trust

Documentation

Index

• type AgeSignal
  • func NewAgeSignal(minDays int, nowFn func() time.Time) *AgeSignal
  • func (s *AgeSignal) Check(_ context.Context, pkg Package) (SignalReport, error)
  • func (s *AgeSignal) Name() string
• type Ecosystem
• type Engine
  • func NewEngine(signals ...Signal) *Engine
  • func (e *Engine) Check(ctx context.Context, pkg Package) (TrustResult, error)
• type OSVSignal
  • func NewOSVSignal(minSeverity string, client *http.Client, c cache.Cache, baseURL string) *OSVSignal
  • func (s *OSVSignal) Check(ctx context.Context, pkg Package) (SignalReport, error)
  • func (s *OSVSignal) Name() string
• type Package
• type PopularitySignal
  • func NewPopularitySignal(spikeFactor float64, client *http.Client, c cache.Cache, ...) *PopularitySignal
  • func (s *PopularitySignal) Check(ctx context.Context, pkg Package) (SignalReport, error)
  • func (s *PopularitySignal) Name() string
• type PublisherSignal
  • func NewPublisherSignal(maxAccountAgeDays int, client *http.Client, c cache.Cache, ...) *PublisherSignal
  • func (s *PublisherSignal) Check(ctx context.Context, pkg Package) (SignalReport, error)
  • func (s *PublisherSignal) Name() string
• type Signal
• type SignalReport
• type SignalResult
• type TrustResult
• type Vuln

Types

type AgeSignal

type AgeSignal struct {
	// contains filtered or unexported fields
}

func NewAgeSignal

func NewAgeSignal(minDays int, nowFn func() time.Time) *AgeSignal

func (*AgeSignal) Check

func (s *AgeSignal) Check(_ context.Context, pkg Package) (SignalReport, error)

func (*AgeSignal) Name

func (s *AgeSignal) Name() string

type Ecosystem

type Ecosystem string

const (
	EcosystemNPM      Ecosystem = "npm"
	EcosystemPyPI     Ecosystem = "pypi"
	EcosystemGo       Ecosystem = "go"
	EcosystemCargo    Ecosystem = "cargo"
	EcosystemComposer Ecosystem = "composer"
	EcosystemNuGet    Ecosystem = "nuget"
	EcosystemMaven    Ecosystem = "maven"
)

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

Engine runs each registered Signal against a package and collects the reports.

Signals are expected to handle their own "couldn't determine" cases by returning SignalSkip with nil error. The engine-level error branch below is for unexpected failures the signal didn't catch (panics recovered to error, internal bugs). Those are surfaced as SignalError so the policy layer can decide fail-open vs fail-closed via the strict_signals knob.

func NewEngine

func NewEngine(signals ...Signal) *Engine

func (*Engine) Check

func (e *Engine) Check(ctx context.Context, pkg Package) (TrustResult, error)

type OSVSignal

type OSVSignal struct {
	// contains filtered or unexported fields
}

func NewOSVSignal

func NewOSVSignal(minSeverity string, client *http.Client, c cache.Cache, baseURL string) *OSVSignal

func (*OSVSignal) Check

func (s *OSVSignal) Check(ctx context.Context, pkg Package) (SignalReport, error)

func (*OSVSignal) Name

func (s *OSVSignal) Name() string

type Package

type Package struct {
	Ecosystem   Ecosystem
	Name        string
	Version     string
	PublishedAt time.Time
	Author      string // npm: first maintainer username; PyPI: author field
}

Package is everything the trust engine needs to assess a specific release.

type PopularitySignal

type PopularitySignal struct {
	// contains filtered or unexported fields
}

func NewPopularitySignal

func NewPopularitySignal(spikeFactor float64, client *http.Client, c cache.Cache, npmBaseURL, pypiBaseURL string) *PopularitySignal

func (*PopularitySignal) Check

func (s *PopularitySignal) Check(ctx context.Context, pkg Package) (SignalReport, error)

func (*PopularitySignal) Name

func (s *PopularitySignal) Name() string

type PublisherSignal

type PublisherSignal struct {
	// contains filtered or unexported fields
}

func NewPublisherSignal

func NewPublisherSignal(maxAccountAgeDays int, client *http.Client, c cache.Cache, npmBaseURL, pypiBaseURL string) *PublisherSignal

func (*PublisherSignal) Check

func (s *PublisherSignal) Check(ctx context.Context, pkg Package) (SignalReport, error)

func (*PublisherSignal) Name

func (s *PublisherSignal) Name() string

type Signal

type Signal interface {
	Name() string
	Check(ctx context.Context, pkg Package) (SignalReport, error)
}

Signal is the interface every trust check implements.

type SignalReport

type SignalReport struct {
	Signal string
	Result SignalResult
	Reason string
	Vulns  []Vuln // populated by the OSV signal when Result == SignalFail
}

type SignalResult

type SignalResult string

const (
	SignalPass  SignalResult = "pass"
	SignalFail  SignalResult = "fail"
	SignalWarn  SignalResult = "warn"
	SignalSkip  SignalResult = "skip"
	SignalError SignalResult = "error" // signal couldn't run (network/parse failure); policy decides fail-open vs fail-closed
)

type TrustResult

type TrustResult struct {
	Package Package
	Reports []SignalReport
}

TrustResult collects all signal reports for one package version.

type Vuln

type Vuln struct {
	ID       string `json:"id"`
	Severity string `json:"severity"` // "CRITICAL"|"HIGH"|"MEDIUM"|"LOW"|"" (unknown)
}

Vuln is a single vulnerability advisory matched against a package version.