client

Documentation

Index

• Variables
• func VerifyJSON(enclave, repo string) (string, error)
• type GroundTruth
• type Response
• type Router
  • func NewRouter() *Router
  • func (r *Router) Client() (*SecureClient, error)
  • func (r *Router) GetRouter() (string, error)
• type SecureClient
  • func NewDefaultClient() (*SecureClient, error)
  • func NewPinnedSecureClient(enclave string, codeMeasurement *attestation.Measurement, ...) *SecureClient
  • func NewSecureClient(enclave, repo string) *SecureClient
  • func (s *SecureClient) Enclave() string
  • func (s *SecureClient) Get(url string, headers map[string]string) (*Response, error)
  • func (s *SecureClient) GroundTruth() *GroundTruth
  • func (s *SecureClient) GroundTruthJSON() (string, error)
  • func (s *SecureClient) HTTPClient() (*http.Client, error)
  • func (s *SecureClient) Post(url string, headers map[string]string, body []byte) (*Response, error)
  • func (s *SecureClient) Repo() string
  • func (s *SecureClient) Verify() (*GroundTruth, error)
• type TLSBoundRoundTripper
  • func (t *TLSBoundRoundTripper) RoundTrip(r *http.Request) (*http.Response, error)

Variables

var (
	ErrNoTLS              = errors.New("no TLS connection")
	ErrCertMismatch       = errors.New("certificate fingerprint mismatch")
	ErrNoValidCertificate = errors.New("no valid certificate")
)

Functions

func VerifyJSON

func VerifyJSON(enclave, repo string) (string, error)

VerifyJSON verifies an enclave against a repo and returns the verification data as a JSON string

Types

type GroundTruth

type GroundTruth struct {
	TLSPublicKey        string                           `json:"tls_public_key,omitempty"`
	HPKEPublicKey       string                           `json:"hpke_public_key,omitempty"`
	Digest              string                           `json:"digest"`
	CodeMeasurement     *attestation.Measurement         `json:"code_measurement"`
	EnclaveMeasurement  *attestation.Measurement         `json:"enclave_measurement"`
	HardwareMeasurement *attestation.HardwareMeasurement `json:"hardware_measurement,omitempty"`
	CodeFingerprint     string                           `json:"code_fingerprint"`
	EnclaveFingerprint  string                           `json:"enclave_fingerprint"`
}

GroundTruth represents the "known good" verified of the enclave

type Response

type Response struct {
	Status     string
	StatusCode int
	Body       []byte
}

type Router

type Router struct {
	// contains filtered or unexported fields
}

func NewRouter

func NewRouter() *Router

func (*Router) Client

func (r *Router) Client() (*SecureClient, error)

func (*Router) GetRouter

func (r *Router) GetRouter() (string, error)

type SecureClient

type SecureClient struct {
	// contains filtered or unexported fields
}

func NewDefaultClient

func NewDefaultClient() (*SecureClient, error)

NewDefaultClient creates a new secure client using the default router

func NewPinnedSecureClient

func NewPinnedSecureClient(enclave string, codeMeasurement *attestation.Measurement, hardwareMeasurements []*attestation.HardwareMeasurement) *SecureClient

func NewSecureClient

func NewSecureClient(enclave, repo string) *SecureClient

func (*SecureClient) Enclave

func (s *SecureClient) Enclave() string

Enclave returns the enclave URL

func (*SecureClient) Get

func (s *SecureClient) Get(url string, headers map[string]string) (*Response, error)

Get makes an HTTP GET request

func (*SecureClient) GroundTruth

func (s *SecureClient) GroundTruth() *GroundTruth

GroundTruth returns the last verified enclave state

func (*SecureClient) GroundTruthJSON

func (s *SecureClient) GroundTruthJSON() (string, error)

GroundTruthJSON returns the ground truth as a JSON string

func (*SecureClient) HTTPClient

func (s *SecureClient) HTTPClient() (*http.Client, error)

HTTPClient returns an HTTP client that only accepts TLS connections to the verified enclave

func (*SecureClient) Post

func (s *SecureClient) Post(url string, headers map[string]string, body []byte) (*Response, error)

Post makes an HTTP POST request

func (*SecureClient) Repo

func (s *SecureClient) Repo() string

Repo returns the repository URL

func (*SecureClient) Verify

func (s *SecureClient) Verify() (*GroundTruth, error)

Verify fetches the latest verification information from GitHub and Sigstore and stores the ground truth results in the client

type TLSBoundRoundTripper

type TLSBoundRoundTripper struct {
	ExpectedPublicKey string
}

func (*TLSBoundRoundTripper) RoundTrip

func (t *TLSBoundRoundTripper) RoundTrip(r *http.Request) (*http.Response, error)