Documentation
¶
Overview ¶
Package oci defines the plugin release format on the shared OCI transport.
Index ¶
- Constants
- func BuildIndex(directory string, descriptors *extension.Registry, opts ...Option) (v1.ImageIndex, error)
- func CheckBundlePath(path string) error
- func Pack(directory, output string, descriptors *extension.Registry, opts ...Option) error
- func ParseDestination(destination string) (name.Repository, error)
- func ParseDigestReference(value string) (name.Digest, error)
- func ValidatePackage(directory string, definition *manifest.Config) error
- type BundleFile
- type DeletionTarget
- type Option
- type Release
Constants ¶
const ( // ConfigMediaType identifies a plugin platform image's static configuration. ConfigMediaType types.MediaType = "application/vnd.atmos.plugin.config.v1+json" // BundleMediaType identifies a bounded, uncompressed package archive. BundleMediaType types.MediaType = "application/vnd.atmos.plugin.bundle.v1+tar" )
Variables ¶
This section is empty.
Functions ¶
func BuildIndex ¶
func BuildIndex(directory string, descriptors *extension.Registry, opts ...Option) (v1.ImageIndex, error)
BuildIndex assembles a deterministic release with one payload per declared platform. Every payload uses exactly the same manifest and schema bytes.
func CheckBundlePath ¶
CheckBundlePath rejects any path that must never ship inside a plugin release: hidden files and directories (.git, .terraform, .atmos, .env, .aws, .ssh, ...), credential, key, and state files, and anything that is not a canonical relative slash path. The same rule applies when packing, publishing, and extracting.
func Pack ¶
Pack assembles prebuilt platform binaries into an OCI layout. It never builds source or starts a plugin, and refuses to overwrite an existing output.
func ParseDestination ¶
func ParseDestination(destination string) (name.Repository, error)
ParseDestination validates a publish destination: an OCI repository without a tag or digest. The release tag always comes from the manifest version, so a tag in the destination would be ignored or contradict it.
func ParseDigestReference ¶
ParseDigestReference validates a `registry/repository@sha256:digest` reference.
func ValidatePackage ¶
ValidatePackage applies the packaging guards that need no built binary and no code execution: the path guard on every declared executable and schema file, and the native-format check on each platform executable that already exists. A platform whose binary has not been built yet is skipped; its path is still checked.
Types ¶
type BundleFile ¶
type BundleFile struct {
Platform string `json:"platform,omitempty" yaml:"platform,omitempty"`
Path string `json:"path" yaml:"path"`
Size int64 `json:"size" yaml:"size"`
Mode string `json:"mode" yaml:"mode"`
}
BundleFile describes one file inside a published platform payload.
func LayoutFiles ¶
func LayoutFiles(layout string) ([]BundleFile, error)
LayoutFiles lists the files inside every platform payload of a local OCI layout.
type DeletionTarget ¶
type DeletionTarget struct {
Repository string
Digest string
// Tags are the repository tags that currently resolve to the digest.
Tags []string
}
DeletionTarget describes what removing a digest would affect.
func DescribeDeletion ¶
func DescribeDeletion(ctx context.Context, client atmosoci.Registry, reference name.Digest) DeletionTarget
DescribeDeletion lists the tags that point at the digest so the caller can show them before a destructive delete. Tag lookups are best effort: a registry that cannot list tags still allows deletion by digest.
type Option ¶
type Option func(*options)
Option adjusts how packing and publishing verify a release.
func WithExecutableFormatCheck ¶
func WithExecutableFormatCheck() Option
WithExecutableFormatCheck requires every platform executable to be a native ELF, Mach-O, or PE binary for its declared operating system and architecture. The path guard and the exact payload file set are always enforced.
type Release ¶
type Release struct {
Name string `json:"name" yaml:"name"`
Version string `json:"version" yaml:"version"`
Digest string `json:"digest" yaml:"digest"`
Platforms map[string]v1.Descriptor `json:"platforms" yaml:"platforms"`
Definition *manifest.Config `json:"manifest" yaml:"manifest"`
Index v1.ImageIndex `json:"-" yaml:"-"`
Manifest []byte `json:"-" yaml:"-"`
// contains filtered or unexported fields
}
Release records immutable metadata for all platforms without executing code.
func Inspect ¶
func Inspect(index v1.ImageIndex, expected string) (*Release, error)
Inspect verifies the release index and every platform's static metadata. Only the selected platform's executable layer needs to be downloaded later.
func Publish ¶
func Publish(ctx context.Context, client atmosoci.Registry, directory, destination string, descriptors *extension.Registry, opts ...Option) (*Release, error)
Publish validates all platform payloads and writes the immutable version tag. Publishing identical bytes is idempotent. Publishers must serialize releases per repository because the OCI distribution API has no tag compare-and-swap.
func (*Release) Extract ¶
Extract verifies and materializes one platform into a fresh staging directory. Callers atomically promote the directory only after extension validation.
func (*Release) Files ¶
func (r *Release) Files() ([]BundleFile, error)
Files lists every file in every platform payload with its size and mode, sorted by platform and path. The listing is read from the verified release layers, so it shows exactly what a registry receives. Publish fills it while validating.
func (*Release) VerifyInstalled ¶
VerifyInstalled compares executable and metadata files to the digest-verified cached payload. A mutable receipt cannot substitute for artifact integrity.
Source Files
Directories