provutil

Documentation

Index

• Variables
• func DecodeBundle(bundle io.Reader, handler func(env *provenance.Envelope) error) error
• type Assertion
  • func AssertBuiltWithGorpaVersion(version string) *Assertion
  • func AssertSignedWith(key in_toto.Key) *Assertion
• type Assertions
  • func (a Assertions) AssertEnvelope(env *provenance.Envelope) (failed []Violation)
  • func (a Assertions) AssertStatement(stmt *provenance.Statement) (failed []Violation)
• type Violation
  • func (v Violation) String() string

Variables

var AssertBuiltWithGorpa = &Assertion{
	Name:        "built-with-gorpa",
	Description: "ensures all bundle entries have been built with Bhojpur GoRPA",
	Run: func(stmt *provenance.Statement) []Violation {
		if strings.HasPrefix(stmt.Predicate.Builder.ID, gorpa.ProvenanceBuilderID) {
			return nil
		}

		return []Violation{
			{Desc: "was not built using Bhojpur GoRPA"},
		}
	},
}

var AssertGitMaterialOnly = &Assertion{
	Name:        "git-material-only",
	Description: "ensures all subjects were built from Git material only",
	Run: func(stmt *provenance.Statement) []Violation {
		for _, m := range stmt.Predicate.Materials {
			if strings.HasPrefix(m.URI, "git+") || strings.HasPrefix(m.URI, "git://") {
				continue
			}

			return []Violation{{
				Desc: "contains non-Git material, e.g. " + m.URI,
			}}
		}
		return nil
	},
}

Functions

func DecodeBundle

func DecodeBundle(bundle io.Reader, handler func(env *provenance.Envelope) error) error

DecodeBundle returns a function which attempts to decode an attestation bundle from the reader and calls the handler for every envelope found in the bundle. If decoding fails, or the handler returns an error, decoding stops and the error is returned.

Types

type Assertion

type Assertion struct {
	Name        string
	Description string
	Run         func(stmt *provenance.Statement) []Violation
	RunEnvelope func(env *provenance.Envelope) []Violation
}

func AssertBuiltWithGorpaVersion

func AssertBuiltWithGorpaVersion(version string) *Assertion

func AssertSignedWith

func AssertSignedWith(key in_toto.Key) *Assertion

type Assertions

type Assertions []*Assertion

func (Assertions) AssertEnvelope

func (a Assertions) AssertEnvelope(env *provenance.Envelope) (failed []Violation)

func (Assertions) AssertStatement

func (a Assertions) AssertStatement(stmt *provenance.Statement) (failed []Violation)

type Violation

type Violation struct {
	Assertion *Assertion
	Statement *provenance.Statement
	Desc      string
}

func (Violation) String

func (v Violation) String() string