releasecontract

package
v0.7.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 27, 2026 License: MIT Imports: 13 Imported by: 0

Documentation

Overview

Package releasecontract defines the public, provider-neutral identity of a SecondBox release.

Index

Constants

View Source 
const (
	ArtifactManifestSchema                     = "secondbox.release/artifact-manifest/v5"
	QualificationEvidenceSchema                = "secondbox.release/qualification-evidence/v2"
	LegacyQualificationEvidenceSchema          = "secondbox.release/qualification-evidence/v1"
	InstallerQualificationEvidenceSchema       = "secondbox.release/installer-qualification-evidence/v2"
	LegacyInstallerQualificationEvidenceSchema = "secondbox.release/installer-qualification-evidence/v1"

	TypeScriptPackage   = "@secondstack-ai/secondbox"
	GoModule            = "github.com/SecondStack-AI/SecondBox"
	ControlPlaneImage   = "ghcr.io/secondstack-ai/secondbox/control-plane"
	RunnerImage         = "ghcr.io/secondstack-ai/secondbox/runner"
	MicroVMImage        = "ghcr.io/secondstack-ai/secondbox/microvm-artifacts"
	InstallerToolsImage = "ghcr.io/secondstack-ai/secondbox/installer-tools"
)

Variables

This section is empty.

Functions

func ArtifactManifestLocation 

func ArtifactManifestLocation(version string) string

func BinaryLocation 

func BinaryLocation(version, name, platform string) string

func CompareVersions added in v0.6.0 

func CompareVersions(left, right string) (int, error)

CompareVersions orders two canonical release versions according to SemVer precedence. It rejects build metadata because release tags do not admit it.

func Digest 

func Digest(data []byte) string

func InstallBootstrapLocation added in v0.4.0 

func InstallBootstrapLocation(version string) string

func InstallerQualificationEvidenceLocation added in v0.4.0 

func InstallerQualificationEvidenceLocation(version string) string

func ParseTag 

func ParseTag(tag string) (string, error)

func QualificationEvidenceLocation added in v0.2.0 

func QualificationEvidenceLocation(version string) string

func SourceFreeSuiteLocation 

func SourceFreeSuiteLocation(version string) string

Types

type ArtifactManifest 

type ArtifactManifest struct {
	SchemaVersion string `json:"schemaVersion"`
	Candidate     bool   `json:"candidate,omitempty"`
	Identity
	OpenAPI                        OpenAPIArtifact          `json:"openapi"`
	RunnerProtocol                 ProtocolWindow           `json:"runnerProtocol"`
	GuestProtocol                  ProtocolWindow           `json:"guestProtocol"`
	Platforms                      PlatformMatrix           `json:"platforms"`
	GoSDK                          SDKArtifact              `json:"goSdk"`
	TypeScriptSDK                  SDKArtifact              `json:"typeScriptSdk"`
	ControlPlane                   OCIArtifact              `json:"controlPlane"`
	Runner                         OCIArtifact              `json:"runner"`
	InstallerTools                 OCIArtifact              `json:"installerTools"`
	BundledServices                BundledServiceImages     `json:"bundledServices"`
	InstallBootstrap               Reference                `json:"installBootstrap"`
	MicroVM                        MicroVMArtifact          `json:"microvm"`
	Binaries                       []BinaryArtifact         `json:"binaries"`
	SBOMs                          []Reference              `json:"sboms"`
	ArtifactAttestations           []Reference              `json:"artifactAttestations,omitempty"`
	SourceFreeSuite                Reference                `json:"sourceFreeSuite,omitempty"`
	QualificationEvidence          Reference                `json:"qualificationEvidence"`
	InstallerQualificationEvidence Reference                `json:"installerQualificationEvidence"`
	StandardBundles                []StandardBundleArtifact `json:"standardBundles"`
}

ArtifactManifest contains immutable release artifact identity.

func DecodeArtifactManifest 

func DecodeArtifactManifest(data []byte) (ArtifactManifest, error)

func (ArtifactManifest) InstallerQualificationSubjectDigest added in v0.4.0 

func (manifest ArtifactManifest) InstallerQualificationSubjectDigest() (string, error)

InstallerQualificationSubjectDigest identifies all public release contract fields except the installer-evidence reference itself. Omitting that one reference avoids a digest cycle while still binding qualification to the exact binaries, images, protocols, bundles, and other immutable release objects that the final manifest publishes.

func (ArtifactManifest) Validate 

func (manifest ArtifactManifest) Validate() error

type BinaryArtifact 

type BinaryArtifact struct {
	Identity Identity `json:"identity"`
	Name     string   `json:"name"`
	Platform string   `json:"platform"`
	Location string   `json:"location"`
	SHA256   string   `json:"sha256"`
}

type BundledServiceImages added in v0.4.0 

type BundledServiceImages struct {
	Postgres string `json:"postgres"`
}

type Identity 

type Identity struct {
	Version      string `json:"version"`
	Tag          string `json:"tag"`
	SourceCommit string `json:"sourceCommit"`
}

Identity is repeated on every independently inspectable release object.

type InstallerQualificationEvidence added in v0.4.0 

type InstallerQualificationEvidence struct {
	SchemaVersion         string                    `json:"schemaVersion"`
	SourceCommit          string                    `json:"sourceCommit"`
	RepositoryDirty       bool                      `json:"repositoryDirty"`
	Suite                 string                    `json:"suite"`
	PassCount             int64                     `json:"passCount"`
	WallClockSeconds      int64                     `json:"wallClockSeconds"`
	Host                  QualificationHostEvidence `json:"host"`
	ReleaseManifestDigest string                    `json:"releaseManifestDigest"`
	FilesystemIdentity    string                    `json:"filesystemIdentity"`
	RebootPassed          bool                      `json:"rebootPassed"`
	QualifiedAt           string                    `json:"qualifiedAt"`
}

func DecodeInstallerQualificationEvidence added in v0.4.0 

func DecodeInstallerQualificationEvidence(data []byte) (InstallerQualificationEvidence, error)

func DecodeRecordedInstallerQualificationEvidence added in v0.7.1 

func DecodeRecordedInstallerQualificationEvidence(data []byte) (InstallerQualificationEvidence, error)

DecodeRecordedInstallerQualificationEvidence strictly decodes evidence for a previously published release. Callers must still validate it against the exact recorded release identity with ValidateRecordedForRelease.

func (InstallerQualificationEvidence) Validate added in v0.4.0 

func (evidence InstallerQualificationEvidence) Validate() error

func (InstallerQualificationEvidence) ValidateForRelease added in v0.4.0 

func (evidence InstallerQualificationEvidence) ValidateForRelease(sourceCommit, qualificationSubjectDigest string) error

func (InstallerQualificationEvidence) ValidateRecordedForRelease added in v0.7.1 

func (evidence InstallerQualificationEvidence) ValidateRecordedForRelease(sourceCommit, qualificationSubjectDigest string) error

ValidateRecordedForRelease recognizes the one immutable v0.6.0 installer evidence waiver only while authenticating that exact release as an update source. New releases and ordinary installation remain subject to Validate.

type MicroVMArtifact 

type MicroVMArtifact struct {
	Identity              Identity        `json:"identity"`
	ImageReference        string          `json:"imageReference"`
	SignedManifestDigest  string          `json:"signedManifestDigest"`
	SigningKeyFingerprint string          `json:"signingKeyFingerprint"`
	RuntimeBundle         SignedComponent `json:"runtimeBundle"`
	ToolchainBundle       SignedComponent `json:"toolchainBundle"`
}

type OCIArtifact 

type OCIArtifact struct {
	Identity  Identity `json:"identity"`
	Reference string   `json:"reference"`
}

type OpenAPIArtifact 

type OpenAPIArtifact struct {
	Identity Identity `json:"identity"`
	Reference
}

type PlatformMatrix 

type PlatformMatrix struct {
	HostBinaries         []string `json:"hostBinaries"`
	ControlPlane         []string `json:"controlPlane"`
	Runner               []string `json:"runner"`
	InstallerTools       []string `json:"installerTools"`
	Guest                []string `json:"guest"`
	QualifiedRunnerGuest []string `json:"qualifiedRunnerGuest"`
}

type ProtocolWindow 

type ProtocolWindow struct {
	Minimum uint32 `json:"minimum"`
	Maximum uint32 `json:"maximum"`
}

type QualificationDeviceEvidence added in v0.2.0 

type QualificationDeviceEvidence struct {
	Path     string `json:"path"`
	Present  bool   `json:"present"`
	Readable bool   `json:"readable"`
	Writable bool   `json:"writable"`
}

type QualificationEvidence added in v0.2.0 

type QualificationEvidence struct {
	SchemaVersion    string                    `json:"schemaVersion"`
	SourceCommit     string                    `json:"sourceCommit"`
	RepositoryDirty  bool                      `json:"repositoryDirty"`
	Suite            string                    `json:"suite"`
	PassCount        int64                     `json:"passCount"`
	WallClockSeconds int64                     `json:"wallClockSeconds"`
	Host             QualificationHostEvidence `json:"host"`
	QualifiedAt      string                    `json:"qualifiedAt"`
}

func DecodeQualificationEvidence added in v0.2.0 

func DecodeQualificationEvidence(data []byte) (QualificationEvidence, error)

func (QualificationEvidence) Validate added in v0.2.0 

func (evidence QualificationEvidence) Validate() error

func (QualificationEvidence) ValidateForRelease added in v0.2.0 

func (evidence QualificationEvidence) ValidateForRelease(sourceCommit string) error

type QualificationFilesystemEvidence added in v0.2.0 

type QualificationFilesystemEvidence struct {
	Mount string `json:"mount"`
	Type  string `json:"type"`
}

type QualificationHostEvidence added in v0.2.0 

type QualificationHostEvidence struct {
	Platform            string                          `json:"platform"`
	KVM                 QualificationDeviceEvidence     `json:"kvm"`
	TUN                 QualificationDeviceEvidence     `json:"tun"`
	WorkspaceFilesystem QualificationFilesystemEvidence `json:"workspaceFilesystem"`
}

type Reference 

type Reference struct {
	Location string `json:"location"`
	Digest   string `json:"digest"`
}

Reference identifies immutable bytes at a public HTTPS location.

type SDKArtifact 

type SDKArtifact struct {
	Identity   Identity  `json:"identity"`
	Coordinate string    `json:"coordinate"`
	Package    Reference `json:"package"`
}

type SignedComponent added in v0.1.3 

type SignedComponent struct {
	ArtifactID             string   `json:"artifactId"`
	ManifestDigest         string   `json:"manifestDigest"`
	MandatoryGuestFeatures []string `json:"mandatoryGuestFeatures"`
}

SignedComponent is one independently selected component bound by the signed top-level microVM manifest.

type StandardBundleArtifact 

type StandardBundleArtifact struct {
	Identity Identity                  `json:"identity"`
	Name     string                    `json:"name"`
	Document Reference                 `json:"document"`
	Profiles []StandardProfileIdentity `json:"profiles"`
}

type StandardProfileIdentity 

type StandardProfileIdentity struct {
	Name       string `json:"name"`
	Revision   int64  `json:"revision"`
	SpecDigest string `json:"specDigest"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.