feat(corks): Add Go library

.github/workflows/dart.yaml

@@ -13,16 +13,8 @@ concurrency:
 
 jobs:
   test:
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - macos-14
-          - windows-latest
-    runs-on: ${{ matrix.os }}
-    # TODO(dnys1): Speed up Rust builds
-    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Git Checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # 4.1.7
@@ -35,4 +27,4 @@ jobs:
         run: dart pub get
       - name: Test
         working-directory: dart
-        run: dart --enable-experiment=native-assets test --fail-fast
+        run: dart test --fail-fast

.github/workflows/go.yaml

@@ -0,0 +1,29 @@
+name: Go
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/go.yaml"
+      - "go/**"
+
+# Prevent duplicate runs due to Graphite
+# https://graphite.dev/docs/troubleshooting#why-are-my-actions-running-twice
+concurrency:
+  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }}-${{ github.ref == 'refs/heads/main' && github.sha || ''}}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Git Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # 4.1.7
+        with:
+          submodules: true
+      - name: Setup Go
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # 5.0.1
+        with:
+          go-version-file: go/go.mod
+      - name: Test
+        working-directory: go
+        run: go test ./...

buf.gen.yaml

@@ -0,0 +1,24 @@
+version: v2
+managed:
+  enabled: true
+  override:
+    - file_option: go_package
+      value: github.com/celest-dev/corks/go/proto/dart;dartoptionspb
+      path: dart/dart_options.proto
+inputs:
+  - directory: proto
+  - directory: third_party
+    paths:
+      - third_party/dart/dart_options.proto
+plugins:
+  - remote: buf.build/protocolbuffers/dart:v21.1.2
+    include_imports: true
+    include_wkt: true
+    out: dart/lib/src/proto
+    opt: grpc
+  - remote: buf.build/protocolbuffers/go:v1.34.2
+    include_imports: false
+    include_wkt: false
+    out: go/proto
+    opt:
+      - paths=source_relative

buf.yaml

@@ -0,0 +1,13 @@
+version: v2
+modules:
+  - path: proto
+  - path: third_party
+breaking:
+  use:
+    - PACKAGE
+lint:
+  use:
+    - MINIMAL
+  ignore:
+    - third_party
+  disallow_comment_ignores: true

dart/CHANGELOG.md

@@ -1,3 +1,5 @@
+## 0.2.0-wip
+
 ## 0.1.2
 
 - chore: Update repository

dart/lib/src/cork.dart

@@ -7,7 +7,6 @@ import 'dart:typed_data';
 import 'package:cedar/cedar.dart' as cedar;
 import 'package:corks_cedar/corks_proto.dart' as proto;
 import 'package:corks_cedar/src/interop/proto_interop.dart';
-import 'package:corks_cedar/src/proto/google/protobuf/any.pb.dart' as proto;
 import 'package:corks_cedar/src/signer.dart';
 import 'package:crypto/crypto.dart';
 import 'package:meta/meta.dart';
@@ -66,10 +65,8 @@ final class Cork {
   Uint8List encode() => toProto().writeToBuffer();
 
   Future<bool> verify(Signer signer) async {
-    if (Digest(signer.keyId) != Digest(keyId)) {
-      return false;
-    }
     await signer.sign(id);
+    await signer.sign(keyId);
     if (bearer != null) {
       // TODO(dnys1): https://github.com/dart-lang/sdk/issues/54664
       if (!await bearer!.verify(signer)) {
@@ -123,6 +120,7 @@ final class CorkBuilder {
 
   Future<Cork> build(Signer signer) async {
     await signer.sign(_id);
+    await signer.sign(signer.keyId);
 
     SignedBearer? signedBearer;
     if (_bearer case final bearer?) {
@@ -173,15 +171,11 @@ extension type SignedBearer(SignedBlock _block) implements SignedBlock {
       : _block = SignedBlock.fromProto(proto);
 
   Bearer get bearer {
-    final any = proto.Any(
-      typeUrl: typeUrl,
-      value: block,
-    );
     final entity = proto.Entity();
-    if (!any.canUnpackInto(entity)) {
-      throw ArgumentError('Invalid bearer type: $typeUrl');
+    if (!block.canUnpackInto(entity)) {
+      throw ArgumentError('Invalid bearer type: ${block.typeUrl}');
     }
-    any.unpackInto(entity);
+    block.unpackInto(entity);
     return Bearer.entity(
       entity: entity.fromProto(),
     );
@@ -214,15 +208,11 @@ extension type SignedCaveat(SignedBlock _block) implements SignedBlock {
       : _block = SignedBlock.fromProto(proto);
 
   Caveat get caveat {
-    final any = proto.Any(
-      typeUrl: typeUrl,
-      value: block,
-    );
     final policy = proto.Policy();
-    if (!any.canUnpackInto(policy)) {
-      throw ArgumentError('Invalid caveat type: $typeUrl');
+    if (!block.canUnpackInto(policy)) {
+      throw ArgumentError('Invalid caveat type: ${block.typeUrl}');
     }
-    any.unpackInto(policy);
+    block.unpackInto(policy);
     return PolicyCaveat(policy: policy.fromProto());
   }
 }

dart/lib/src/proto/corks/v1/cork.pb.dart

@@ -13,6 +13,8 @@ import 'dart:core' as $core;
 
 import 'package:protobuf/protobuf.dart' as $pb;
 
+import '../../google/protobuf/any.pb.dart' as $4;
+
 class Cork extends $pb.GeneratedMessage {
   factory Cork({
     $core.List<$core.int>? id,
@@ -117,17 +119,13 @@ class Cork extends $pb.GeneratedMessage {
 
 class SignedBlock extends $pb.GeneratedMessage {
   factory SignedBlock({
-    $core.List<$core.int>? block,
-    $core.List<$core.int>? typeUrl,
+    $4.Any? block,
     $core.List<$core.int>? signature,
   }) {
     final $result = create();
     if (block != null) {
       $result.block = block;
     }
-    if (typeUrl != null) {
-      $result.typeUrl = typeUrl;
-    }
     if (signature != null) {
       $result.signature = signature;
     }
@@ -138,9 +136,8 @@ class SignedBlock extends $pb.GeneratedMessage {
   factory SignedBlock.fromJson($core.String i, [$pb.ExtensionRegistry r = $pb.ExtensionRegistry.EMPTY]) => create()..mergeFromJson(i, r);
 
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(_omitMessageNames ? '' : 'SignedBlock', package: const $pb.PackageName(_omitMessageNames ? '' : 'corks.v1'), createEmptyInstance: create)
-    ..a<$core.List<$core.int>>(1, _omitFieldNames ? '' : 'block', $pb.PbFieldType.OY)
-    ..a<$core.List<$core.int>>(2, _omitFieldNames ? '' : 'typeUrl', $pb.PbFieldType.OY)
-    ..a<$core.List<$core.int>>(3, _omitFieldNames ? '' : 'signature', $pb.PbFieldType.OY)
+    ..aOM<$4.Any>(1, _omitFieldNames ? '' : 'block', subBuilder: $4.Any.create)
+    ..a<$core.List<$core.int>>(2, _omitFieldNames ? '' : 'signature', $pb.PbFieldType.OY)
     ..hasRequiredFields = false
   ;
 
@@ -166,31 +163,24 @@ class SignedBlock extends $pb.GeneratedMessage {
   static SignedBlock? _defaultInstance;
 
   @$pb.TagNumber(1)
-  $core.List<$core.int> get block => $_getN(0);
+  $4.Any get block => $_getN(0);
   @$pb.TagNumber(1)
-  set block($core.List<$core.int> v) { $_setBytes(0, v); }
+  set block($4.Any v) { setField(1, v); }
   @$pb.TagNumber(1)
   $core.bool hasBlock() => $_has(0);
   @$pb.TagNumber(1)
   void clearBlock() => clearField(1);
+  @$pb.TagNumber(1)
+  $4.Any ensureBlock() => $_ensure(0);
 
   @$pb.TagNumber(2)
-  $core.List<$core.int> get typeUrl => $_getN(1);
+  $core.List<$core.int> get signature => $_getN(1);
   @$pb.TagNumber(2)
-  set typeUrl($core.List<$core.int> v) { $_setBytes(1, v); }
+  set signature($core.List<$core.int> v) { $_setBytes(1, v); }
   @$pb.TagNumber(2)
-  $core.bool hasTypeUrl() => $_has(1);
+  $core.bool hasSignature() => $_has(1);
   @$pb.TagNumber(2)
-  void clearTypeUrl() => clearField(2);
-
-  @$pb.TagNumber(3)
-  $core.List<$core.int> get signature => $_getN(2);
-  @$pb.TagNumber(3)
-  set signature($core.List<$core.int> v) { $_setBytes(2, v); }
-  @$pb.TagNumber(3)
-  $core.bool hasSignature() => $_has(2);
-  @$pb.TagNumber(3)
-  void clearSignature() => clearField(3);
+  void clearSignature() => clearField(2);
 }
 
 

dart/lib/src/proto/corks/v1/cork.pbjson.dart

@@ -39,14 +39,13 @@ final $typed_data.Uint8List corkDescriptor = $convert.base64Decode(
 const SignedBlock$json = {
   '1': 'SignedBlock',
   '2': [
-    {'1': 'block', '3': 1, '4': 1, '5': 12, '10': 'block'},
-    {'1': 'type_url', '3': 2, '4': 1, '5': 12, '10': 'typeUrl'},
-    {'1': 'signature', '3': 3, '4': 1, '5': 12, '10': 'signature'},
+    {'1': 'block', '3': 1, '4': 1, '5': 11, '6': '.google.protobuf.Any', '10': 'block'},
+    {'1': 'signature', '3': 2, '4': 1, '5': 12, '10': 'signature'},
   ],
 };
 
 /// Descriptor for `SignedBlock`. Decode as a `google.protobuf.DescriptorProto`.
 final $typed_data.Uint8List signedBlockDescriptor = $convert.base64Decode(
-    'CgtTaWduZWRCbG9jaxIUCgVibG9jaxgBIAEoDFIFYmxvY2sSGQoIdHlwZV91cmwYAiABKAxSB3'
-    'R5cGVVcmwSHAoJc2lnbmF0dXJlGAMgASgMUglzaWduYXR1cmU=');
+    'CgtTaWduZWRCbG9jaxIqCgVibG9jaxgBIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlSBWJsb2'
+    'NrEhwKCXNpZ25hdHVyZRgCIAEoDFIJc2lnbmF0dXJl');
 

dart/lib/src/proto/google/protobuf/plugin.pb.dart

@@ -14,7 +14,7 @@ import 'dart:core' as $core;
 import 'package:fixnum/fixnum.dart' as $fixnum;
 import 'package:protobuf/protobuf.dart' as $pb;
 
-import 'descriptor.pb.dart' as $2;
+import 'descriptor.pb.dart' as $0;
 
 export 'plugin.pbenum.dart';
 
@@ -119,7 +119,7 @@ class CodeGeneratorRequest extends $pb.GeneratedMessage {
     $core.Iterable<$core.String>? fileToGenerate,
     $core.String? parameter,
     Version? compilerVersion,
-    $core.Iterable<$2.FileDescriptorProto>? protoFile,
+    $core.Iterable<$0.FileDescriptorProto>? protoFile,
   }) {
     final $result = create();
     if (fileToGenerate != null) {
@@ -144,7 +144,7 @@ class CodeGeneratorRequest extends $pb.GeneratedMessage {
     ..pPS(1, _omitFieldNames ? '' : 'fileToGenerate')
     ..aOS(2, _omitFieldNames ? '' : 'parameter')
     ..aOM<Version>(3, _omitFieldNames ? '' : 'compilerVersion', subBuilder: Version.create)
-    ..pc<$2.FileDescriptorProto>(15, _omitFieldNames ? '' : 'protoFile', $pb.PbFieldType.PM, subBuilder: $2.FileDescriptorProto.create)
+    ..pc<$0.FileDescriptorProto>(15, _omitFieldNames ? '' : 'protoFile', $pb.PbFieldType.PM, subBuilder: $0.FileDescriptorProto.create)
   ;
 
   @$core.Deprecated(
@@ -211,7 +211,7 @@ class CodeGeneratorRequest extends $pb.GeneratedMessage {
   ///  Type names of fields and extensions in the FileDescriptorProto are always
   ///  fully qualified.
   @$pb.TagNumber(15)
-  $core.List<$2.FileDescriptorProto> get protoFile => $_getList(3);
+  $core.List<$0.FileDescriptorProto> get protoFile => $_getList(3);
 }
 
 /// Represents a single generated file.
@@ -220,7 +220,7 @@ class CodeGeneratorResponse_File extends $pb.GeneratedMessage {
     $core.String? name,
     $core.String? insertionPoint,
     $core.String? content,
-    $2.GeneratedCodeInfo? generatedCodeInfo,
+    $0.GeneratedCodeInfo? generatedCodeInfo,
   }) {
     final $result = create();
     if (name != null) {
@@ -245,7 +245,7 @@ class CodeGeneratorResponse_File extends $pb.GeneratedMessage {
     ..aOS(1, _omitFieldNames ? '' : 'name')
     ..aOS(2, _omitFieldNames ? '' : 'insertionPoint')
     ..aOS(15, _omitFieldNames ? '' : 'content')
-    ..aOM<$2.GeneratedCodeInfo>(16, _omitFieldNames ? '' : 'generatedCodeInfo', subBuilder: $2.GeneratedCodeInfo.create)
+    ..aOM<$0.GeneratedCodeInfo>(16, _omitFieldNames ? '' : 'generatedCodeInfo', subBuilder: $0.GeneratedCodeInfo.create)
     ..hasRequiredFields = false
   ;
 
@@ -350,15 +350,15 @@ class CodeGeneratorResponse_File extends $pb.GeneratedMessage {
   /// point is used, this information will be appropriately offset and inserted
   /// into the code generation metadata for the generated files.
   @$pb.TagNumber(16)
-  $2.GeneratedCodeInfo get generatedCodeInfo => $_getN(3);
+  $0.GeneratedCodeInfo get generatedCodeInfo => $_getN(3);
   @$pb.TagNumber(16)
-  set generatedCodeInfo($2.GeneratedCodeInfo v) { setField(16, v); }
+  set generatedCodeInfo($0.GeneratedCodeInfo v) { setField(16, v); }
   @$pb.TagNumber(16)
   $core.bool hasGeneratedCodeInfo() => $_has(3);
   @$pb.TagNumber(16)
   void clearGeneratedCodeInfo() => clearField(16);
   @$pb.TagNumber(16)
-  $2.GeneratedCodeInfo ensureGeneratedCodeInfo() => $_ensure(3);
+  $0.GeneratedCodeInfo ensureGeneratedCodeInfo() => $_ensure(3);
 }
 
 /// The plugin writes an encoded CodeGeneratorResponse to stdout.