releasecontract

package
v0.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 4, 2026 License: MIT Imports: 11 Imported by: 0

Documentation

Overview

Package releasecontract defines the public, provider-neutral identity chain for a coordinated SecondBox release.

Index

Constants

View Source 
const (
	ArtifactManifestSchema         = "secondbox.release/artifact-manifest/v2"
	QualificationAttestationSchema = "secondbox.release/qualification-attestation/v1"
	ReleaseIndexSchema             = "secondbox.release/release-index/v1"

	TypeScriptPackage = "@secondstack-ai/secondbox"
	GoModule          = "github.com/SecondStack-AI/SecondBox"
	ControlPlaneImage = "ghcr.io/secondstack-ai/secondbox/control-plane"
	RunnerImage       = "ghcr.io/secondstack-ai/secondbox/runner"
	MicroVMImage      = "ghcr.io/secondstack-ai/secondbox/microvm-artifacts"
)

Variables

This section is empty.

Functions

func AcceptImmutableRetry 

func AcceptImmutableRetry(existing, staged []byte) error

AcceptImmutableRetry permits a publication retry only when the bytes already present at an immutable coordinate are identical to the staged candidate.

func ArtifactManifestLocation 

func ArtifactManifestLocation(version string) string

func BinaryLocation 

func BinaryLocation(version, name, platform string) string

func Digest 

func Digest(data []byte) string

func ParseTag 

func ParseTag(tag string) (string, error)

func QualificationAttestationLocation 

func QualificationAttestationLocation(version string) string

func ReleaseIndexLocation 

func ReleaseIndexLocation(version string) string

func SourceFreeSuiteLocation 

func SourceFreeSuiteLocation(version string) string

func ValidateRuntimeCombination 

func ValidateRuntimeCombination(manifest ArtifactManifest, controlPlane, runner, guest Identity) error

ValidateRuntimeCombination applies the v1 mixed-version policy. Until a future schema records explicit cross-release evidence, all runtime members must carry the artifact manifest's exact coordinated identity.

func VerifyFinalRelease 

func VerifyFinalRelease(indexBytes, manifestBytes, qualificationBytes []byte) (ReleaseIndex, ArtifactManifest, QualificationAttestation, error)

VerifyFinalRelease binds the exact public index bytes to the exact manifest and qualification bytes fetched independently by the caller.

Types

type ArtifactManifest 

type ArtifactManifest struct {
	SchemaVersion string `json:"schemaVersion"`
	Identity
	OpenAPI              OpenAPIArtifact          `json:"openapi"`
	RunnerProtocol       ProtocolWindow           `json:"runnerProtocol"`
	GuestProtocol        ProtocolWindow           `json:"guestProtocol"`
	Platforms            PlatformMatrix           `json:"platforms"`
	GoSDK                SDKArtifact              `json:"goSdk"`
	TypeScriptSDK        SDKArtifact              `json:"typeScriptSdk"`
	ControlPlane         OCIArtifact              `json:"controlPlane"`
	Runner               OCIArtifact              `json:"runner"`
	MicroVM              MicroVMArtifact          `json:"microvm"`
	Binaries             []BinaryArtifact         `json:"binaries"`
	SBOMs                []Reference              `json:"sboms"`
	ArtifactAttestations []Reference              `json:"artifactAttestations"`
	SourceFreeSuite      Reference                `json:"sourceFreeSuite"`
	StandardBundles      []StandardBundleArtifact `json:"standardBundles"`
}

ArtifactManifest contains immutable artifact identity only. Qualification is deliberately separate so the final index has no digest cycle.

func DecodeArtifactManifest 

func DecodeArtifactManifest(data []byte) (ArtifactManifest, error)

func (ArtifactManifest) Validate 

func (manifest ArtifactManifest) Validate() error

type BinaryArtifact 

type BinaryArtifact struct {
	Identity Identity `json:"identity"`
	Name     string   `json:"name"`
	Platform string   `json:"platform"`
	Location string   `json:"location"`
	SHA256   string   `json:"sha256"`
}

type Identity 

type Identity struct {
	Version      string `json:"version"`
	Tag          string `json:"tag"`
	SourceCommit string `json:"sourceCommit"`
}

Identity is repeated on every independently inspectable release object.

type MicroVMArtifact 

type MicroVMArtifact struct {
	Identity              Identity        `json:"identity"`
	ImageReference        string          `json:"imageReference"`
	SignedManifestDigest  string          `json:"signedManifestDigest"`
	SigningKeyFingerprint string          `json:"signingKeyFingerprint"`
	RuntimeBundle         SignedComponent `json:"runtimeBundle"`
	ToolchainBundle       SignedComponent `json:"toolchainBundle"`
}

type OCIArtifact 

type OCIArtifact struct {
	Identity  Identity `json:"identity"`
	Reference string   `json:"reference"`
}

type OpenAPIArtifact 

type OpenAPIArtifact struct {
	Identity Identity `json:"identity"`
	Reference
}

type PlatformMatrix 

type PlatformMatrix struct {
	HostBinaries         []string `json:"hostBinaries"`
	ControlPlane         []string `json:"controlPlane"`
	Runner               []string `json:"runner"`
	Guest                []string `json:"guest"`
	QualifiedRunnerGuest []string `json:"qualifiedRunnerGuest"`
}

type ProtocolWindow 

type ProtocolWindow struct {
	Minimum uint32 `json:"minimum"`
	Maximum uint32 `json:"maximum"`
}

type QualificationAttestation 

type QualificationAttestation struct {
	SchemaVersion string `json:"schemaVersion"`
	Identity
	ArtifactManifest        Reference         `json:"artifactManifest"`
	Suite                   string            `json:"suite"`
	SuiteDigest             string            `json:"suiteDigest"`
	Architecture            string            `json:"architecture"`
	RunnerProtocolVersion   uint32            `json:"runnerProtocolVersion"`
	GuestProtocolGeneration uint32            `json:"guestProtocolGeneration"`
	Guest                   QualifiedGuest    `json:"guest"`
	RunnerEnvironment       RunnerEnvironment `json:"runnerEnvironment"`
	Result                  string            `json:"result"`
	CompletedAt             string            `json:"completedAt"`
}

QualificationAttestation proves source-free use of one exact manifest.

func DecodeQualificationAttestation 

func DecodeQualificationAttestation(data []byte) (QualificationAttestation, error)

func (QualificationAttestation) Validate 

func (attestation QualificationAttestation) Validate() error

type QualifiedGuest 

type QualifiedGuest struct {
	ManifestDigest        string `json:"manifestDigest"`
	SigningKeyFingerprint string `json:"signingKeyFingerprint"`
}

type Reference 

type Reference struct {
	Location string `json:"location"`
	Digest   string `json:"digest"`
}

Reference identifies immutable bytes at a public HTTPS location.

type ReleaseIndex 

type ReleaseIndex struct {
	SchemaVersion string `json:"schemaVersion"`
	Identity
	ArtifactManifest Reference `json:"artifactManifest"`
	Qualification    Reference `json:"qualificationAttestation"`
}

ReleaseIndex is the last artifact published. Its presence is the release completeness signal consumed by normal deployments.

func DecodeReleaseIndex 

func DecodeReleaseIndex(data []byte) (ReleaseIndex, error)

func (ReleaseIndex) Validate 

func (index ReleaseIndex) Validate() error

type RunnerEnvironment 

type RunnerEnvironment struct {
	RunnerImageReference string `json:"runnerImageReference"`
	OperatingSystem      string `json:"operatingSystem"`
	Kernel               string `json:"kernel"`
	FirecrackerVersion   string `json:"firecrackerVersion"`
	CPUModel             string `json:"cpuModel"`
}

type SDKArtifact 

type SDKArtifact struct {
	Identity   Identity  `json:"identity"`
	Coordinate string    `json:"coordinate"`
	Package    Reference `json:"package"`
}

type SignedComponent added in v0.1.3 

type SignedComponent struct {
	ArtifactID             string   `json:"artifactId"`
	ManifestDigest         string   `json:"manifestDigest"`
	MandatoryGuestFeatures []string `json:"mandatoryGuestFeatures"`
}

SignedComponent is one independently selected component bound by the signed top-level microVM manifest.

type StandardBundleArtifact 

type StandardBundleArtifact struct {
	Identity Identity                  `json:"identity"`
	Name     string                    `json:"name"`
	Document Reference                 `json:"document"`
	Profiles []StandardProfileIdentity `json:"profiles"`
}

type StandardProfileIdentity 

type StandardProfileIdentity struct {
	Name       string `json:"name"`
	Revision   int64  `json:"revision"`
	SpecDigest string `json:"specDigest"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.