Reference¶
The Go API — types, functions, signatures — is published at pkg.go.dev/gitlab.com/phpboyscout/go/artifacts and its trust subpackage. That page is generated from the source, so it cannot drift; nothing here duplicates it.
What lives here is the part pkg.go.dev cannot describe: the shape of the channel this package talks to, and the bounds it operates within.
In this section¶
- Channel layout — URL structure, manifest format, signature format
- Limits and defaults — timeouts, size ceilings, paths and modes
Sentinel errors¶
Four, matched with errors.Is. What to do about each is in
Handle failures.
| Error | Means |
|---|---|
ErrNotFound |
no such artefact-version, or no such file in its manifest |
ErrUnverified |
bytes arrived and could not be trusted — bad signature or bad digest, deliberately not distinguished |
ErrMalformedManifest |
signature good, contents are not a manifest — a broken publisher, not an attack |
Configuration mistakes — no verifier, no cache — return plain errors rather than sentinels. A caller branching on those is branching on its own bug.