types: Common Protocol Buffer Types

This module is a set of common types expressed as Google Protocol Buffers.

Please see the godoc for detailed documentation. The documentation is also indexed on Context7 for use with AI coding assistants. Use the library ID /sixafter/types with the Context7 MCP server or any Context7-aware tool.

---

Status

Build & Test

Package and Deploy

---

Verify with Cosign

Cosign is used to sign releases for integrity verification.

To verify the integrity of the types source, run the following commands:

# Fetch the latest release tag from GitHub API (e.g., "v1.61.0")
TAG=$(curl -s https://api.github.com/repos/sixafter/types/releases/latest | jq -r .tag_name)

# Remove the leading "v" for filenames (e.g., "v1.61.0" -> "1.61.0")
VERSION=${TAG#v}

# ---------------------------------------------------------------------
# Verify the source archive using Sigstore bundles
# ---------------------------------------------------------------------

# Download the release tarball and its signature bundle
curl -LO "https://github.com/sixafter/types/releases/download/${TAG}/types-${VERSION}.tar.gz"
curl -LO "https://github.com/sixafter/types/releases/download/${TAG}/types-${VERSION}.tar.gz.sigstore.json"

# Verify the tarball with Cosign using the published public key
cosign verify-blob \
  --key "https://raw.githubusercontent.com/sixafter/types/main/cosign.pub" \
  --bundle "types-${VERSION}.tar.gz.sigstore.json" \
  "types-${VERSION}.tar.gz"

# ---------------------------------------------------------------------
# Verify the checksums manifest using Sigstore bundles
# ---------------------------------------------------------------------

curl -LO "https://github.com/sixafter/types/releases/download/${TAG}/checksums.txt"
curl -LO "https://github.com/sixafter/types/releases/download/${TAG}/checksums.txt.sigstore.json"

# Verify checksums.txt with Cosign
cosign verify-blob \
  --key "https://raw.githubusercontent.com/sixafter/types/main/cosign.pub" \
  --bundle "checksums.txt.sigstore.json" \
  "checksums.txt"

# ---------------------------------------------------------------------
# Confirm local artifact integrity
# ---------------------------------------------------------------------

shasum -a 256 -c checksums.txt

If valid, Cosign will output:

Verified OK

---

Overview

To use this module, execute the following command:

go get -u github.com/sixafter/types

In your Go code, you can import the module as follows.

package main

import (
    pb "github.com/sixafter/types/proto/v1/pb"
)

The use of Go vendoring is RECOMMENDED.

Contributing

Contributions are welcome. See CONTRIBUTING

License

This project is licensed under the Apache 2.0 License. See LICENSE file.