Documentation
¶
Overview ¶
Package cachenamespace is the one place a compiler-cache object key is built.
A prefix root -- organization/repository/trust/<class> -- was written as a literal in twenty-four places across five files: the identity manifest, the RustFS validator, the reconciler that also derives lifecycle-rule identifiers from it, the provider's delivery check, two jq expressions rendered into the guest, and the canary workflow. Changing the root meant finding all of them, and #236 is the consequence: every tenant shares one read-write namespace and widening it is a twenty-four-site edit rather than a decision.
Repository identity is supplied by deployment configuration; this package owns only its public syntax and trust-boundary transformations.
Index ¶
- Constants
- func Identifier(prefix string) (string, error)
- func MustPrefixRoot(class TrustClass) string
- func PrefixRoot(class TrustClass) (string, error)
- func PrefixRootFor(repository string, class TrustClass) (string, error)
- func PrefixRoots() map[TrustClass]string
- func Template() string
- type Object
- type TrustClass
Constants ¶
const ( // Organization and Repository form the public example configuration only. // Production authorization must use PrefixRootFor with its estate identity. Organization = "example-org" Repository = "example-actions" )
Variables ¶
This section is empty.
Functions ¶
func Identifier ¶
Identifier is the lifecycle-rule id for a prefix: the part below the trust root, with separators flattened. The reconciler derived this by trimming the literal root, which meant the root was written down there too.
func MustPrefixRoot ¶
func MustPrefixRoot(class TrustClass) string
MustPrefixRoot is PrefixRoot for the three constants above, where an unknown class is a programming error rather than input.
func PrefixRoot ¶
func PrefixRoot(class TrustClass) (string, error)
PrefixRoot is the credential-scoped root for a trust class. Every S3 policy, every lifecycle rule and every worker delivery is scoped to one of these.
func PrefixRootFor ¶
func PrefixRootFor(repository string, class TrustClass) (string, error)
PrefixRootFor builds a trust root for an explicitly configured repository. Repository identity is deployment data: public binaries must not compile a tenant into their authorization decisions.
func PrefixRoots ¶
func PrefixRoots() map[TrustClass]string
PrefixRoots is every class's root, keyed by class.
Types ¶
type Object ¶
type Object struct {
Class TrustClass
Platform string
Arch string
Toolchain string
LockDigest string
RefClass string
// Name is the object itself. It may contain slashes; everything above it
// may not, because each is one path segment.
Name string
}
Object names the parts of a key below the root. Every one is required: a key missing its lock digest would collide across dependency sets, and a key missing its ref class would let a branch read a tag's entry.
type TrustClass ¶
type TrustClass string
TrustClass is the isolation boundary an object belongs to. It is the only axis on which a worker's credential is scoped, so it is the only part of the root that varies.
const ( // Trusted holds output from a job on a reviewed ref of a reviewed // repository. A fork or an unreviewed ref must never reach it. Trusted TrustClass = "trusted" // Untrusted holds output from a job whose inputs were not reviewed. It is // disposable and expires fastest. Untrusted TrustClass = "untrusted" // Promoted holds artifacts a promoter moved out of trusted after review. // Release jobs read it and nothing writes it from a worker. Promoted TrustClass = "promoted" )
func Counterpart ¶
func Counterpart(class TrustClass) (TrustClass, error)
Counterpart is the class a credential for the given class must be denied. The reconciler proves isolation by attempting a write there and requiring refusal, and picking the counterpart by hand is how that proof could quietly become a test of a class the credential was never granted anyway.
func ParsePrefixRoot ¶
func ParsePrefixRoot(prefix string) (string, TrustClass, error)
ParsePrefixRoot returns the repository and trust class encoded by a complete credential root. It rejects additional path segments and ambiguous values.
func TrustClasses ¶
func TrustClasses() []TrustClass
TrustClasses is every class, in the order a reader would expect them.
func (TrustClass) Valid ¶
func (c TrustClass) Valid() bool
Valid reports whether a class is one this package builds keys for. An unknown class must fail closed rather than produce a namespace nobody granted.
Source Files