tlog

README

tlog

This package implements transparency logging.

Documentation

Index

• Constants
• func CreateX509Cert(subject string, signer dsse.SignerVerifier) ([]byte, error)
• func WithTUFDownloader(tufDownloader tuf.Downloader) func(*Rekor)
• func WithTUFPublicKeysDir(dir string) func(*Rekor)
• type DockerTLExtension
• type MockTransparencyLog
  • func (tl *MockTransparencyLog) UploadEntry(ctx context.Context, subject string, payload, signature []byte, ...) (*DockerTLExtension, error)
  • func (tl *MockTransparencyLog) VerifyEntry(ctx context.Context, ext *DockerTLExtension, payload, publicKey []byte) (time.Time, error)
• type Payload
• type Rekor
  • func NewRekorLog(options ...func(*Rekor)) (*Rekor, error)
  • func (tl *Rekor) UnmarshalEntry(entry []byte) (*models.LogEntryAnon, error)
  • func (tl *Rekor) UploadEntry(ctx context.Context, subject string, encPayload, signature []byte, ...) (*DockerTLExtension, error)
  • func (tl *Rekor) VerifyEntry(ctx context.Context, ext *DockerTLExtension, encPayload, publicKey []byte) (time.Time, error)
  • func (tl *Rekor) VerifyEntryPayload(entry *models.LogEntryAnon, payload, publicKey []byte) error
• type TransparencyLog
  • func GetMockTL() TransparencyLog

Constants

const (
	UseMockTL = true

	TestEntry = `` /* 3051-byte string literal not displayed */
)

const (
	DefaultRekorURL = "https://rekor.sigstore.dev"
)

const RekorTLExtKind = "Rekor"

Functions

func CreateX509Cert

func CreateX509Cert(subject string, signer dsse.SignerVerifier) ([]byte, error)

CreateX509Cert generates a self-signed x509 cert for TL submission.

func WithTUFDownloader

func WithTUFDownloader(tufDownloader tuf.Downloader) func(*Rekor)

func WithTUFPublicKeysDir

func WithTUFPublicKeysDir(dir string) func(*Rekor)

Types

type DockerTLExtension

type DockerTLExtension struct {
	Kind string `json:"kind"`
	Data any    `json:"data"`
}

type MockTransparencyLog

type MockTransparencyLog struct {
	UploadLogEntryFunc func(ctx context.Context, subject string, payload, signature []byte, signer dsse.SignerVerifier) (*DockerTLExtension, error)
	VerifyLogEntryFunc func(ctx context.Context, ext *DockerTLExtension, payload, publicKey []byte) (time.Time, error)
}

func (*MockTransparencyLog) UploadEntry

func (tl *MockTransparencyLog) UploadEntry(ctx context.Context, subject string, payload, signature []byte, signer dsse.SignerVerifier) (*DockerTLExtension, error)

func (*MockTransparencyLog) VerifyEntry

func (tl *MockTransparencyLog) VerifyEntry(ctx context.Context, ext *DockerTLExtension, payload, publicKey []byte) (time.Time, error)

type Payload

type Payload struct {
	Algorithm string
	Hash      string
	Signature string
	PublicKey string
}

type Rekor

type Rekor struct {
	// contains filtered or unexported fields
}

func NewRekorLog

func NewRekorLog(options ...func(*Rekor)) (*Rekor, error)

func (*Rekor) UnmarshalEntry

func (tl *Rekor) UnmarshalEntry(entry []byte) (*models.LogEntryAnon, error)

func (*Rekor) UploadEntry

func (tl *Rekor) UploadEntry(ctx context.Context, subject string, encPayload, signature []byte, signer dsse.SignerVerifier) (*DockerTLExtension, error)

UploadEntry submits a PK token signature to the transparency log.

func (*Rekor) VerifyEntry

func (tl *Rekor) VerifyEntry(ctx context.Context, ext *DockerTLExtension, encPayload, publicKey []byte) (time.Time, error)

VerifyEntry verifies a transparency log entry.

func (*Rekor) VerifyEntryPayload

func (tl *Rekor) VerifyEntryPayload(entry *models.LogEntryAnon, payload, publicKey []byte) error

VerifyEntryPayload checks that the TL entry payload matches envelope payload.

type TransparencyLog

type TransparencyLog interface {
	UploadEntry(ctx context.Context, subject string, payload, signature []byte, signer dsse.SignerVerifier) (*DockerTLExtension, error)
	VerifyEntry(ctx context.Context, entry *DockerTLExtension, payload, publicKey []byte) (time.Time, error)
}

func GetMockTL

func GetMockTL() TransparencyLog