document PackageSignatureV1, verifier SignatureVerifier) error

func VerifyReleaseMetadata 

func VerifyReleaseMetadata(channel string, document ReleaseMetadataV8, signature []byte, verifier SignatureVerifier) error

func VerifyRevocation 

func VerifyRevocation(document RevocationV2, verifier SignatureVerifier) error

func VerifyRevocationPointer 

func VerifyRevocationPointer(document RevocationPointerV1, verifier SignatureVerifier) error

func VerifyRootDelegation 

func VerifyRootDelegation(document RootDelegationV1, verifier SignatureVerifier) error

func VerifySourcePolicy 

func VerifySourcePolicy(document SourcePolicyV2, verifier SignatureVerifier) error

func VerifySourcePolicyPointer 

func VerifySourcePolicyPointer(document SourcePolicyPointerV1, verifier SignatureVerifier) error

Types

type DelegatedKeyUsage 

type DelegatedKeyUsage string
const (
	DelegatedKeyUsagePackage             DelegatedKeyUsage = "package"
	DelegatedKeyUsageReleaseMetadata     DelegatedKeyUsage = "release_metadata"
	DelegatedKeyUsageSourcePolicy        DelegatedKeyUsage = "source_policy_document"
	DelegatedKeyUsageSourcePolicyPointer DelegatedKeyUsage = "source_policy_pointer"
	DelegatedKeyUsageRevocation          DelegatedKeyUsage = "revocation_document"
	DelegatedKeyUsageRevocationPointer   DelegatedKeyUsage = "revocation_pointer"
)

type Ed25519PublicKeyVerifier 

type Ed25519PublicKeyVerifier map[string]ed25519.PublicKey

func (Ed25519PublicKeyVerifier) VerifySignature 

func (keys Ed25519PublicKeyVerifier) VerifySignature(request SignatureVerificationRequest) error

type HostCapabilityContractRef 

type HostCapabilityContractRef struct {
	PublisherID     string `json:"publisher_id"`
	ContractID      string `json:"contract_id"`
	ContractVersion string `json:"contract_version"`
	ArtifactSHA256  string `json:"artifact_sha256"`
}

type HostCapabilityRequirementRef 

type HostCapabilityRequirementRef struct {
	CapabilityID      string                    `json:"capability_id"`
	CapabilityVersion string                    `json:"capability_version"`
	Contract          HostCapabilityContractRef `json:"contract"`
}

type PackageReleaseSignatureRef 

type PackageReleaseSignatureRef struct {
	Algorithm          string `json:"algorithm"`
	KeyID              string `json:"key_id"`
	SignatureBundleRef string `json:"signature_bundle_ref"`
	SourcePolicyEpoch  string `json:"source_policy_epoch"`
	RevocationEpoch    string `json:"revocation_epoch"`
}

type PackageSignatureV1 

type PackageSignatureV1 struct {
	SchemaVersion string `json:"schema_version"`
	Algorithm     string `json:"algorithm"`
	KeyID         string `json:"key_id"`
	PublisherID   string `json:"publisher_id,omitempty"`
	PluginID      string `json:"plugin_id,omitempty"`
	PackageHash   string `json:"package_hash"`
	ManifestHash  string `json:"manifest_hash"`
	EntriesHash   string `json:"entries_hash"`
	Signature     string `json:"signature"`
	SignedAt      string `json:"signed_at,omitempty"`
}

func BuildPackageSignature 

func BuildPackageSignature(input PackageSigningInput, signature []byte) (PackageSignatureV1, error)

func DecodePackageSignature 

func DecodePackageSignature(raw []byte, context PackageVerificationContext) (PackageSignatureV1, error)

type PackageSigningInput 

type PackageSigningInput struct {
	SourceID     string
	Channel      string
	Version      string
	Algorithm    string
	KeyID        string
	PublisherID  string
	PluginID     string
	PackageHash  string
	ManifestHash string
	EntriesHash  string
	SignedAt     string
}

type PackageVerificationContext 

type PackageVerificationContext struct {
	SourceID string
	Channel  string
	Version  string
}

type ReleaseCompatibility 

type ReleaseCompatibility struct {
	MinReDevPluginVersion string   `json:"min_redevplugin_version"`
	MinRuntimeVersion     string   `json:"min_runtime_version"`
	UIProtocolVersion     string   `json:"ui_protocol_version"`
	SupportedTargets      []string `json:"supported_targets,omitempty"`
}

type ReleaseDistributionRef 

type ReleaseDistributionRef struct {
	Distribution string `json:"distribution"`
	ArtifactRef  string `json:"artifact_ref"`
}

type ReleaseEvidence 

type ReleaseEvidence struct {
	NoticesSHA256    string `json:"notices_sha256,omitempty"`
	ProvenanceSHA256 string `json:"provenance_sha256,omitempty"`
	GeneratedAt      string `json:"generated_at,omitempty"`
}

type ReleaseHostRequirement 

type ReleaseHostRequirement struct {
	HostID                      string                         `json:"host_id"`
	MinHostVersion              string                         `json:"min_host_version,omitempty"`
	RequiredCapabilityContracts []HostCapabilityRequirementRef `json:"required_capability_contracts,omitempty"`
}

type ReleaseMetadataSignatureRef 

type ReleaseMetadataSignatureRef struct {
	Algorithm         string `json:"algorithm"`
	KeyID             string `json:"key_id"`
	SignatureRef      string `json:"signature_ref"`
	SourcePolicyEpoch string `json:"source_policy_epoch"`
	RevocationEpoch   string `json:"revocation_epoch"`
}

type ReleaseMetadataV8 

type ReleaseMetadataV8 struct {
	SchemaVersion            string                      `json:"schema_version"`
	SourceID                 string                      `json:"source_id"`
	ReleaseMetadataRef       string                      `json:"release_metadata_ref"`
	PublisherID              string                      `json:"publisher_id"`
	PluginID                 string                      `json:"plugin_id"`
	Version                  string                      `json:"version"`
	DistributionRef          ReleaseDistributionRef      `json:"distribution_ref"`
	Hashes                   ReleasePackageHashSet       `json:"hashes"`
	ReleaseMetadataSignature ReleaseMetadataSignatureRef `json:"release_metadata_signature"`
	PackageSignature         PackageReleaseSignatureRef  `json:"package_signature"`
	Compatibility            ReleaseCompatibility        `json:"compatibility"`
	HostRequirements         []ReleaseHostRequirement    `json:"host_requirements,omitempty"`
	ReleaseEvidence          *ReleaseEvidence            `json:"release_evidence,omitempty"`
	Metadata                 map[string]string           `json:"metadata,omitempty"`
}

func BuildReleaseMetadata 

func BuildReleaseMetadata(document ReleaseMetadataV8) (ReleaseMetadataV8, error)

func DecodeReleaseMetadata 

func DecodeReleaseMetadata(raw []byte) (ReleaseMetadataV8, error)

type ReleasePackageHashSet 

type ReleasePackageHashSet struct {
	PackageSHA256  string `json:"package_sha256"`
	ManifestSHA256 string `json:"manifest_sha256"`
	EntriesSHA256  string `json:"entries_sha256"`
}

type ReleasePointerInput 

type ReleasePointerInput struct {
	SchemaVersion  string
	SourceID       string
	Channel        string
	Epoch          string
	Ref            string
	DocumentSHA256 string
	GeneratedAt    string
	ExpiresAt      string
	KeyID          string
}

type RevocationInput 

type RevocationInput struct {
	SchemaVersion   string
	SourceID        string
	Channel         string
	Epoch           string
	RootEpoch       string
	GeneratedAt     string
	ExpiresAt       string
	RevokedKeyIDs   []string
	RevokedReleases []RevokedRelease
	KeyID           string
}

type RevocationPointerV1 

type RevocationPointerV1 struct {
	SchemaVersion  string `json:"schema_version"`
	SourceID       string `json:"source_id"`
	Channel        string `json:"channel"`
	Epoch          string `json:"epoch"`
	Ref            string `json:"ref"`
	DocumentSHA256 string `json:"document_sha256"`
	GeneratedAt    string `json:"generated_at"`
	ExpiresAt      string `json:"expires_at"`
	KeyID          string `json:"key_id"`
	Signature      string `json:"signature"`
}

func BuildRevocationPointer 

func BuildRevocationPointer(input ReleasePointerInput, signature []byte) (RevocationPointerV1, error)

func DecodeRevocationPointer 

func DecodeRevocationPointer(raw []byte) (RevocationPointerV1, error)

func (RevocationPointerV1) SigningPreimage 

func (document RevocationPointerV1) SigningPreimage() ([]byte, error)

type RevocationV2 

type RevocationV2 struct {
	SchemaVersion   string           `json:"schema_version"`
	SourceID        string           `json:"source_id"`
	Channel         string           `json:"channel"`
	Epoch           string           `json:"epoch"`
	RootEpoch       string           `json:"root_epoch"`
	GeneratedAt     string           `json:"generated_at"`
	ExpiresAt       string           `json:"expires_at"`
	RevokedKeyIDs   []string         `json:"revoked_key_ids"`
	RevokedReleases []RevokedRelease `json:"revoked_releases"`
	KeyID           string           `json:"key_id"`
	Signature       string           `json:"signature"`
}

func BuildRevocation 

func BuildRevocation(input RevocationInput, signature []byte) (RevocationV2, error)

func DecodeRevocation 

func DecodeRevocation(raw []byte) (RevocationV2, error)

func (RevocationV2) SigningPreimage 

func (document RevocationV2) SigningPreimage() ([]byte, error)

type RevokedRelease 

type RevokedRelease struct {
	PublisherID           string `json:"publisher_id"`
	PluginID              string `json:"plugin_id"`
	Version               string `json:"version"`
	ReleaseMetadataSHA256 string `json:"release_metadata_sha256"`
	RevokedAt             string `json:"revoked_at"`
}

type RootDelegatedKey 

type RootDelegatedKey struct {
	Algorithm  string              `json:"algorithm"`
	KeyID      string              `json:"key_id"`
	PublicKey  string              `json:"public_key"`
	Usages     []DelegatedKeyUsage `json:"usages"`
	Channels   []string            `json:"channels"`
	ValidFrom  string              `json:"valid_from"`
	ValidUntil string              `json:"valid_until"`
}

type RootDelegationInput 

type RootDelegationInput struct {
	SourceID      string
	RootEpoch     string
	GeneratedAt   string
	ExpiresAt     string
	DelegatedKeys []RootDelegatedKey
	KeyID         string
}

type RootDelegationV1 

type RootDelegationV1 struct {
	SchemaVersion string             `json:"schema_version"`
	SourceID      string             `json:"source_id"`
	RootEpoch     string             `json:"root_epoch"`
	GeneratedAt   string             `json:"generated_at"`
	ExpiresAt     string             `json:"expires_at"`
	DelegatedKeys []RootDelegatedKey `json:"delegated_keys"`
	KeyID         string             `json:"key_id"`
	Signature     string             `json:"signature"`
}

func BuildRootDelegation 

func BuildRootDelegation(input RootDelegationInput, signature []byte) (RootDelegationV1, error)

func DecodeRootDelegation 

func DecodeRootDelegation(raw []byte) (RootDelegationV1, error)

func (RootDelegationV1) SigningPreimage 

func (document RootDelegationV1) SigningPreimage() ([]byte, error)

type SignatureVerificationRequest 

type SignatureVerificationRequest struct {
	Usage                 SigningUsage
	KeyID                 string
	SigningPreimageSHA256 [sha256.Size]byte
	Signature             []byte
}

type SignatureVerifier 

type SignatureVerifier interface {
	VerifySignature(SignatureVerificationRequest) error
}

type SignatureVerifierFunc 

type SignatureVerifierFunc func(SignatureVerificationRequest) error

func (SignatureVerifierFunc) VerifySignature 

func (verify SignatureVerifierFunc) VerifySignature(request SignatureVerificationRequest) error

type SigningUsage 

type SigningUsage string
const (
	SigningUsageRootDelegation      SigningUsage = "redevplugin.release-signing.root-delegation.v1"
	SigningUsagePackage             SigningUsage = "redevplugin.release-signing.package.v1"
	SigningUsageReleaseMetadata     SigningUsage = "redevplugin.release-signing.release-metadata.v1"
	SigningUsageSourcePolicy        SigningUsage = "redevplugin.release-signing.source-policy-document.v1"
	SigningUsageSourcePolicyPointer SigningUsage = "redevplugin.release-signing.source-policy-pointer.v1"
	SigningUsageRevocation          SigningUsage = "redevplugin.release-signing.revocation-document.v1"
	SigningUsageRevocationPointer   SigningUsage = "redevplugin.release-signing.revocation-pointer.v1"
)

type SourcePolicyActiveKeys 

type SourcePolicyActiveKeys struct {
	Package             []string `json:"package"`
	ReleaseMetadata     []string `json:"release_metadata"`
	SourcePolicyPointer []string `json:"source_policy_pointer"`
	Revocation          []string `json:"revocation_document"`
	RevocationPointer   []string `json:"revocation_pointer"`
}

type SourcePolicyInput 

type SourcePolicyInput struct {
	SchemaVersion          string
	SourceID               string
	Channel                string
	Epoch                  string
	RootEpoch              string
	SourceType             string
	SourceClass            string
	AllowedPublishers      []string
	AllowedArtifactHosts   []string
	ActiveKeys             SourcePolicyActiveKeys
	RequireSignature       bool
	InstallPolicy          string
	UnsignedPolicy         string
	DowngradePolicy        string
	MinimumRevocationEpoch string
	Limits                 SourcePolicyLimits
	GeneratedAt            string
	ExpiresAt              string
	KeyID                  string
}

type SourcePolicyLimits 

type SourcePolicyLimits struct {
	DocumentMaxLifetimeSeconds     int `json:"document_max_lifetime_seconds"`
	FutureSkewSeconds              int `json:"future_skew_seconds"`
	RefreshIntervalMaxSeconds      int `json:"refresh_interval_max_seconds"`
	FailureTeardownDeadlineSeconds int `json:"failure_teardown_deadline_seconds"`
}

func DefaultSourcePolicyLimits 

func DefaultSourcePolicyLimits() SourcePolicyLimits

func PersonalMaintainerSourcePolicyLimits 

func PersonalMaintainerSourcePolicyLimits() SourcePolicyLimits

type SourcePolicyPointerV1 

type SourcePolicyPointerV1 struct {
	SchemaVersion  string `json:"schema_version"`
	SourceID       string `json:"source_id"`
	Channel        string `json:"channel"`
	Epoch          string `json:"epoch"`
	Ref            string `json:"ref"`
	DocumentSHA256 string `json:"document_sha256"`
	GeneratedAt    string `json:"generated_at"`
	ExpiresAt      string `json:"expires_at"`
	KeyID          string `json:"key_id"`
	Signature      string `json:"signature"`
}

func BuildSourcePolicyPointer 

func BuildSourcePolicyPointer(input ReleasePointerInput, signature []byte) (SourcePolicyPointerV1, error)

func DecodeSourcePolicyPointer 

func DecodeSourcePolicyPointer(raw []byte) (SourcePolicyPointerV1, error)

func (SourcePolicyPointerV1) SigningPreimage 

func (document SourcePolicyPointerV1) SigningPreimage() ([]byte, error)

type SourcePolicyV2 

type SourcePolicyV2 struct {
	SchemaVersion          string                 `json:"schema_version"`
	SourceID               string                 `json:"source_id"`
	Channel                string                 `json:"channel"`
	Epoch                  string                 `json:"epoch"`
	RootEpoch              string                 `json:"root_epoch"`
	SourceType             string                 `json:"source_type"`
	SourceClass            string                 `json:"source_class"`
	AllowedPublishers      []string               `json:"allowed_publishers"`
	AllowedArtifactHosts   []string               `json:"allowed_artifact_hosts"`
	ActiveKeys             SourcePolicyActiveKeys `json:"active_keys"`
	RequireSignature       bool                   `json:"require_signature"`
	InstallPolicy          string                 `json:"install_policy"`
	UnsignedPolicy         string                 `json:"unsigned_policy"`
	DowngradePolicy        string                 `json:"downgrade_policy"`
	MinimumRevocationEpoch string                 `json:"minimum_revocation_epoch"`
	Limits                 SourcePolicyLimits     `json:"limits"`
	GeneratedAt            string                 `json:"generated_at"`
	ExpiresAt              string                 `json:"expires_at"`
	KeyID                  string                 `json:"key_id"`
	Signature              string                 `json:"signature"`
}

func BuildSourcePolicy 

func BuildSourcePolicy(input SourcePolicyInput, signature []byte) (SourcePolicyV2, error)

func DecodeSourcePolicy 

func DecodeSourcePolicy(raw []byte) (SourcePolicyV2, error)

func (SourcePolicyV2) SigningPreimage 

func (document SourcePolicyV2) SigningPreimage() ([]byte, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.