mirror of
https://github.com/vee1e/gittuf.git
synced 2026-09-01 10:18:18 +00:00
9e269f46fb
Restructure storage so gittuf verification can run over backends other
than the git binary (e.g. go-git):
- pkg/githash: concrete Git object hash, stdlib-only.
gitinterface.Hash aliases it.
- pkg/gitstore: the single Storer interface (24 methods) that all
storage consumers program against, plus the shared
ErrReferenceNotFound sentinel. *gitinterface.Repository satisfies it
structurally (compile-time asserted). Also defines ConfigKey, the
canonical type for the Git config settings gittuf reads.
- pkg/rsl (from internal/rsl): entry model, codec, and readers over
gitstore.Storer; zero gitinterface/sigstore dependencies. rsl.Hash
aliases githash.Hash; nil is the unset-Hash sentinel and IsZero
matches nil and empty as well as both format zeros (no
object-format-unaware ZeroHash). Entry commits (empty tree on the
RSL ref) are owned by the package; no storer adapter.
- internal/signerverifier/gitobject: verifies commit/tag signatures
over (payload, signature) bytes, Rekor URL as an option. The storage
half is Repository.GetObjectSignature. Removes sigstore, cosign, and
gitsign from gitinterface's dependency tree.
- internal/propagation: propagation workflow, moved off pkg/rsl's
public API (its tuf directive types are internal).
- internal/{attestations,cache,policy}: storage via gitstore.Storer;
tree writing via WriteTree(blobs, subtrees).
Breaking changes to pkg/gitinterface: Repository.VerifySignature and
the verification sentinels are removed (use gitobject.Verify);
ErrReferenceNotFound now aliases gitstore's. Repository.GetGitConfig
(which returned the whole config map) is replaced by
LookupConfig(gitstore.ConfigKey), returning a single setting's value.
Policy resolves the Rekor override from git config once per
verification and extracts signed payloads once per object instead of
per key attempt.
Assisted-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
49 lines
1.5 KiB
Go
49 lines
1.5 KiB
Go
// Copyright The gittuf Authors
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package gitinterface
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"os/exec"
|
|
"strings"
|
|
|
|
"github.com/gittuf/gittuf/pkg/gitstore"
|
|
)
|
|
|
|
// LookupConfig returns the value of a single Git config setting. ok is false
|
|
// when the key is not set. A key that is set to an empty value returns "" with
|
|
// ok true, matching `git config --get`, which exits 0 for a set-but-empty key
|
|
// and 1 for an unset one.
|
|
func (r *Repository) LookupConfig(key gitstore.ConfigKey) (string, bool, error) {
|
|
stdOut, stdErr, err := r.executor("config", "--get", string(key)).execute()
|
|
if err != nil {
|
|
var exitErr *exec.ExitError
|
|
if errors.As(err, &exitErr) && exitErr.ExitCode() == 1 {
|
|
return "", false, nil
|
|
}
|
|
stdErrContents, readErr := io.ReadAll(stdErr)
|
|
if readErr != nil {
|
|
return "", false, fmt.Errorf("unable to read Git config key '%s': %w", key, err)
|
|
}
|
|
return "", false, fmt.Errorf("unable to read Git config key '%s': %w: %s", key, err, strings.TrimSpace(string(stdErrContents)))
|
|
}
|
|
|
|
value, err := io.ReadAll(stdOut)
|
|
if err != nil {
|
|
return "", false, fmt.Errorf("unable to read Git config value for '%s': %w", key, err)
|
|
}
|
|
|
|
return strings.TrimSpace(string(value)), true, nil
|
|
}
|
|
|
|
// SetGitConfig sets the specified key to the value locally for a repository.
|
|
func (r *Repository) SetGitConfig(key, value string) error {
|
|
if _, err := r.executor("config", "--local", key, value).executeString(); err != nil {
|
|
return fmt.Errorf("unable to set '%s' to '%s': %w", key, value, err)
|
|
}
|
|
|
|
return nil
|
|
}
|