formpackage

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 28, 2026 License: MIT Imports: 29 Imported by: 0

Documentation

Overview

Package formpackage verifies portable, data-only Takoform Form Packages.

It deliberately does not fetch packages, execute extensions, verify signatures, or select a host implementation. Those are separate operator and release concerns.

Index

Constants

View Source 
const (
	// LegacyFormAPIVersion identifies the frozen pre-reset Form epoch.
	LegacyFormAPIVersion = "forms.takoform.com/v1alpha1"
	// FormAPIVersion is the retained source-compatible name for the v1alpha1
	// package and provider-v1 verifier surface. New code must select the epoch
	// explicitly instead of treating this alias as current authority.
	FormAPIVersion = LegacyFormAPIVersion
	// CurrentFormAPIVersion identifies the current Form specification epoch.
	// An epoch does not imply that any Form has reached Experimental maturity.
	CurrentFormAPIVersion = "forms.takoform.com/v1alpha2"
	// PackageAPIVersion is the retained v1alpha1 package profile. Its
	// packageVersion remains part of immutable Legacy bytes and locators.
	PackageAPIVersion = "packages.forms.takoform.com/v1alpha1"
	// LegacyContentAddressedPackageAPIVersion is the immutable v1alpha2 package
	// profile published for v1alpha1 FormRefs. It remains readable but cannot
	// carry a Form from the current epoch.
	LegacyContentAddressedPackageAPIVersion = "packages.forms.takoform.com/v1alpha2"
	// CurrentPackageAPIVersion identifies content-addressed packages for the
	// current Form epoch. Their publication locator is derived from
	// packageDigest, never a second SemVer.
	CurrentPackageAPIVersion = "packages.forms.takoform.com/v1alpha3"
	// FamilyPackageAPIVersion identifies content-addressed packages carrying
	// Form Family (namespaced-group, v1beta1 form-definition) Forms. FormRefs
	// in this lane use DNS-like groups, so there is no single Form apiVersion
	// constant; validation accepts any namespaced group outside the two frozen
	// central epochs.
	FamilyPackageAPIVersion = "packages.forms.takoform.com/v1alpha4"
	// VersionlessFamilyPackageAPIVersion identifies content-addressed packages
	// whose family group carries no version segment (decision 0049). It exists
	// only because v1alpha4's index schema refers to a FormRef schema that
	// requires one, and that schema is published.
	VersionlessFamilyPackageAPIVersion = "packages.forms.takoform.com/v1alpha5"
	PackageKind                        = "FormPackage"
	// TrustAPIVersion identifies the occupied v1alpha1 statement and checkpoint
	// formats. They remain readable but are not changed in place.
	TrustAPIVersion = "trust.forms.takoform.com/v1alpha1"
	// CurrentTrustAPIVersion identifies the current revocation statement and
	// signed checkpoint data formats. It is consumed by Core and does not name
	// another Host API lane or negotiated version axis.
	CurrentTrustAPIVersion   = "trust.forms.takoform.com/v1"
	RevocationKind           = "FormPackageRevocation"
	RevocationCheckpointKind = "FormPackageRevocationCheckpoint"
	PackageIndexFilename     = "package-index.json"
	DefinitionMediaType      = "application/vnd.takoform.form-definition.v1+json"
)
View Source 
const (
	InterfaceInputSourceLiteral = "literal"
	InterfaceInputSourceOutput  = "output"
	// InterfaceInputSourceResourceURI asks the host to supply its canonical
	// OAuth resource URI for this runtime declaration. It is non-secret and
	// grants no authorization by itself.
	InterfaceInputSourceResourceURI = "resource_uri"
)

Portable interface input sources. Any other source must be host-namespaced (`<host>.<token>`) and is explicitly non-portable: a host that does not understand one fails closed instead of dropping the input.

View Source 
const (
	LegacyStandardServiceAPIVersion  = "standards.takoform.com/v1alpha1"
	StandardServiceAPIVersion        = "standards.takoform.com/v1"
	StandardServiceSupportAPIVersion = "support.takoform.com/v1"
	PatternStandardServiceProtocol   = `^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?){2,}$`
	StandardServiceProtocolMaxLength = 253
)

Variables

This section is empty.

Functions

func Canonicalize 

func Canonicalize(input []byte) ([]byte, error)

Canonicalize validates UTF-8 I-JSON and returns RFC 8785 JSON Canonicalization Scheme bytes. Duplicate object names, invalid Unicode, non-finite numbers, and every spelling of negative zero are rejected before canonicalization.

func DecodeStrictIJSON 

func DecodeStrictIJSON(input []byte, target any) error

DecodeStrictIJSON validates the complete raw document as UTF-8 I-JSON before typed decoding. This preserves duplicate-member, Unicode, number, depth, and trailing-value failures that encoding/json would otherwise collapse or normalize before DisallowUnknownFields can inspect the target shape.

func DigestBytes 

func DigestBytes(input []byte) string

DigestBytes returns a normalized lowercase sha256:<hex> digest.

func DigestCanonicalJSON 

func DigestCanonicalJSON(input []byte) (string, error)

DigestCanonicalJSON returns the lowercase SHA-256 digest of RFC 8785 bytes.

func FamilyPackageLane 

func FamilyPackageLane(apiVersion string) bool

FamilyPackageLane reports whether a package index apiVersion is one of the Form Family lanes, which are distinguished from each other only by whether the family group carries a version segment (decision 0049).

func FamilyReleaseID 

func FamilyReleaseID(releaseID string) (group, kind string, family bool)

FamilyReleaseID reports whether a release ID encodes the v1alpha4 Form Family identity "<group>/<Kind>" rather than a bare central Kind, and returns the two components when it does. It is the one place that knows the separator rule stated on ReleaseIDForGroupKind.

func KindFromReleaseID 

func KindFromReleaseID(releaseID string) (string, error)

KindFromReleaseID reverses and canonicalizes a path-safe release ID.

func NamespacedFormGroup 

func NamespacedFormGroup(apiVersion string) bool

NamespacedFormGroup reports whether apiVersion is a namespaced Form group from the family model (decision 0009).

This guard is deliberately STRICTER than the normative grammar it mirrors. spec/schemas/form-ref-v1alpha3.schema.json constrains apiVersion with the DNS-like group/version pattern and excludes exactly two enum values, forms.takoform.com/v1alpha1 and forms.takoform.com/v1alpha2. On top of that minimum this function also rejects:

  • the bare forms.takoform.com group in every version AND with no version at all. That domain names retained Form epochs and Host API wire identities (forms.takoform.com/v1alpha3 is the Host API lane, not a Form group), while publisher-owned families may use subdomains of it.
  • the reserved envelope namespaces packages.forms.takoform.com and trust.forms.takoform.com, likewise versioned or not.

Both exclusions are a strict superset of the schema's, so every apiVersion this function accepts also satisfies the normative schema; the extra rules only ever refuse. Loosening them is a specification change, not a Go change.

func PortableInterfaceInputSource 

func PortableInterfaceInputSource(source string) bool

PortableInterfaceInputSource reports whether a source is part of the closed portable vocabulary every conforming host must understand.

func ReleaseIDForGroupKind 

func ReleaseIDForGroupKind(group, kind string) string

ReleaseIDForGroupKind is the v1alpha4 release identity: it encodes the namespaced Form group (the FormRef apiVersion) together with the kind, so "storage.publisher.example/v1beta1 ObjectBucket" and the frozen central "ObjectBucket" own different release lines.

The joined string contains MORE than one "/": a Form group is itself "<dns-name>/<groupVersion>", so "storage.publisher.example/v1beta1" plus "ObjectBucket" joins to a value with two separators. The separator is therefore not unique and never was. What makes the encoding unambiguous is the Kind grammar (^[A-Z][A-Za-z0-9]{0,63}$, spec/schemas/form-ref-*.json), which admits no "/" at all:

  • the LAST "/" of a decoded release ID always splits the group from the kind (see FamilyReleaseID), and
  • a decoded release ID containing any "/" is a family locator, because a bare central Kind can never contain one.

KindFromReleaseID round-trips the joined string verbatim, so neither the encoding nor the split loses information.

func ReleaseIDForKind 

func ReleaseIDForKind(kind string) string

ReleaseIDForKind is a reversible path-safe encoding of the exact Form kind.

func ValidDigest 

func ValidDigest(digest string) bool

ValidDigest reports whether digest is the exact lowercase SHA-256 form used by FormRef and package-index documents.

func ValidateBindingDefinition 

func ValidateBindingDefinition(raw []byte) error

ValidateBindingDefinition validates one exact Binding Definition against the normative v1alpha2 schema embedded with the production parser.

func ValidateDesiredInstance 

func ValidateDesiredInstance(schema map[string]any, value any) error

ValidateDesiredInstance validates one already-decoded desired value against the exact desired schema carried by its Form Definition. It is the shared consumption seam for providers and hosts that already resolved an exact FormRef; callers must never substitute a latest/default schema.

func ValidateInterfaceDefinition 

func ValidateInterfaceDefinition(raw []byte) error

ValidateInterfaceDefinition validates one exact Interface Definition against the normative v1alpha1 schema embedded with the production parser. Family renderers call this path before deriving a digest, so a local authoring validator can add narrower invariants but can never substitute for the published wire contract.

func ValidatePortableData 

func ValidatePortableData(value any) error

ValidatePortableData rejects credential, secret, host-authority, commercial, and executable field vocabulary from an already decoded JSON value. Runtime declaration readers use the same fail-closed policy as Form Definitions before exposing host-supplied documents or values to non-sensitive state.

func ValidateRevocationFormRef added in v1.1.0 

func ValidateRevocationFormRef(revocationAPIVersion string, ref FormRef) error

ValidateRevocationFormRef checks that ref belongs to the exact FormRef profile addressed by a retained or current revocation document. This closes empty checkpoints as well as entries: one profile cannot issue a not-revoked result for a FormRef that only the other profile can revoke.

func ValidateStandardServiceRef 

func ValidateStandardServiceRef(ref StandardServiceRef) error

ValidateStandardServiceRef validates structure, never protocol meaning or conformance. A namespaced identifier unknown to Takoform is valid.

func ValidateStandardServiceSupport 

func ValidateStandardServiceSupport(ref StandardServiceRef, profile map[string]any) (bool, error)

ValidateStandardServiceSupport validates one stable Host support answer and returns its satisfiable decision. Every identity member is exact: a profile for a different protocol is not a fallback or an alias.

Types

type BindingRef 

type BindingRef struct {
	APIVersion   string `json:"apiVersion"`
	Name         string `json:"name"`
	Version      string `json:"version"`
	SchemaDigest string `json:"schemaDigest"`
}

BindingRef is the exact identity of one published Binding Definition. SchemaDigest is calculated over the definition's RFC 8785 bytes.

type ConformanceFixture 

type ConformanceFixture struct {
	Name         string `json:"name"`
	DesiredPath  string `json:"desiredPath"`
	ObservedPath string `json:"observedPath,omitempty"`
	OutputPath   string `json:"outputPath,omitempty"`
}

type ConformanceReport 

type ConformanceReport struct {
	PositivePackages int `json:"positivePackages"`
	NegativeCases    int `json:"negativeCases"`
}

func VerifyConformance 

func VerifyConformance(root string) (ConformanceReport, error)

VerifyConformance runs the committed Form Package v1 corpus. It is local and deterministic: no network, trust-root, signature, host, or provider operation is performed.

type FormConstraint 

type FormConstraint struct {
	Kind       string   `json:"kind"`
	Reference  string   `json:"reference,omitempty"`
	KeyedBy    string   `json:"keyedBy,omitempty"`
	List       string   `json:"list,omitempty"`
	Member     string   `json:"member,omitempty"`
	Total      int64    `json:"total,omitempty"`
	Property   string   `json:"property,omitempty"`
	Output     string   `json:"output,omitempty"`
	References []string `json:"references,omitempty"`
	Anchor     string   `json:"anchor,omitempty"`
	Members    string   `json:"members,omitempty"`
	Through    string   `json:"through,omitempty"`
}

FormConstraint is one entry of a Form Definition's closed constraint list. Every pointer is an RFC 6901 JSON Pointer into the desired instance, or into the outputs for a host-assigned member. References is shared by the closed orderedPair, distinctPair, and uniquePair variants; Kind fixes whether the values are numeric desired fields or resolved resource UIDs.

func (FormConstraint) MarshalJSON 

func (constraint FormConstraint) MarshalJSON() ([]byte, error)

MarshalJSON preserves the presence of sum.total when its valid value is zero. A plain `omitempty` integer cannot distinguish "sum of exactly zero" from "this constraint kind has no total member", while the closed schemas require total on sum and forbid it everywhere else.

type FormDefinition 

type FormDefinition struct {
	APIVersion        string `json:"apiVersion"`
	Kind              string `json:"kind"`
	DefinitionVersion string `json:"definitionVersion"`
	Title             string `json:"title"`
	Description       string `json:"description,omitempty"`
	// Status is retained only for immutable v1alpha1 Definition bytes. The
	// v1alpha2 schema forbids it because forms/lifecycle.json is the sole
	// authority for Proposal, Experimental, Stable, and Legacy maturity.
	Status string `json:"status,omitempty"`
	// Role is the closed family resource role (decision 0009). The frozen
	// v1alpha1/v1alpha2 schemas forbid it, so it stays empty on those epochs.
	Role string `json:"role,omitempty"`
	// RequiresHostAPI is the earliest Host API lane whose rules this contract
	// needs — a lower bound, not a pin (decision 0047). It is the one
	// dependency every Form has and the only one that used to travel by
	// convention, which is why a family and a lane could never move apart.
	// Empty on the epochs whose frozen schemas forbid it.
	RequiresHostAPI string `json:"requiresHostApi,omitempty"`
	// Constraints is the closed list of rules about RESOURCES this Form
	// declares (decision 0049). They are not shape, so they are not in the
	// desired schema, where they rode in extension slots no standard validator
	// reads. Empty on the epochs whose frozen schemas forbid the member.
	Constraints   []FormConstraint `json:"constraints,omitempty"`
	DesiredSchema map[string]any   `json:"desiredSchema"`
	// ObservedSchema is required by the frozen v1alpha1/v1alpha2 schemas and
	// optional in the family lanes, where the envelope owns status.
	ObservedSchema        map[string]any        `json:"observedSchema,omitempty"`
	OutputSchema          map[string]any        `json:"outputSchema,omitempty"`
	ImmutableFields       []string              `json:"immutableFields,omitempty"`
	LifecycleCapabilities []string              `json:"lifecycleCapabilities"`
	Interfaces            []InterfaceDescriptor `json:"interfaces,omitempty"`
	// ProvidedInterfaces and AcceptedBindings are the exact digest-bound
	// contracts of the family lane (decision 0010).
	ProvidedInterfaces  []InterfaceRef       `json:"providedInterfaces,omitempty"`
	AcceptedBindings    []BindingRef         `json:"acceptedBindings,omitempty"`
	ConformanceFixtures []ConformanceFixture `json:"conformanceFixtures,omitempty"`
	NegativeFixtures    []NegativeFixture    `json:"negativeConformanceFixtures,omitempty"`
}

func ValidateDefinition 

func ValidateDefinition(raw []byte) (FormDefinition, error)

ValidateDefinition validates the Draft 2020-12 Form Definition, its inline schemas, and the fail-closed data-only content policy.

type FormRef 

type FormRef struct {
	APIVersion        string `json:"apiVersion"`
	Kind              string `json:"kind"`
	DefinitionVersion string `json:"definitionVersion"`
	SchemaDigest      string `json:"schemaDigest"`
}

FormRef is the exact portable identity of one immutable Form Definition. SchemaDigest is calculated over the definition's RFC 8785 bytes.

func ValidateFormRef 

func ValidateFormRef(raw []byte) (FormRef, error)

ValidateFormRef validates the exact four-field Draft 2020-12 FormRef and returns its typed value.

type InterfaceDescriptor 

type InterfaceDescriptor struct {
	Name             string                      `json:"name"`
	Version          string                      `json:"version"`
	Description      string                      `json:"description,omitempty"`
	Required         bool                        `json:"required,omitempty"`
	ResourceURIInput string                      `json:"resourceUriInput,omitempty"`
	Document         map[string]any              `json:"document,omitempty"`
	DocumentSchema   map[string]any              `json:"documentSchema,omitempty"`
	Inputs           []InterfaceInputDeclaration `json:"inputs,omitempty"`
}

InterfaceDescriptor declares one portable runtime interface a Form exposes. Name and Version are author-defined: there is no registry, allowlist, or central approval for an interface type. A host owns the resulting record, authorization, and lifecycle; this descriptor owns only declared data.

type InterfaceInputDeclaration 

type InterfaceInputDeclaration struct {
	Name    string          `json:"name"`
	Source  string          `json:"source"`
	Pointer string          `json:"pointer,omitempty"`
	Value   json.RawMessage `json:"value,omitempty"`
}

InterfaceInputDeclaration is a deterministic mapping from the Form's own output document (or a literal) into one named interface input. Value is raw JSON so an explicit JSON null remains distinguishable from an absent value. It never carries credentials or targets. The resource_uri source is the one explicit host-resolved identifier and remains a non-secret audience fence.

type InterfaceRef 

type InterfaceRef struct {
	APIVersion   string `json:"apiVersion"`
	Name         string `json:"name"`
	Version      string `json:"version"`
	SchemaDigest string `json:"schemaDigest"`
}

InterfaceRef is the exact identity of one published Interface Definition. SchemaDigest is calculated over the definition's RFC 8785 bytes.

type NegativeFixture 

type NegativeFixture struct {
	Name            string `json:"name"`
	Stage           string `json:"stage"`
	InputPath       string `json:"inputPath"`
	ExpectedFailure string `json:"expectedFailure"`
}

type PackageFile 

type PackageFile struct {
	Path      string `json:"path"`
	MediaType string `json:"mediaType"`
	Size      int64  `json:"size"`
	Digest    string `json:"digest"`
}

type PackageIndex 

type PackageIndex struct {
	APIVersion     string        `json:"apiVersion"`
	Kind           string        `json:"kind"`
	PackageVersion string        `json:"packageVersion,omitempty"`
	FormRef        FormRef       `json:"formRef"`
	DefinitionPath string        `json:"definitionPath"`
	Files          []PackageFile `json:"files"`
}

func ValidatePackageIndex 

func ValidatePackageIndex(raw []byte) (PackageIndex, error)

ValidatePackageIndex validates the exact Draft 2020-12 package-index document. Filesystem closure and payload bytes are verified separately by VerifyDirectory.

type PublicationLocator 

type PublicationLocator struct {
	APIVersion string `json:"apiVersion"`
	ReleaseID  string `json:"releaseId"`
	ArtifactID string `json:"artifactId"`
	Tag        string `json:"tag"`
	SourcePath string `json:"sourcePath"`
}

PublicationLocator is the immutable repository/Git locator for one exact package artifact. ArtifactID is a compatibility locator, not Form maturity.

func ParsePublicationTag 

func ParsePublicationTag(tag string) (PublicationLocator, error)

func ParsePublicationTagForPackageAPIVersion 

func ParsePublicationTagForPackageAPIVersion(tag, packageAPIVersion string) (PublicationLocator, error)

ParsePublicationTagForPackageAPIVersion parses one canonical publication tag under an explicit Form Package envelope identity. The package apiVersion is the only information capable of distinguishing the byte-identical central v1alpha2 and v1alpha3 tag grammars; publisher and Form group names do not participate in that decision.

func PublicationLocatorFor 

func PublicationLocatorFor(index PackageIndex, packageDigest string) (PublicationLocator, error)

PublicationLocatorFor derives the only canonical locator for an already verified package index and digest. v1alpha1 retains its immutable SemVer locator; v1alpha2 through v1alpha5 use the package digest and forbid a second version clock. Form Family release IDs encode the namespaced group together with the kind so a family kind can never collide with a frozen central-epoch kind of the same name.

type RevocationCheckpoint 

type RevocationCheckpoint struct {
	APIVersion               string                      `json:"apiVersion"`
	Kind                     string                      `json:"kind"`
	CheckpointVersion        string                      `json:"checkpointVersion"`
	Sequence                 uint64                      `json:"sequence"`
	PreviousCheckpointDigest *string                     `json:"previousCheckpointDigest"`
	Entries                  []RevocationCheckpointEntry `json:"entries"`
}

RevocationCheckpoint is a signed cumulative index. Sequence and PreviousCheckpointDigest form a monotonic hash chain; Entries closes the complete statement set from sequence 1 through this checkpoint. In the current profile, sequence zero is the one signed empty genesis state.

func ValidateRevocationCheckpoint 

func ValidateRevocationCheckpoint(raw []byte) (RevocationCheckpoint, error)

ValidateRevocationCheckpoint validates the cumulative checkpoint schema and sequence closure. Signature verification remains a caller precondition.

type RevocationCheckpointEntry 

type RevocationCheckpointEntry struct {
	StatementAPIVersion string  `json:"statementApiVersion,omitempty"`
	Sequence            uint64  `json:"sequence"`
	StatementVersion    string  `json:"statementVersion"`
	StatementDigest     string  `json:"statementDigest"`
	PackageDigest       string  `json:"packageDigest"`
	FormRef             FormRef `json:"formRef"`
}

func RevocationCheckpointEntryForStatement added in v1.1.0 

func RevocationCheckpointEntryForStatement(raw []byte) (RevocationCheckpointEntry, error)

RevocationCheckpointEntryForStatement validates one statement and derives the exact cumulative-checkpoint identity for its RFC 8785 bytes. The current profile records its statement data-format identity explicitly; the retained v1alpha1 profile omits it because that published entry shape is immutable.

type RevocationCheckpointPin 

type RevocationCheckpointPin struct {
	CheckpointAPIVersion string `json:"checkpointApiVersion,omitempty"`
	Sequence             uint64 `json:"sequence"`
	Digest               string `json:"digest"`
	EntriesDigest        string `json:"entriesDigest"`
}

RevocationCheckpointPin is the minimum durable state a host retains after cryptographically verifying a checkpoint signature and publisher policy. CheckpointAPIVersion is omitted only on retained v1alpha1 pins whose historical JSON shape predates profile binding. Current pins carry the exact checkpoint data-format identity so a caller cannot splice profiles.

func AdvanceRevocationCheckpoint 

func AdvanceRevocationCheckpoint(previous *RevocationCheckpointPin, raw []byte) (RevocationCheckpointPin, error)

AdvanceRevocationCheckpoint verifies monotonic continuity against a host's last trusted pin and returns the new pin. Callers must first verify the checkpoint's Sigstore bundle and publisher identity.

type RevocationEffects 

type RevocationEffects struct {
	BlockNewCreateOrUpdate         bool `json:"blockNewCreateOrUpdate"`
	BlockActivation                bool `json:"blockActivation"`
	RetainBytesForObserveAndDelete bool `json:"retainBytesForObserveAndDelete"`
}

type RevocationStatement 

type RevocationStatement struct {
	APIVersion       string            `json:"apiVersion"`
	Kind             string            `json:"kind"`
	Sequence         uint64            `json:"sequence"`
	StatementVersion string            `json:"statementVersion"`
	PackageDigest    string            `json:"packageDigest"`
	FormRef          FormRef           `json:"formRef"`
	ReasonCode       string            `json:"reasonCode"`
	Summary          string            `json:"summary"`
	AdvisoryURL      string            `json:"advisoryUrl,omitempty"`
	IssuedAt         string            `json:"issuedAt"`
	Effects          RevocationEffects `json:"effects"`
}

RevocationStatement is one immutable, append-only security decision for an exact Form Package digest. Deprecation is represented by Form Definition status and must not be encoded as a security revocation.

func ValidateRevocationStatement 

func ValidateRevocationStatement(raw []byte) (RevocationStatement, error)

ValidateRevocationStatement validates one canonicalizable append-only security revocation. Signature and publisher identity verification are deliberately performed by the release/host trust layer, not by this parser.

type StandardServiceRef 

type StandardServiceRef struct {
	APIVersion string `json:"apiVersion"`
	Protocol   string `json:"protocol"`
}

StandardServiceRef is one exact opaque protocol identity.

type VerificationReport 

type VerificationReport struct {
	PackageDigest string  `json:"packageDigest"`
	FormRef       FormRef `json:"formRef"`
	FileCount     int     `json:"fileCount"`
	PayloadBytes  int64   `json:"payloadBytes"`
	// contains filtered or unexported fields
}

func VerifyDirectory 

func VerifyDirectory(root string) (VerificationReport, error)

VerifyDirectory verifies a complete local Form Package without network I/O or code execution. The directory must contain package-index.json plus exactly the regular, non-executable payload files listed by that index. Supported Unix systems open payloads relative to a held root descriptor without following symlinks. Other systems require an immutable staging directory while this function runs; metadata fences are defense in depth, not an atomic snapshot.

func VerifyFS 

func VerifyFS(source fs.FS, root string) (VerificationReport, error)

VerifyFS verifies one complete Form Package rooted in an immutable fs.FS. It exists for build-time embedded package closures: callers do not need a repository-relative path, and successful verification still issues the same non-forgeable VerifiedPackage capability as VerifyDirectory.

The fs.FS must remain immutable for the duration of this call. VerifyFS inventories the closure before and after bounded reads, rejects links, special or executable files and escaping paths, and stages only those copied bytes into a private temporary directory. VerifyDirectory then performs the one complete package/index/schema/fixture/content verification. The staging directory is removed before a capability is returned; a verification or cleanup failure returns a zero report and therefore no partial capability.

func (VerificationReport) VerifiedPackage 

func (report VerificationReport) VerifiedPackage() (VerifiedPackage, bool)

VerifiedPackage returns the package capability attached to a successful VerifyDirectory report. Reports built by callers or decoded from JSON never carry issuance state and therefore return false.

type VerifiedPackage 

type VerifiedPackage struct {
	// contains filtered or unexported fields
}

VerifiedPackage is the immutable capability issued by VerifyDirectory after it has verified a complete Form Package closure. Its zero value is invalid; callers cannot construct a valid value because the issuance state is package-private and is never serialized through VerificationReport.

The value is intentionally small and copyable. The data it points at is immutable after issuance, and every method returns a defensive copy at the public seam.

func (VerifiedPackage) Definition 

func (packageValue VerifiedPackage) Definition() []byte

Definition returns a defensive copy of the canonical Form Definition bytes.

func (VerifiedPackage) Files 

func (packageValue VerifiedPackage) Files() []PackageFile

Files returns a defensive copy of the validated payload file inventory.

func (VerifiedPackage) FormRef 

func (packageValue VerifiedPackage) FormRef() FormRef

FormRef returns the verified exact Form identity.

func (VerifiedPackage) PackageDigest 

func (packageValue VerifiedPackage) PackageDigest() string

PackageDigest returns the verified canonical package-index digest.

func (VerifiedPackage) PackageIndex 

func (packageValue VerifiedPackage) PackageIndex() PackageIndex

PackageIndex returns a defensive copy of the validated package index.

func (VerifiedPackage) Payload 

func (packageValue VerifiedPackage) Payload(relativePath string) ([]byte, bool)

Payload returns a defensive copy of one verified payload by its canonical package-relative path. The package index remains the source of file metadata; this method returns only bytes and whether the path is listed.

func (VerifiedPackage) RevalidateDefinition 

func (packageValue VerifiedPackage) RevalidateDefinition() (FormDefinition, error)

RevalidateDefinition rechecks the canonical Definition carried by a verifier-issued package under the schema profile selected by that package's immutable envelope identity. Publisher and Form group names never affect the profile. An invalid or caller-constructed package capability is refused.

func (VerifiedPackage) Valid 

func (packageValue VerifiedPackage) Valid() bool

Valid reports whether this value was issued by VerifyDirectory.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.