header

package
v0.22.0-rc1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 21, 2026 License: Apache-2.0 Imports: 3 Imported by: 0

Documentation

Overview

Package header provides common header types for AICR data structures.

This package defines the Header type used across recipes, snapshots, and other AICR data structures to provide consistent metadata and versioning information.

Header Structure

The Header contains standard fields for API versioning and metadata:

type Header struct {
    Kind       Kind              `json:"kind,omitempty" yaml:"kind,omitempty"`             // Resource type (Snapshot, Recipe, RecipeResult)
    APIVersion string            `json:"apiVersion,omitempty" yaml:"apiVersion,omitempty"` // API version (e.g., "aicr.run/v1")
    Metadata   map[string]string `json:"metadata,omitempty" yaml:"metadata,omitempty"`     // Free-form string metadata (timestamp, version, etc.)
}

Metadata is a flat map[string]string populated by Init / InitWithTime with the unprefixed keys "timestamp" (RFC3339 UTC) and "version" (when supplied).

Usage

Initialize a header for a recipe via Init:

var h header.Header
h.Init(header.KindRecipe, header.StableGroupVersion, "v1.0.0")
// h.Metadata == map[string]string{"timestamp": "...", "version": "v1.0.0"}

KindRecipe shown here is the legacy input kind, distinct from KindRecipeResult and normalized to it per ADR-022 §2; both sit on the stable artifact track alongside Snapshot, hence StableGroupVersion. An authored catalog RecipeMetadata is colloquially a "recipe" too but sits on the authoring track, and a profile-bearing artifact on its own track, so those emitters pass AuthoringGroupVersion or ProfileGroupVersion instead; see the API Versioning section below.

For reproducible-build callers (SLSA, signed artifacts) inject a fixed timestamp via InitWithTime instead of Init:

var h header.Header
h.InitWithTime(header.KindSnapshot, header.StableGroupVersion, "v1.0.0", buildTime)

Serialization

Headers serialize consistently to JSON and YAML:

{
  "apiVersion": "aicr.run/v1",
  "kind": "Recipe",
  "metadata": {
    "timestamp": "2025-12-30T10:30:00Z",
    "version": "v1.0.0"
  }
}

API Versioning

The APIVersion field enables evolution of data formats. APIGroup derives from Domain. Per ADR-013 the move from the legacy aicr.nvidia.com/v1alpha1 group was a hard break — the old value is rejected, not migrated.

ADR-022 splits artifacts across three schema tracks. An emitter aliases the constant for its track — StableGroupVersion, AuthoringGroupVersion, or ProfileGroupVersion — never GroupVersion directly. The three carried the same value through the reader-first release, so aliasing by value rather than by track compiled and passed tests while emitting the wrong version later. The v0.22 switch (#2416) separated them, which turns that mistake into a visible wrong value instead of a latent one.

Callers should select the gate for the artifact's schema track rather than comparing literals, so the single source of truth in this package stays authoritative. IsSupportedAPIVersion covers the stable artifact track:

if h.APIVersion != "" && !header.IsSupportedAPIVersion(h.APIVersion) {
    return errors.New(errors.ErrCodeInvalidRequest,
        fmt.Sprintf("unsupported apiVersion %q", h.APIVersion))
}

Kind Field

The Kind field is a typed constant identifying the resource:

  • KindSnapshot ("Snapshot"): System configuration capture
  • KindRecipe ("Recipe"): Configuration recommendations
  • KindRecipeResult ("RecipeResult"): Resolved recipe with hydrated values

Custom Metadata

Because Metadata is a flat map[string]string, callers may add their own keys alongside the Init-populated "timestamp" and "version":

h.Metadata["node"] = "gpu-node-1"
h.Metadata["cluster"] = "production"
h.Metadata["environment"] = "staging"

Timestamps

Init writes the timestamp using RFC3339 format in UTC:

h.Init(header.KindRecipe, header.StableGroupVersion, "v1.0.0")
// h.Metadata["timestamp"] == "2025-12-30T10:30:00Z"

Validation

While Header doesn't enforce validation, consumers should verify:

  • APIVersion is supported
  • Kind is recognized
  • Metadata["timestamp"] is reasonable
  • Version is a valid semantic version (if present)

Index

Constants

View Source
const (
	// Domain is the single source of truth for the AICR API domain. Every
	// role (apiVersion group, K8s label/annotation keys, attestation and
	// provenance URI hosts, UUIDv5 namespace seed) derives from this value.
	Domain = "aicr.run"

	// APIGroup is the API group for AICR artifacts.
	APIGroup = Domain

	// APIVersionV1Alpha2 is the current artifact API version segment.
	APIVersionV1Alpha2 = "v1alpha2"

	// APIVersionV1Alpha3 is the strict RecipeResult schema carrying typed
	// desired-state configuration. Other artifact kinds remain on v1alpha2.
	APIVersionV1Alpha3 = "v1alpha3"

	// APIVersionV1Beta1 is the ADR-022 target for authoring and configuration
	// artifacts: AICRConfig, ordinary RecipeMetadata, RecipeMixin, and
	// ComponentRegistry.
	APIVersionV1Beta1 = "v1beta1"

	// APIVersionV1Beta2 is the ADR-022 target for profile-bearing
	// RecipeMetadata and RecipeResult artifacts.
	APIVersionV1Beta2 = "v1beta2"

	// APIVersionV1 is the ADR-022 target for stable public artifacts:
	// Snapshot, default RecipeResult, RecipeCriteria, and BundleProvenance.
	APIVersionV1 = "v1"

	// GroupVersion is the canonical "group/version" string for AICR artifacts.
	GroupVersion = APIGroup + "/" + APIVersionV1Alpha2

	// RecipeResultGroupVersion is the current configured RecipeResult schema.
	RecipeResultGroupVersion = APIGroup + "/" + APIVersionV1Alpha3

	// StableGroupVersion is the value emitted for the ADR-022 stable artifact
	// track: Snapshot, the default RecipeResult, RecipeCriteria, and
	// BundleProvenance. It reached its §2 target in v0.22 (#2416); the readers
	// still accept GroupVersion until #2417.
	StableGroupVersion = GroupVersionV1

	// AuthoringGroupVersion is the value emitted for the ADR-022 authoring and
	// configuration track: AICRConfig, ordinary RecipeMetadata, RecipeMixin,
	// and ComponentRegistry. It reached its §2 target in v0.22 (#2416).
	AuthoringGroupVersion = GroupVersionV1Beta1

	// ProfileGroupVersion is the value emitted for the ADR-022 profile-bearing
	// track: profile RecipeMetadata and RecipeResult. It reached its §2 target
	// in v0.22 (#2416).
	ProfileGroupVersion = GroupVersionV1Beta2

	// GroupVersionV1Beta1 is the target authoring/configuration group/version.
	GroupVersionV1Beta1 = APIGroup + "/" + APIVersionV1Beta1

	// GroupVersionV1Beta2 is the target profile-bearing group/version.
	GroupVersionV1Beta2 = APIGroup + "/" + APIVersionV1Beta2

	// GroupVersionV1 is the target stable public artifact group/version.
	GroupVersionV1 = APIGroup + "/" + APIVersionV1
)

AICR artifact API versioning. These constants are the single source of truth for every AICR artifact group/version. Package-local emitters and readers select a version by wire kind and schema track; see ADR-022.

Three tracks exist. StableGroupVersion, AuthoringGroupVersion, and ProfileGroupVersion name the value each track emits; since the v0.22 emitter switch (#2416) each equals its target, GroupVersionV1, GroupVersionV1Beta1 and GroupVersionV1Beta2 respectively.

They carried the same string through the reader-first release, which is what let a package alias GroupVersion directly and still look correct while emitting the wrong value later. Alias the constant for your track, never the string it happens to equal; the tracks are distinct now and a collapsed alias shows up as a wrong value rather than a latent one.

Evolution policy (see docs/design/011-artifact-apiversion-policy.md and docs/design/022-artifact-maturity-and-deprecation.md): schema changes within a version must be additive-only; a breaking change requires a new version segment. Alpha versions owe no deprecation window. Beta versions remain readable for two AICR releases after deprecation, and GA versions remain readable through the current AICR major version. Version bumps that owe a window stage readers before emitters.

View Source
const AlphaRemovedIn = "v1.0.0"

AlphaRemovedIn is the release that stops reading the alpha apiVersion values and the legacy empty header. ADR-022 §3 binds N+2 to v1.0.0 (#2417): shipping v1.0.0 while it still reads alpha would make alpha acceptance part of the frozen v1 surface.

Variables

This section is empty.

Functions

func IsSupportedAPIVersion added in v0.16.0

func IsSupportedAPIVersion(v string) bool

IsSupportedAPIVersion reports whether v is an artifact apiVersion this binary understands. The empty string is intentionally NOT supported here: callers that tolerate a missing apiVersion for backward compatibility with older artifacts must special-case "" before calling this.

This compatibility helper covers the stable artifact track only. Callers reading authoring or profile-bearing artifacts must use the corresponding schema-track helper instead of treating versions as globally interchangeable.

func IsSupportedAuthoringAPIVersion added in v0.21.0

func IsSupportedAuthoringAPIVersion(v string) bool

IsSupportedAuthoringAPIVersion reports whether v is accepted for an ADR-022 authoring/configuration artifact. It still admits the superseded alpha value; #2417 narrows it to the target in v1.0.0.

func IsSupportedBundleInfoAPIVersion added in v0.22.0

func IsSupportedBundleInfoAPIVersion(v string) bool

IsSupportedBundleInfoAPIVersion reports whether v is accepted for a BundleInfo. Unlike the other stable-track artifacts, this kind shipped directly at its ADR-022 target with no alpha predecessor to retire, so the alpha value IsSupportedAPIVersion still admits names a document that never legitimately existed.

func IsSupportedProfileAPIVersion added in v0.21.0

func IsSupportedProfileAPIVersion(v string) bool

IsSupportedProfileAPIVersion reports whether v is accepted for a profile-bearing RecipeMetadata or RecipeResult during the Release N reader-first window.

func IsSupportedRecipeResultAPIVersion added in v0.19.0

func IsSupportedRecipeResultAPIVersion(v string) bool

IsSupportedRecipeResultAPIVersion reports whether v is a RecipeResult version understood by this binary. The gate is the union of the default and profile-bearing schema tracks; callers must still enforce the bidirectional version/profile discriminator contract.

func WarnDeprecatedAPIVersion added in v0.22.0

func WarnDeprecatedAPIVersion(path, apiVersion, target string)

WarnDeprecatedAPIVersion emits a deprecation warning when an artifact carries an alpha or absent apiVersion, and does nothing otherwise. target is the §2 value the caller's track expects, so the warning says what to write instead.

The subject embeds the file path, which makes it the deduplication key: a catalog scan over many files warns once per offending file rather than once per process. Callers with no file — a request body, an in-memory decode — should not call this: the message would name nothing actionable. The REST surface has no equivalent signal for artifact headers today; deprecation's SetHTTPHeaders covers deprecated routes, not deprecated payload versions.

Types

type Header struct {
	// Kind is the type of the snapshot object.
	Kind Kind `json:"kind,omitempty" yaml:"kind,omitempty"`

	// APIVersion is the API version of the snapshot object.
	APIVersion string `json:"apiVersion,omitempty" yaml:"apiVersion,omitempty"`

	// Metadata contains key-value pairs with metadata about the snapshot.
	Metadata map[string]string `json:"metadata,omitempty" yaml:"metadata,omitempty"`
}

Header contains metadata and versioning information for AICR resources. It follows Kubernetes-style resource conventions with Kind, APIVersion, and Metadata fields.

func (*Header) Init

func (h *Header) Init(kind Kind, apiVersion string, version string)

Init initializes the Header with the specified kind, apiVersion, and version. It sets the Kind, APIVersion, and populates Metadata with timestamp and version. Uses unprefixed keys (timestamp, version) for all kinds.

The timestamp is wall-clock time. Reproducible-build callers (SLSA, signed artifacts) must inject a fixed timestamp via InitWithTime to keep the serialized header byte-stable across runs.

func (*Header) InitWithTime added in v0.14.0

func (h *Header) InitWithTime(kind Kind, apiVersion string, version string, ts time.Time)

InitWithTime is like Init but uses the caller-supplied timestamp. Use this when the header feeds into a digest, signature, or otherwise reproducible artifact — derive ts from a content-addressable source (commit SHA, the SOURCE_DATE_EPOCH environment variable, etc.).

type Kind

type Kind string

Kind represents the type of AICR resource. All AICR resources should use these constants for consistency.

const (
	KindSnapshot     Kind = "Snapshot"
	KindRecipe       Kind = "Recipe"
	KindRecipeResult Kind = "RecipeResult"
	KindBundleInfo   Kind = "BundleInfo"
)

Valid Kind constants for all AICR resource types.

func (Kind) String

func (k Kind) String() string

String returns the string representation of the Kind.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL