Internal

internal/app/verify

Package verify owns the CI-side receipt verification use case.

import "github.com/nilstate/scafld/v2/internal/app/verify"

Package verify owns the CI-side receipt verification use case.

Functions

func Run(ctx context.Context, envelope receipt.Envelope, trusted trust.TrustedKeys, policy Policy, ports Ports) (Result, error)

Source: internal/app/verify/verify.go:79

Run verifies every receipt invariant against current reality.

Types

type AcceptanceResult

Source: internal/app/verify/verify.go:59

AcceptanceResult is one observed acceptance rerun result.

type AcceptanceResult struct {
	ID       string
	Status   string
	ExitCode int
}
Fields
  • ID string
  • Status string
  • ExitCode int

type AcceptanceRunner

Source: internal/app/verify/verify.go:21

AcceptanceRunner re-runs recorded acceptance commands.

type AcceptanceRunner interface {
	RunAcceptance(context.Context, []receipt.Acceptance) ([]AcceptanceResult, error)
}
Methods
  • RunAcceptance func(context.Context, []receipt.Acceptance) ([]AcceptanceResult, error)

type AncestryChecker

Source: internal/app/verify/verify.go:26

AncestryChecker verifies base_commit ancestry against the explicit target.

type AncestryChecker interface {
	IsAncestor(context.Context, string, string) (bool, error)
}
Methods
  • IsAncestor func(context.Context, string, string) (bool, error)

type Policy

Source: internal/app/verify/verify.go:66

Policy controls pure verify invariants.

type Policy struct {
	TargetCommit    string
	CI              bool
	MinIndependence string
}
Fields
  • TargetCommit string
  • CI bool
  • MinIndependence string

type Ports

Source: internal/app/verify/verify.go:36

Ports groups the narrow verification ports.

type Ports struct {
	Snapshotter       Snapshotter
	AcceptanceRunner  AcceptanceRunner
	AncestryChecker   AncestryChecker
	SignatureVerifier SignatureVerifier
}
Fields
  • Snapshotter Snapshotter
  • AcceptanceRunner AcceptanceRunner
  • AncestryChecker AncestryChecker
  • SignatureVerifier SignatureVerifier

type Result

Source: internal/app/verify/verify.go:73

Result is the structured verification verdict.

type Result struct {
	Passed bool
	Reason string
}
Fields
  • Passed bool
  • Reason string

type SignatureVerifier

Source: internal/app/verify/verify.go:31

SignatureVerifier verifies detached receipt signatures.

type SignatureVerifier interface {
	Verify(receipt.Envelope, trust.TrustedKeys) error
}
Methods
  • Verify func(receipt.Envelope, trust.TrustedKeys) error

type Snapshot

Source: internal/app/verify/verify.go:51

Snapshot is the recomputed tree state.

type Snapshot struct {
	TreeSHA     string
	BaseCommit  string
	FileDigests map[string]string
	Ignored     []string
}
Fields
  • TreeSHA string
  • BaseCommit string
  • FileDigests map[string]string
  • Ignored []string

type SnapshotInput

Source: internal/app/verify/verify.go:44

SnapshotInput scopes verification fingerprinting.

type SnapshotInput struct {
	Scope        []string
	SnapshotMode string
	BaseRef      string
}
Fields
  • Scope []string
  • SnapshotMode string
  • BaseRef string

type Snapshotter

Source: internal/app/verify/verify.go:16

Snapshotter recomputes the checked-out tree fingerprint.

type Snapshotter interface {
	Snapshot(context.Context, SnapshotInput) (Snapshot, error)
}
Methods
  • Snapshot func(context.Context, SnapshotInput) (Snapshot, error)