chains

Documentation

Index

• Constants
• func AddAnnotation(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, ...) error
• func AddRetry(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, ...) error
• func HandleRetry(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, ...) error
• func MarkFailed(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, ...) error
• func MarkSigned(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, ...) error
• func Reconciled(ctx context.Context, client versioned.Interface, obj objects.TektonObject) bool
• func RetryAvailable(obj objects.TektonObject) bool
• type MetricsRecorder
• type ObjectSigner
  • func (o *ObjectSigner) Sign(ctx context.Context, tektonObj objects.TektonObject) error
• type Signer
• type TaskRunVerifier
  • func (tv *TaskRunVerifier) VerifyTaskRun(ctx context.Context, tr *v1.TaskRun) error
• type Verifier

Constants

const (
	// ChainsAnnotation is the standard annotation to indicate a TR has been signed.
	ChainsAnnotation             = "chains.tekton.dev/signed"
	RetryAnnotation              = "chains.tekton.dev/retries"
	ChainsTransparencyAnnotation = "chains.tekton.dev/transparency"
	MaxRetries                   = 3
)

const (
	SignedMessagesCount     = "sgcount"
	SignsStoredCount        = "stcount"
	PayloadUploadeCount     = "plcount"
	MarkedAsSignedCount     = "mrcount"
	PipelineRunSignedName   = "pipelinerun_sign_created_total"
	PipelineRunSignedDesc   = "Total number of signed messages for pipelineruns"
	PipelineRunUploadedName = "pipelinerun_payload_uploaded_total"
	PipelineRunUploadedDesc = "Total number of uploaded payloads for pipelineruns"
	PipelineRunStoredName   = "pipelinerun_payload_stored_total"
	PipelineRunStoredDesc   = "Total number of stored payloads for pipelineruns"
	PipelineRunMarkedName   = "pipelinerun_marked_signed_total"
	PipelineRunMarkedDesc   = "Total number of objects marked as signed for pipelineruns"
	TaskRunSignedName       = "taskrun_sign_created_total"
	TaskRunSignedDesc       = "Total number of signed messages for taskruns"
	TaskRunUploadedName     = "taskrun_payload_uploaded_total"
	TaskRunUploadedDesc     = "Total number of uploaded payloads for taskruns"
	TaskRunStoredName       = "taskrun_payload_stored_total"
	TaskRunStoredDesc       = "Total number of stored payloads for taskruns"
	TaskRunMarkedName       = "taskrun_marked_signed_total"
	TaskRunMarkedDesc       = "Total number of objects marked as signed for taskruns"
)

const (
	RekorAnnotation = "chains.tekton.dev/transparency-upload"
)

Functions

func AddAnnotation

func AddAnnotation(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, key, value string, annotations map[string]string) error

func AddRetry

func AddRetry(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, annotations map[string]string) error

func HandleRetry

func HandleRetry(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, annotations map[string]string) error

func MarkFailed

func MarkFailed(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, annotations map[string]string) error

func MarkSigned

func MarkSigned(ctx context.Context, obj objects.TektonObject, ps versioned.Interface, annotations map[string]string) error

MarkSigned marks a Tekton object as signed.

func Reconciled

func Reconciled(ctx context.Context, client versioned.Interface, obj objects.TektonObject) bool

Reconciled determines whether a Tekton object has already been reconciled. It first inspects the state of the given TektonObject. If that indicates it has not been reconciled, then Reconciled fetches the latest version of the TektonObject from the cluster and inspects that version as well. This aims to avoid creating multiple attestations due to a stale cached TektonObject.

func RetryAvailable

func RetryAvailable(obj objects.TektonObject) bool

Types

type MetricsRecorder

type MetricsRecorder interface {
	RecordCountMetrics(ctx context.Context, MetricType string)
}

type ObjectSigner

type ObjectSigner struct {
	// Backends: store payload and signature
	// The keys are different storage option's name. {docdb, gcs, grafeas, oci, tekton}
	// The values are the actual storage backends that will be used to store and retrieve provenance.
	Backends          map[string]storage.Backend
	SecretPath        string
	Pipelineclientset versioned.Interface
	// Metrics Recorder config
	Recorder MetricsRecorder
}

func (*ObjectSigner) Sign

func (o *ObjectSigner) Sign(ctx context.Context, tektonObj objects.TektonObject) error

Signs TaskRun and PipelineRun objects, as well as generates attesations for each Follows process of extract payload, sign payload, store payload and signature

type Signer

type Signer interface {
	Sign(ctx context.Context, obj objects.TektonObject) error
}

type TaskRunVerifier

type TaskRunVerifier struct {
	KubeClient        kubernetes.Interface
	Pipelineclientset versioned.Interface
	SecretPath        string
}

func (*TaskRunVerifier) VerifyTaskRun

func (tv *TaskRunVerifier) VerifyTaskRun(ctx context.Context, tr *v1.TaskRun) error

type Verifier

type Verifier interface {
	VerifyTaskRun(ctx context.Context, tr *v1.TaskRun) error
}