attestation

Documentation

Index

• Constants
• func AttestorOptions(nameOrType string) []registry.Configurer
• func FactoryByName(name string) (registry.FactoryFunc[Attestor], bool)
• func FactoryByType(uri string) (registry.FactoryFunc[Attestor], bool)
• func RegisterAttestation(name, predicateType string, run RunType, ...)
• func RegistrationEntries() []registry.Entry[Attestor]
• type AttestationContext
  • func NewContext(attestors []Attestor, opts ...AttestationContextOption) (*AttestationContext, error)
  • func (ctx *AttestationContext) CompletedAttestors() []CompletedAttestor
  • func (ctx *AttestationContext) Context() context.Context
  • func (ctx *AttestationContext) Hashes() []crypto.Hash
  • func (ctx *AttestationContext) Materials() map[string]cryptoutil.DigestSet
  • func (ctx *AttestationContext) Products() map[string]Product
  • func (ctx *AttestationContext) RunAttestors() error
  • func (ctx *AttestationContext) WorkingDir() string
• type AttestationContextOption
  • func WithContext(ctx context.Context) AttestationContextOption
  • func WithHashes(hashes []crypto.Hash) AttestationContextOption
  • func WithWorkingDir(workingDir string) AttestationContextOption
• type Attestor
  • func Attestors(nameOrTypes []string) ([]Attestor, error)
  • func GetAttestor(nameOrType string) (Attestor, error)
  • func GetAttestors(nameOrTypes []string) ([]Attestor, error)
• type BackReffer
• type Collection
  • func NewCollection(name string, attestors []CompletedAttestor) Collection
  • func (c *Collection) Artifacts() map[string]cryptoutil.DigestSet
  • func (c *Collection) BackRefs() map[string]cryptoutil.DigestSet
  • func (c *Collection) Materials() map[string]cryptoutil.DigestSet
  • func (c *Collection) Subjects() map[string]cryptoutil.DigestSet
• type CollectionAttestation
  • func NewCollectionAttestation(completed CompletedAttestor) CollectionAttestation
  • func (c *CollectionAttestation) UnmarshalJSON(data []byte) error
• type CompletedAttestor
• type ErrAttestationNotFound
  • func (e ErrAttestationNotFound) Error() string
• type ErrAttestorNotFound
  • func (e ErrAttestorNotFound) Error() string
• type ErrInvalidOption
  • func (e ErrInvalidOption) Error() string
• type Materialer
• type Producer
• type Product
• type RunType
  • func (r RunType) String() string
• type Subjecter

Constants

const CollectionType = "https://witness.testifysec.com/attestation-collection/v0.1"

Functions

func AttestorOptions

func AttestorOptions(nameOrType string) []registry.Configurer

func FactoryByName

func FactoryByName(name string) (registry.FactoryFunc[Attestor], bool)

func FactoryByType

func FactoryByType(uri string) (registry.FactoryFunc[Attestor], bool)

func RegisterAttestation

func RegisterAttestation(name, predicateType string, run RunType, factoryFunc registry.FactoryFunc[Attestor], opts ...registry.Configurer)

func RegistrationEntries

func RegistrationEntries() []registry.Entry[Attestor]

Types

type AttestationContext

type AttestationContext struct {
	// contains filtered or unexported fields
}

func NewContext

func NewContext(attestors []Attestor, opts ...AttestationContextOption) (*AttestationContext, error)

func (*AttestationContext) CompletedAttestors

func (ctx *AttestationContext) CompletedAttestors() []CompletedAttestor

func (*AttestationContext) Context

func (ctx *AttestationContext) Context() context.Context

func (*AttestationContext) Hashes

func (ctx *AttestationContext) Hashes() []crypto.Hash

func (*AttestationContext) Materials

func (ctx *AttestationContext) Materials() map[string]cryptoutil.DigestSet

func (*AttestationContext) Products

func (ctx *AttestationContext) Products() map[string]Product

func (*AttestationContext) RunAttestors

func (ctx *AttestationContext) RunAttestors() error

func (*AttestationContext) WorkingDir

func (ctx *AttestationContext) WorkingDir() string

type AttestationContextOption

type AttestationContextOption func(ctx *AttestationContext)

func WithContext

func WithContext(ctx context.Context) AttestationContextOption

func WithHashes

func WithHashes(hashes []crypto.Hash) AttestationContextOption

func WithWorkingDir

func WithWorkingDir(workingDir string) AttestationContextOption

type Attestor

type Attestor interface {
	Name() string
	Type() string
	RunType() RunType
	Attest(ctx *AttestationContext) error
}

func Attestors

func Attestors(nameOrTypes []string) ([]Attestor, error)

Deprecated: use AddAttestors instead

func GetAttestor

func GetAttestor(nameOrType string) (Attestor, error)

func GetAttestors

func GetAttestors(nameOrTypes []string) ([]Attestor, error)

type BackReffer

type BackReffer interface {
	BackRefs() map[string]cryptoutil.DigestSet
}

BackReffer allows attestors to indicate which of their subjects are good candidates to find related attestations. For example the git attestor's commit hash subject is a good candidate to find all attestation collections that also refer to a specific git commit.

type Collection

type Collection struct {
	Name         string                  `json:"name"`
	Attestations []CollectionAttestation `json:"attestations"`
}

func NewCollection

func NewCollection(name string, attestors []CompletedAttestor) Collection

func (*Collection) Artifacts

func (c *Collection) Artifacts() map[string]cryptoutil.DigestSet

Artifacts returns a map of digestsets that describe the union of the materials and products from the collection. This essentially gives a view of end state of the files after all the attestors in the collection ran.

func (*Collection) BackRefs

func (c *Collection) BackRefs() map[string]cryptoutil.DigestSet

func (*Collection) Materials

func (c *Collection) Materials() map[string]cryptoutil.DigestSet

func (*Collection) Subjects

func (c *Collection) Subjects() map[string]cryptoutil.DigestSet

type CollectionAttestation

type CollectionAttestation struct {
	Type        string    `json:"type"`
	Attestation Attestor  `json:"attestation"`
	StartTime   time.Time `json:"starttime"`
	EndTime     time.Time `json:"endtime"`
}

func NewCollectionAttestation

func NewCollectionAttestation(completed CompletedAttestor) CollectionAttestation

func (*CollectionAttestation) UnmarshalJSON

func (c *CollectionAttestation) UnmarshalJSON(data []byte) error

type CompletedAttestor

type CompletedAttestor struct {
	Attestor  Attestor
	StartTime time.Time
	EndTime   time.Time
	Error     error
}

type ErrAttestationNotFound

type ErrAttestationNotFound string

func (ErrAttestationNotFound) Error

func (e ErrAttestationNotFound) Error() string

type ErrAttestorNotFound

type ErrAttestorNotFound string

func (ErrAttestorNotFound) Error

func (e ErrAttestorNotFound) Error() string

type ErrInvalidOption

type ErrInvalidOption struct {
	Option string
	Reason string
}

func (ErrInvalidOption) Error

func (e ErrInvalidOption) Error() string

type Materialer

type Materialer interface {
	Materials() map[string]cryptoutil.DigestSet
}

Materialer allows attestors to communicate about materials that were observed while the attestor executed. For example the material attestor records the hashes of all files before a command is run.

type Producer

type Producer interface {
	Products() map[string]Product
}

Producer allows attestors to communicate that some product was created while the attestor executed. For example the product attestor runs after a command run and finds files that did not exist in the working directory prior to the command's execution.

type Product

type Product struct {
	MimeType string               `json:"mime_type"`
	Digest   cryptoutil.DigestSet `json:"digest"`
}

type RunType

type RunType string

const (
	PreMaterialRunType RunType = "prematerial"
	MaterialRunType    RunType = "material"
	ExecuteRunType     RunType = "execute"
	ProductRunType     RunType = "product"
	PostProductRunType RunType = "postproduct"
)

func (RunType) String

func (r RunType) String() string

type Subjecter

type Subjecter interface {
	Subjects() map[string]cryptoutil.DigestSet
}

Subjecter allows attestors to expose bits of information that will be added to the in-toto statement as subjects. External services such as Rekor and Archivista use in-toto subjects as indexes back to attestations.