Documentation
¶
Overview ¶
Package trust implements a trust-on-first-use (TOFU) approval gate for env-starter config files.
A command's run/setup/teardown/readiness.shell fields are executed verbatim as shell scripts by design (see SECURITY.md) — this package does not sanitize them, and never will. What it defends against is a config or overlay file that was tampered with or slipped in without the operator's knowledge: it hashes each config file's raw bytes and refuses to load a config unless every watched file's current hash has been explicitly approved (via the `allow` subcommand). Approval is invalidated the moment a file's content changes, so a later edit — malicious or not — always requires a fresh review.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Approve ¶
Approve hashes each non-empty path in paths and records it as approved. Call this only after the operator has reviewed what the config will execute (see the `allow` subcommand) — Approve itself does not show or check anything, it just records trust.
func Check ¶
Check verifies that every non-empty path in paths has been approved at its current content hash. It returns a *NotApprovedError for the first path that is unapproved or has changed since approval. A path that cannot be read (e.g. it does not exist) fails with the underlying error instead — callers may want to handle that case differently (e.g. cmd/env-starter's "no config file found" hint on first run).
Types ¶
type NotApprovedError ¶
NotApprovedError reports that Path has not been approved, or has changed since it was approved, and must be reviewed via `env-starter allow`.
func (*NotApprovedError) Error ¶
func (e *NotApprovedError) Error() string
type PathStatus ¶
type PathStatus struct {
Path string
CurrentHash string
ApprovedHash string // "" if never approved
Approved bool // true when CurrentHash == ApprovedHash
}
PathStatus reports the approval state of a single config path, used to render the `allow` subcommand's preview.
func Status ¶
func Status(paths []string) ([]PathStatus, error)
Status reports the current approval state of each non-empty path in paths. It fails outright if any path cannot be hashed (e.g. it does not exist) — that is a "no such file" error, not an approval decision.
Source Files