Documentation
¶
Overview ¶
Package fixtureimport owns the staging contract for final cross-product conformance fixtures. It deliberately does not create producer artifacts or Proof assessments: every staged byte must be supplied by a released source.
Index ¶
- Constants
- func CanonicalContractBytes(contract Contract) ([]byte, error)
- func Check(dest string) error
- func ReadContractFile(path string) ([]byte, error)
- func Update(sourceRoot, dest string, contract Contract, contractRaw []byte) error
- type Artifact
- type Contract
- type DriftError
- type File
- type Reference
- type ReleaseAsset
- type RuntimeError
- type SchemaError
- type Source
- type UnsafeError
Constants ¶
const ( ContractFormat = "proof.cross_product_fixture_import/v1" ManifestPath = "provenance/import-manifest.json" ContractPath = "provenance/import-contract.json" ManagedMarker = ".proof-fixture-managed" ManagedContent = "proof-cross-product-fixture/v1\n" AxymRegisterSchemaID = "https://axym.dev/schemas/v1/governance/action-contract-register.schema.json" AxymPacketSchemaID = "https://axym.dev/schemas/v1/governance/action-contract-evidence-packet.schema.json" AxymSchemaVersion = "v1" )
Variables ¶
This section is empty.
Functions ¶
func CanonicalContractBytes ¶
CanonicalContractBytes returns the exact contract representation staged by Update and checked by Check.
func Check ¶
Check validates the committed staged tree without reading any external checkout. It is deterministic and offline.
func ReadContractFile ¶
ReadContractFile reads the operator-supplied import contract without following symlinks or opening non-regular files. Contract paths are input boundaries, so an unsafe file type is distinct from an ordinary I/O error; in particular, this prevents a FIFO/device from blocking os.ReadFile.
Types ¶
type Artifact ¶
type Artifact struct {
Path string `json:"path"`
SHA256 string `json:"sha256"`
Kind string `json:"kind"`
SchemaPath string `json:"schema_path"`
SchemaSHA256 string `json:"schema_sha256"`
SchemaID string `json:"schema_id"`
SchemaVersion string `json:"schema_version"`
ProducerArtifact bool `json:"producer_artifact"`
Synthetic bool `json:"synthetic"`
SignaturePath string `json:"signature_path,omitempty"`
SignatureSHA256 string `json:"signature_sha256,omitempty"`
SignatureRequired bool `json:"signature_required,omitempty"`
RelationshipRefs []Reference `json:"relationship_refs,omitempty"`
}
type Contract ¶
type Contract struct {
Format string `json:"format"`
FixtureID string `json:"fixture_id"`
ProofCommit string `json:"proof_commit,omitempty"`
Sources []Source `json:"sources"`
}
Contract pins the exact producer identities and bytes accepted by the importer. Paths are relative to the source root and use slash separators. The contract is intentionally supplied by the release owner; no defaults contain a developer checkout or a guessed tag/commit.
func LoadContract ¶
LoadContract parses and validates the shape of a contract. Byte and producer validation happens in ValidateSource so callers can use this in a preflight without writing anything.
type DriftError ¶
type DriftError struct{ Err error }
DriftError marks a committed fixture that no longer matches its generated contract, manifest, or allowlisted file set.
func (*DriftError) Error ¶
func (e *DriftError) Error() string
func (*DriftError) Unwrap ¶
func (e *DriftError) Unwrap() error
type ReleaseAsset ¶
type ReleaseAsset struct {
Role string `json:"role"`
Path string `json:"path"`
SHA256 string `json:"sha256"`
}
ReleaseAsset pins the detached release material used to anchor an extracted authoritative bundle. The bytes are copied and digest-checked like every other source file; the role keeps checksum, signature, certificate, attestation, provenance, and bundle inputs distinguishable.
type RuntimeError ¶
type RuntimeError struct{ Err error }
RuntimeError marks an internal destination/I/O failure. Validation and verification failures intentionally remain ordinary errors so the CLI can preserve the stable exit-code distinction.
func (*RuntimeError) Error ¶
func (e *RuntimeError) Error() string
func (*RuntimeError) Unwrap ¶
func (e *RuntimeError) Unwrap() error
type SchemaError ¶
type SchemaError struct{ Err error }
SchemaError marks a pinned-schema or artifact-schema contract violation.
func (*SchemaError) Error ¶
func (e *SchemaError) Error() string
func (*SchemaError) Unwrap ¶
func (e *SchemaError) Unwrap() error
type Source ¶
type Source struct {
Product string `json:"product"`
Version string `json:"version"`
Commit string `json:"commit"`
Tag string `json:"tag"`
TagObject string `json:"tag_object,omitempty"`
PeeledCommit string `json:"peeled_commit,omitempty"`
IntegrityMode string `json:"integrity_mode"`
ManifestPath string `json:"manifest_path"`
ManifestSHA256 string `json:"manifest_sha256"`
PublicKeyPath string `json:"public_key_path"`
PublicKeySHA256 string `json:"public_key_sha256"`
ReleaseAssets []ReleaseAsset `json:"release_assets,omitempty"`
Schemas []File `json:"schemas"`
Artifacts []Artifact `json:"artifacts"`
}
type UnsafeError ¶
type UnsafeError struct{ Err error }
UnsafeError marks an existing destination that is not a previously staged fixture. Update refuses to replace such paths.
func (*UnsafeError) Error ¶
func (e *UnsafeError) Error() string
func (*UnsafeError) Unwrap ¶
func (e *UnsafeError) Unwrap() error
Source Files