Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

register

package module

Go to main page

Versions in this module

v0

v0.7.0

Sep 22, 2026

v0.6.0

Sep 16, 2026

v0.5.0

Sep 15, 2026

v0.4.0

Sep 14, 2026

v0.3.0

Sep 14, 2026

v0.2.0

Sep 12, 2026

Changes in this version

+ func BackfillParamsSchemaDigests(data []byte) ([]byte, error)

+ func ValidateSchemeParams(scheme, capability string, raw json.RawMessage) error

+ func VerifyCapabilityPKCS7Cert(capPath string, trustRoots []*x509.Certificate) (*x509.Certificate, error)

type CapabilityClaim

+ SchemeVersion string

type Registry

+ func (r *Registry) ValidateParams(scheme, capability string, params map[string]any) error

v0.1.0

Aug 24, 2026

Changes in this version

+ var Version = "0.1.0"

+ func Deduplicate(caps []string) []string

+ func FilterByScheme(caps []string, schemeID string) []string

+ func FormatCapability(schemeID, capID string) string

+ func FormatSchemeID(vendor, product string) string

+ func GenAuthzToFile(cfg GenAuthzConfig, outputPath string) error

+ func GenDocs(def *SchemeDefinition) (string, error)

+ func GenDocsToFile(def *SchemeDefinition, outputPath string) error

+ func GetSignerCert(p7sPath string) (*x509.Certificate, error)

+ func HasSignature(capPath string) bool

+ func ListCapabilities(def *SchemeDefinition) []string

+ func LoadAllSchemes(root string) (map[string]*SchemeDefinition, error)

+ func LoadCertFile(path string) ([]*x509.Certificate, error)

+ func LoadEmbedded() (map[string]*SchemeDefinition, error)

+ func LoadFromBoth(diskDir string) (map[string]*SchemeDefinition, error)

+ func LoadFromDir(root string) (map[string]*SchemeDefinition, error)

+ func LoadFromFS(fsys fs.FS) (map[string]*SchemeDefinition, error)

+ func LoadTrustRoots(path string) ([]*x509.Certificate, error)

+ func MatchCapability(id, pattern string) bool

+ func ParseCapability(s string) (schemeID, capID string, ok bool)

+ func ParseSchemeID(schemeID string) (vendor, product string, ok bool)

+ func SignCapability(certPath, keyPath, capPath, outputPath string) error

+ func ValidateSchemeID(schemeID string) error

+ func VerifyCapabilityPKCS7(capPath string, trustRoots []*x509.Certificate) error

+ func WriteScheme(def *SchemeDefinition, path string) error

+ type AuthzDocument struct

+ CapabilityParameters map[string]map[string]any

+ GatewayNamespaces map[string]GatewayNSDef

+ OUMapping map[string]string

+ Roles map[string]AuthzRoleDef

+ Version string

+ func GenAuthz(cfg GenAuthzConfig) (*AuthzDocument, error)

+ type AuthzRoleDef struct

+ DisplayName string

+ Grants []string

+ Profiles []string

+ Scope []string

+ type CapabilityClaim struct

+ Capability string

+ Parameters map[string]any

+ Rationale string

+ SchemeID string

+ func ParseCapabilityClaims(data []byte) ([]CapabilityClaim, error)

+ type CapabilityEntry struct

+ Description string

+ Examples []string

+ ID string

+ Parameters map[string]ParameterDef

+ ParamsSchema json.RawMessage

+ Related []string

+ Summary string

+ Usage string

+ WhenNot string

+ type ClaimResult struct

+ Claim CapabilityClaim

+ Error string

+ Valid bool

+ type GatewayNSDef struct

+ DisplayName string

+ Grants []string

+ Prefix string

+ type GenAuthzConfig struct

+ NamespacePrefix string

+ SchemePaths []string

+ TrustRootsPEM []string

+ VerifyRequired bool

+ VerifySignature bool

+ Version string

+ type MinSetReport struct

+ AllowedPatterns []string

+ InvalidClaims []ClaimResult

+ IsMinimal bool

+ MissingGranted []string

+ RedundantClaims []ClaimResult

+ ValidClaims []CapabilityClaim

+ type ParameterDef struct

+ Default interface{}

+ Description string

+ Enum []string

+ Max interface{}

+ Min interface{}

+ Required bool

+ Type string

+ type Registry struct

+ func NewRegistry() *Registry

+ func NewRegistryFromBoth(diskDir string) (*Registry, error)

+ func NewRegistryFromDisk(dir string) (*Registry, error)

+ func NewRegistryWithEmbedded() (*Registry, error)

+ func (r *Registry) CheckIntersection(setA, setB []string) (common []string)

+ func (r *Registry) CheckMinimalCapabilitySet(claims []CapabilityClaim, grantedPatterns []string) *MinSetReport

+ func (r *Registry) CheckSubset(declared, allowed []string) (denied []string)

+ func (r *Registry) Get(schemeID string) (*SchemeDefinition, bool)

+ func (r *Registry) Has(schemeID string) bool

+ func (r *Registry) HasCapability(schemeID, capID string) bool

+ func (r *Registry) Register(def *SchemeDefinition)

+ func (r *Registry) RoleGrantCovered(schemeID, grant string) bool

+ func (r *Registry) SchemeIDs() []string

+ func (r *Registry) Summary() string

+ func (r *Registry) ValidateCapabilities(caps []string) *ValidationResult

+ func (r *Registry) ValidateCapability(formatted string) (*SchemeDefinition, *CapabilityEntry, error)

+ func (r *Registry) ValidateClaims(claims []CapabilityClaim) []ClaimResult

+ func (r *Registry) ValidateRoles(schemeID string) ([]string, error)

+ type RoleDef struct

+ DisplayName string

+ Grants []string

+ OUs []string

+ Profiles []string

+ type SchemeDefinition struct

+ Author string

+ Capabilities []CapabilityEntry

+ Description string

+ Homepage string

+ License string

+ Name string

+ Product string

+ Roles map[string]RoleDef

+ SchemeID string

+ Vendor string

+ Version string

+ func LoadScheme(path string) (*SchemeDefinition, error)

+ func (def *SchemeDefinition) ValidateSchemeRoles() ([]error, []string)

+ type ValidationError struct

+ Field string

+ Message string

+ func (e ValidationError) Error() string

+ type ValidationResult struct

+ Checked int

+ Errors []ValidationError

+ Valid bool

+ Warnings []string