in_toto

May 4, 2023

Changes in this version

+ var ErrNotLayout = errors.New("verification workflow passed a non-layout")

+ var ErrUnknownMetadataType = errors.New("unknown metadata type encountered: not link or layout")

+ type Envelope struct

+ func (e *Envelope) Dump(path string) error

+ func (e *Envelope) GetPayload() any

+ func (e *Envelope) GetSignatureForKeyID(keyID string) (Signature, error)

+ func (e *Envelope) SetPayload(payload any) error

+ func (e *Envelope) Sign(key Key) error

+ func (e *Envelope) Sigs() []Signature

+ func (e *Envelope) VerifySignature(key Key) error

type Metablock

+ func (mb *Metablock) GetPayload() any

+ func (mb *Metablock) Sigs() []Signature

+ type Metadata interface

+ Dump func(string) error

+ GetPayload func() any

+ GetSignatureForKeyID func(string) (Signature, error)

+ Sign func(Key) error

+ Sigs func() []Signature

+ VerifySignature func(Key) error

+ func LoadMetadata(path string) (Metadata, error)

Apr 25, 2023

Changes in this version

+ type ProvenanceStatementSLSA1 struct

+ Predicate slsa1.ProvenancePredicate

Oct 19, 2022

Changes in this version

+ var ErrEmptyCommandArgs = errors.New("the command args are empty")

Sep 24, 2022

Changes in this version

+ const PredicateCycloneDX

+ type CycloneDXStatement struct

+ Predicate interface{}

+ type DSSESigner struct

+ func NewDSSESigner(p ...dsse.SignVerifier) (*DSSESigner, error)

+ func (s *DSSESigner) SignPayload(body []byte) (*dsse.Envelope, error)

+ func (s *DSSESigner) Verify(e *dsse.Envelope) error

+ type ProvenanceStatementSLSA01 struct

+ Predicate slsa01.ProvenancePredicate

+ type ProvenanceStatementSLSA02 struct

+ Predicate slsa02.ProvenancePredicate

Sep 21, 2021

Changes in this version

+ const AllowAllConstraint

+ const LinkGlobFormat

+ const PredicateSLSAProvenanceV01

+ const PreliminaryLinkNameFormat

+ func LoadLayoutCertificates(layout Layout, intermediatePems [][]byte) (*x509.CertPool, *x509.CertPool, error)

+ func VerifyCertificateTrust(cert *x509.Certificate, rootCertPool, intermediateCertPool *x509.CertPool) ([][]*x509.Certificate, error)

+ type CertificateConstraint struct

+ CommonName string

+ DNSNames []string

+ Emails []string

+ Organizations []string

+ Roots []string

+ URIs []string

+ func (cc CertificateConstraint) Check(cert *x509.Certificate, rootCAIDs []string, ...) error

type Key

+ func (k *Key) LoadKeyDefaults(path string) error

+ func (k *Key) LoadKeyReaderDefaults(r io.Reader) error

type KeyVal

+ Certificate string

type Layout

+ IntermediateCas map[string]Key

+ RootCas map[string]Key

+ func (l *Layout) RootCAIDs() []string

type Metablock

+ func InTotoRecordStart(name string, materialPaths []string, key Key, ...) (Metablock, error)

+ func InTotoRecordStop(prelimLinkMb Metablock, productPaths []string, key Key, ...) (Metablock, error)

+ func (mb *Metablock) GetSignatureForKeyID(keyID string) (Signature, error)

type Signature

+ Certificate string

+ func (sig Signature) GetCertificate() (Key, error)

type Step

+ CertificateConstraints []CertificateConstraint

+ func (s Step) CheckCertConstraints(key Key, rootCAIDs []string, rootCertPool, intermediateCertPool *x509.CertPool) error

Jun 21, 2021

Changes in this version

+ const PayloadType

+ const PredicateLinkV1

+ const PredicateProvenanceV01

+ const PredicateSPDX

+ const StatementInTotoV01

+ var ErrInspectionRunDirIsSymlink = errors.New("runDir is a symlink. This is a security risk")

+ var ErrInvalidPayloadType = errors.New("unknown payload type")

+ var ErrUnsupportedKeyIDHashAlgorithms = errors.New("the given keyID hash algorithm is not supported")

+ func ValidateMetablock(mb Metablock) error

+ type DigestSet map[string]string

type Key

+ KeyID string

+ KeyIDHashAlgorithms []string

+ type LinkStatement struct

+ Predicate Link

type Metablock

+ func InTotoVerifyWithDirectory(layoutMb Metablock, layoutKeys map[string]Key, linkDir string, runDir string, ...) (Metablock, error)

+ type ProvenanceBuilder struct

+ ID string

+ type ProvenanceComplete struct

+ Arguments bool

+ Environment bool

+ Materials bool

+ type ProvenanceMaterial struct

+ Digest DigestSet

+ URI string

+ type ProvenanceMetadata struct

+ BuildFinishedOn *time.Time

+ BuildStartedOn *time.Time

+ Completeness ProvenanceComplete

+ Reproducible bool

+ type ProvenancePredicate struct

+ Builder ProvenanceBuilder

+ Materials []ProvenanceMaterial

+ Metadata ProvenanceMetadata

+ Recipe ProvenanceRecipe

+ type ProvenanceRecipe struct

+ Arguments interface{}

+ DefinedInMaterial *int

+ EntryPoint string

+ Environment interface{}

+ Type string

+ type ProvenanceStatement struct

+ Predicate ProvenancePredicate

+ type SPDXStatement struct

+ Predicate interface{}

+ type SSLSigner struct

+ func NewSSLSigner(p ...ssl.SignVerifier) (*SSLSigner, error)

+ func (s *SSLSigner) SignPayload(body []byte) (*ssl.Envelope, error)

+ func (s *SSLSigner) Verify(e *ssl.Envelope) error

type Signature

+ KeyID string

+ type Statement struct

+ Predicate interface{}

+ type StatementHeader struct

+ PredicateType string

+ Subject []Subject

+ Type string

+ type Subject struct

+ Digest DigestSet

+ Name string

Jan 5, 2021

Changes in this version

+ const ISO8601DateSchema

+ const LinkNameFormat

+ const LinkNameFormatShort

+ const SublayoutLinkDirFormat

+ var ErrCurveSizeSchemeMismatch = errors.New("the scheme does not match the curve size")

+ var ErrEmptyKeyField = errors.New("empty field in key")

+ var ErrFailedPEMParsing = errors.New("failed parsing the PEM block: unsupported PEM type")

+ var ErrInvalidHexString = errors.New("invalid hex string")

+ var ErrInvalidKey = errors.New("invalid key")

+ var ErrInvalidSignature = errors.New("invalid signature")

+ var ErrKeyKeyTypeMismatch = errors.New("the given key does not match its key type")

+ var ErrNoPEMBlock = errors.New("failed to decode the data as PEM block (are you sure this is a pem file?)")

+ var ErrNoPublicKey = errors.New("the given key is not a public key")

+ var ErrSchemeKeyTypeMismatch = errors.New("the scheme and key type are not supported together")

+ var ErrSymCycle = errors.New("symlink cycle detected")

+ var ErrUnsupportedHashAlgorithm = errors.New("unsupported hash algorithm detected")

+ var ErrUnsupportedKeyIdHashAlgorithms = errors.New("the given keyID hash algorithm is not supported")

+ var ErrUnsupportedKeyType = errors.New("unsupported key type")

+ func EncodeCanonical(obj interface{}) ([]byte, error)

+ func InterfaceKeyStrings(m map[string]interface{}) []string

+ func LoadLinksForLayout(layout Layout, linkDir string) (map[string]map[string]Metablock, error)

+ func RecordArtifact(path string, hashAlgorithms []string) (map[string]interface{}, error)

+ func RecordArtifacts(paths []string, hashAlgorithms []string, gitignorePatterns []string) (evalArtifacts map[string]interface{}, err error)

+ func ReduceStepsMetadata(layout Layout, stepsMetadata map[string]map[string]Metablock) (map[string]Metablock, error)

+ func RunCommand(cmdArgs []string) (map[string]interface{}, error)

+ func RunInspections(layout Layout) (map[string]Metablock, error)

+ func UnpackRule(rule []string) (map[string]string, error)

+ func VerifyArtifacts(items []interface{}, itemsMetadata map[string]Metablock) error

+ func VerifyLayoutExpiration(layout Layout) error

+ func VerifyLayoutSignatures(layoutMb Metablock, layoutKeys map[string]Key) error

+ func VerifyLinkSignatureThesholds(layout Layout, stepsMetadata map[string]map[string]Metablock) (map[string]map[string]Metablock, error)

+ func VerifySignature(key Key, sig Signature, unverified []byte) error

+ func VerifyStepCommandAlignment(layout Layout, stepsMetadata map[string]map[string]Metablock)

+ func VerifySublayouts(layout Layout, stepsMetadataVerified map[string]map[string]Metablock, ...) (map[string]map[string]Metablock, error)

+ func WaitErrToExitCode(err error) int

+ type Inspection struct

+ Run []string

+ Type string

+ type Key struct

+ KeyId string

+ KeyIdHashAlgorithms []string

+ KeyType string

+ KeyVal KeyVal

+ Scheme string

+ func (k *Key) LoadKey(path string, scheme string, keyIdHashAlgorithms []string) error

+ func (k *Key) LoadKeyReader(r io.Reader, scheme string, keyIdHashAlgorithms []string) error

+ type KeyVal struct

+ Private string

+ Public string

+ type Layout struct

+ Expires string

+ Inspect []Inspection

+ Keys map[string]Key

+ Readme string

+ Steps []Step

+ Type string

+ func SubstituteParameters(layout Layout, parameterDictionary map[string]string) (Layout, error)

+ func (l *Layout) InspectAsInterfaceSlice() []interface{}

+ func (l *Layout) StepsAsInterfaceSlice() []interface{}

+ type Link struct

+ ByProducts map[string]interface{}

+ Command []string

+ Environment map[string]interface{}

+ Materials map[string]interface{}

+ Name string

+ Products map[string]interface{}

+ Type string

+ type Metablock struct

+ Signatures []Signature

+ Signed interface{}

+ func GetSummaryLink(layout Layout, stepsMetadataReduced map[string]Metablock, stepName string) (Metablock, error)

+ func InTotoRun(name string, materialPaths []string, productPaths []string, cmdArgs []string, ...) (Metablock, error)

+ func InTotoVerify(layoutMb Metablock, layoutKeys map[string]Key, linkDir string, stepName string, ...) (Metablock, error)

+ func (mb *Metablock) Dump(path string) error

+ func (mb *Metablock) GetSignableRepresentation() ([]byte, error)

+ func (mb *Metablock) Load(path string) (err error)

+ func (mb *Metablock) Sign(key Key) error

+ func (mb *Metablock) VerifySignature(key Key) error

+ type Set map[string]struct

+ func NewSet(elems ...string) Set

+ func (s Set) Add(elem string)

+ func (s Set) Difference(s2 Set) Set

+ func (s Set) Filter(pattern string) Set

+ func (s Set) Has(elem string) bool

+ func (s Set) Intersection(s2 Set) Set

+ func (s Set) IsSubSet(subset Set) bool

+ func (s Set) Remove(elem string)

+ func (s Set) Slice() []string

+ type Signature struct

+ KeyId string

+ Sig string

+ func GenerateSignature(signable []byte, key Key) (Signature, error)

+ type Step struct

+ ExpectedCommand []string

+ PubKeys []string

+ Threshold int

+ Type string

+ type SupplyChainItem struct

+ ExpectedMaterials [][]string

+ ExpectedProducts [][]string

+ Name string