Help us shape the future of Go! Take the 2026 Go Developer Survey

Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

policy

package module

Go to main page

Versions in this module

v0

v0.6.0

Oct 4, 2026

Changes in this version

+ const AssertModeAND

+ const AssertModeOR

+ const EnforceOff

+ const EnforceOn

+ var ErrParseInconsistency = errors.New("internal error: fetched reference ID and policy ID mismatch")

+ var ErrUnsupportedLocationURI = errors.New("unsupported policy location")

+ func PolicyOrSet(set *api.PolicySet, pcy *api.Policy) any

+ func PolicyOrSetOrGroup(set *api.PolicySet, pcy *api.Policy, grp *api.PolicyGroup) any

+ type Compiler struct

+ Options CompilerOptions

+ Store StorageBackend

+ func NewCompiler() *Compiler

+ func (compiler *Compiler) Compile(data []byte, funcs ...options.OptFn) (*api.PolicySet, *api.Policy, *api.PolicyGroup, error)

+ func (compiler *Compiler) CompileFile(path string, funcs ...options.OptFn) (*api.PolicySet, *api.Policy, *api.PolicyGroup, error)

+ func (compiler *Compiler) CompileLocation(location string, funcs ...options.OptFn) (*api.PolicySet, *api.Policy, *api.PolicyGroup, error)

+ func (compiler *Compiler) CompilePolicy(p *api.Policy, funcs ...options.OptFn) (*api.Policy, error)

+ func (compiler *Compiler) CompilePolicyGroup(grp *api.PolicyGroup, funcs ...options.OptFn) (*api.PolicyGroup, error)

+ func (compiler *Compiler) CompileRemote(uri string, funcs ...options.OptFn) (*api.PolicySet, *api.Policy, *api.PolicyGroup, error)

+ func (compiler *Compiler) CompileSet(set *api.PolicySet, funcs ...options.OptFn) (*api.PolicySet, error)

+ func (compiler *Compiler) CompileVerify(data []byte, funcs ...options.OptFn) (set *api.PolicySet, pcy *api.Policy, grp *api.PolicyGroup, ...)

+ func (compiler *Compiler) CompileVerifyFile(path string, funcs ...options.OptFn) (*api.PolicySet, *api.Policy, *api.PolicyGroup, attestation.Verification, error)

+ func (compiler *Compiler) CompileVerifyLocation(location string, funcs ...options.OptFn) (set *api.PolicySet, pcy *api.Policy, grp *api.PolicyGroup, ...)

+ func (compiler *Compiler) CompileVerifyRemote(uri string, funcs ...options.OptFn) (set *api.PolicySet, pcy *api.Policy, grp *api.PolicyGroup, ...)

+ type CompilerOptions struct

+ MaxParallelFetches int

+ MaxRemoteRecursion int

+ MaxTotalFetches int

+ type Fetcher struct

+ Limits options.Limits

+ func NewFetcher() *Fetcher

+ func NewFetcherWithLimits(limits options.Limits) *Fetcher

+ func (gf *Fetcher) Get(uri string) ([]byte, error)

+ func (gf *Fetcher) GetFromGit(locator string) ([]byte, error)

+ func (gf *Fetcher) GetFromHTTP(url string) ([]byte, error)

+ func (gf *Fetcher) GetGroup(uris []string) ([][]byte, error)

+ func (gf *Fetcher) GetGroupBatched(uris []string, batchSize int) ([][]byte, error)

+ type Parser struct

+ func NewParser() *Parser

+ func (p *Parser) Open(location string, funcs ...options.OptFn) (*api.PolicySet, *api.Policy, *api.PolicyGroup, error)

+ func (p *Parser) OpenVerify(location string, funcs ...options.OptFn) (set *api.PolicySet, pcy *api.Policy, grp *api.PolicyGroup, ...)

+ func (p *Parser) ParsePolicy(data []byte, funcs ...options.OptFn) (*api.Policy, error)

+ func (p *Parser) ParsePolicyFile(path string, funcs ...options.OptFn) (*api.Policy, error)

+ func (p *Parser) ParsePolicyGroup(policyGroupData []byte, funcs ...options.OptFn) (*api.PolicyGroup, error)

+ func (p *Parser) ParsePolicyGroupFile(path string, funcs ...options.OptFn) (*api.PolicyGroup, error)

+ func (p *Parser) ParsePolicyOrSet(data []byte, funcs ...options.OptFn) (*api.PolicySet, *api.Policy, error)

+ func (p *Parser) ParsePolicySet(policySetData []byte, funcs ...options.OptFn) (*api.PolicySet, error)

+ func (p *Parser) ParsePolicySetFile(path string, funcs ...options.OptFn) (*api.PolicySet, error)

+ func (p *Parser) ParseVerifyPolicy(data []byte, funcs ...options.OptFn) (*api.Policy, attestation.Verification, error)

+ func (p *Parser) ParseVerifyPolicyGroup(policyGroupData []byte, funcs ...options.OptFn) (*api.PolicyGroup, attestation.Verification, error)

+ func (p *Parser) ParseVerifyPolicyOrSet(data []byte, funcs ...options.OptFn) (set *api.PolicySet, pcy *api.Policy, v attestation.Verification, err error)

+ func (p *Parser) ParseVerifyPolicyOrSetOrGroup(data []byte, funcs ...options.OptFn) (set *api.PolicySet, pcy *api.Policy, grp *api.PolicyGroup, ...)

+ func (p *Parser) ParseVerifyPolicySet(policySetData []byte, funcs ...options.OptFn) (*api.PolicySet, attestation.Verification, error)

+ type PolicyFetcher interface

+ Get func(string) ([]byte, error)

+ GetGroup func(uris []string) ([][]byte, error)

+ type RefUpdate struct

+ New *api.PolicyRef

+ Old *api.PolicyRef

+ type Signer struct

+ Options options.SignerOptions

+ func NewSigner(funcs ...options.SignerOptFn) *Signer

+ func (ps *Signer) SignPolicyData(data []byte, w io.Writer, funcs ...options.SignerOptFn) error

+ func (ps *Signer) SignPolicyFile(path string, w io.Writer, funcs ...options.SignerOptFn) error

+ type StorageBackend interface

+ GetReferencedGroup func(api.RemoteReference) (*api.PolicyGroup, error)

+ GetReferencedPolicy func(api.RemoteReference) (*api.Policy, error)

+ StoreReference func(api.RemoteReference) error

+ StoreReferenceWithReturn func(api.RemoteReference) (*api.PolicySet, *api.Policy, *api.PolicyGroup, error)

+ type Updater struct

+ MaxParallel int

+ func NewUpdater() *Updater

+ func (u *Updater) ApplyUpdates(updates map[string][]*RefUpdate) (map[string][]*RefUpdate, error)

+ func (u *Updater) CheckUpdates(locations ...string) (map[string][]*RefUpdate, error)

+ func (u *Updater) Update(locations ...string) (map[string][]*RefUpdate, error)