client

Documentation

Index

• Variables
• func VerifyFromATCJSON(repo string, sigstoreTrustedRootJSON []byte) (string, error)
• func VerifyFromATCURLJSON(attestationBundleURL, repo string, sigstoreTrustedRootJSON []byte) (string, error)
• func VerifyFromBundleJSON(bundleJSON []byte, repo string, sigstoreTrustedRootJSON []byte) (string, error)
• func VerifyJSON(enclave, repo string, sigstoreTrustedRootJSON []byte) (string, error)
• type GroundTruth
• type Response
• type SecureClient
  • func NewDefaultClient() (*SecureClient, error)
  • func NewPinnedSecureClient(enclave string, codeMeasurement *attestation.Measurement, ...) *SecureClient
  • func NewSecureClient(enclave, repo string) *SecureClient
  • func (s *SecureClient) Enclave() string
  • func (s *SecureClient) Get(url string, headers map[string]string) (*Response, error)
  • func (s *SecureClient) GroundTruth() *GroundTruth
  • func (s *SecureClient) GroundTruthJSON() (string, error)
  • func (s *SecureClient) HTTPClient() (*http.Client, error)
  • func (s *SecureClient) Post(url string, headers map[string]string, body []byte) (*Response, error)
  • func (s *SecureClient) Repo() string
  • func (s *SecureClient) Verify() (*GroundTruth, error)
  • func (s *SecureClient) VerifyFromBundle(bundle *attestation.Bundle) (*GroundTruth, error)
• type TLSBoundRoundTripper
  • func (t *TLSBoundRoundTripper) RoundTrip(r *http.Request) (*http.Response, error)

Variables

var (
	ErrNoTLS              = errors.New("no TLS connection")
	ErrCertMismatch       = errors.New("certificate fingerprint mismatch")
	ErrNoValidCertificate = errors.New("no valid certificate")
)

Functions

func VerifyFromATCJSON

func VerifyFromATCJSON(repo string, sigstoreTrustedRootJSON []byte) (string, error)

VerifyFromATCJSON fetches an attestation bundle from the default ATC endpoint and verifies it. Returns the verification data as a JSON string.

func VerifyFromATCURLJSON

func VerifyFromATCURLJSON(attestationBundleURL, repo string, sigstoreTrustedRootJSON []byte) (string, error)

VerifyFromATCURLJSON fetches an attestation bundle from a custom URL and verifies it. If attestationBundleURL is empty, defaults to https://atc.tinfoil.sh. Returns the verification data as a JSON string.

func VerifyFromBundleJSON

func VerifyFromBundleJSON(bundleJSON []byte, repo string, sigstoreTrustedRootJSON []byte) (string, error)

VerifyFromBundleJSON verifies using a pre-fetched attestation bundle and returns the verification data as a JSON string

func VerifyJSON

func VerifyJSON(enclave, repo string, sigstoreTrustedRootJSON []byte) (string, error)

VerifyJSON verifies an enclave against a repo and returns the verification data as a JSON string

Types

type GroundTruth

type GroundTruth struct {
	EnclaveHost         string                           `json:"enclave_host,omitempty"`
	TLSPublicKey        string                           `json:"tls_public_key,omitempty"`
	HPKEPublicKey       string                           `json:"hpke_public_key,omitempty"`
	Digest              string                           `json:"digest"`
	CodeMeasurement     *attestation.Measurement         `json:"code_measurement"`
	EnclaveMeasurement  *attestation.Measurement         `json:"enclave_measurement"`
	HardwareMeasurement *attestation.HardwareMeasurement `json:"hardware_measurement,omitempty"`
	CodeFingerprint     string                           `json:"code_fingerprint"`
	EnclaveFingerprint  string                           `json:"enclave_fingerprint"`
}

GroundTruth represents the "known good" verified of the enclave

type Response

type Response struct {
	Status     string
	StatusCode int
	Body       []byte
}

type SecureClient

type SecureClient struct {
	// contains filtered or unexported fields
}

func NewDefaultClient

func NewDefaultClient() (*SecureClient, error)

NewDefaultSecureClient creates a new secure client with fallback mechanism. It tries to fetch routers from the router service, attempts to verify each one, and falls back to inference.tinfoil.sh if all routers fail.

func NewPinnedSecureClient

func NewPinnedSecureClient(enclave string, codeMeasurement *attestation.Measurement, hardwareMeasurements []*attestation.HardwareMeasurement) *SecureClient

NewPinnedSecureClient creates a new secure client with a given enclave and fixed measurements

func NewSecureClient

func NewSecureClient(enclave, repo string) *SecureClient

NewSecureClient creates a new secure client with a given repo and enclave

func (*SecureClient) Enclave

func (s *SecureClient) Enclave() string

Enclave returns the enclave URL

func (*SecureClient) Get

func (s *SecureClient) Get(url string, headers map[string]string) (*Response, error)

Get makes an HTTP GET request

func (*SecureClient) GroundTruth

func (s *SecureClient) GroundTruth() *GroundTruth

GroundTruth returns the last verified enclave state

func (*SecureClient) GroundTruthJSON

func (s *SecureClient) GroundTruthJSON() (string, error)

GroundTruthJSON returns the ground truth as a JSON string

func (*SecureClient) HTTPClient

func (s *SecureClient) HTTPClient() (*http.Client, error)

HTTPClient returns an HTTP client that only accepts TLS connections to the verified enclave

func (*SecureClient) Post

func (s *SecureClient) Post(url string, headers map[string]string, body []byte) (*Response, error)

Post makes an HTTP POST request

func (*SecureClient) Repo

func (s *SecureClient) Repo() string

Repo returns the repository URL

func (*SecureClient) Verify

func (s *SecureClient) Verify() (*GroundTruth, error)

Verify fetches the latest verification information from GitHub and Sigstore and stores the ground truth results in the client

func (*SecureClient) VerifyFromBundle

func (s *SecureClient) VerifyFromBundle(bundle *attestation.Bundle) (*GroundTruth, error)

VerifyFromBundle verifies using a pre-fetched attestation bundle from ATC (single-request verification)

type TLSBoundRoundTripper

type TLSBoundRoundTripper struct {
	ExpectedPublicKey string
}

func (*TLSBoundRoundTripper) RoundTrip

func (t *TLSBoundRoundTripper) RoundTrip(r *http.Request) (*http.Response, error)