git-attest 1.6.0

Sign and verify attestations that a test suite already passed on a tree, so CI can skip it: the library and its command line
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

//! `git-attest`: the one implementation of the attestation format (SPEC.md,
//! decisions ADR-0037). Producers and verifiers call this library; the
//! `git-attest` binary is a thin command line over it.
//!
//! Each module owns one piece of the format and hides it:
//!
//! - [`format`]: the payload's fields, a note's blocks, the shared names;
//! - [`spec`]: the `attest-inputs` declaration and the canonical opt-out;
//! - [`fingerprint`]: input fingerprints, the canonical tree, their note keys;
//! - [`sign`]: `ssh-keygen -Y`, for any namespace;
//! - [`notes`]: the notes refs as origin's mirror, and publishing to them;
//! - [`produce`]: what a producer signs for the gates that passed on a tree;
//! - [`verify`]: what a valid attestation covers.
//!
//! Every entry point takes the repository it acts on as a path and never
//! reads the process's working directory, and nothing here prints: callers
//! render what the library returns.
//!
//! No dependencies, and that is load-bearing (see Cargo.toml).

pub mod fingerprint;
pub mod format;
pub mod notes;
pub mod produce;
pub mod sign;
pub mod spec;
pub mod verify;

mod git;

#[cfg(test)]
mod tests;