Documentation
¶
Overview ¶
Package fetch reads published Kit descriptors and image metadata from OCI registries. Credentials, transport, and platform selection belong to Client.
Assemble is the single-call runtime API: Kit requests and Options produce selected declarations, image metadata, and final container settings. It defaults to Docker credentials and known capabilities; supply Options.Loader for another store or Options.CapabilitySelector for the runtime's actual claims and policy. Options.OnProgress reports stages. Client.LoadKit supplies a loader with custom credentials and platform. Source-form references (directories, git URLs) use a custom loader that builds the Kit and supplies its runtime image reference in LoadedKit.Image. The caller's reference remains the identity for resolution, diagnostics and locks.
Layer validation is opt-in: set Options.LayerValidator to DefaultLayerValidator for the built-in integrity, safe-extraction, inventory-limit, and cross-Kit file collision checks. A custom LayerValidator can use a runtime's verified store. Nil enables metadata-only assembly for consent-time resolution or images already checked by the caller. It never calls LayerLoader and preserves metadata and descriptor validation and the same Result. The caller remains responsible for layer integrity, safe extraction, resource limits, and cross-Kit collisions before using the image.
Resolve fetches a closed set of requests, resolves create arguments, validates every input, orders the dependency graph, selects capability groups, reconciles the selected descriptors with spec.Compose, and validates the final descriptor. ResolvePartial performs the same checks while allowing a mixin-only set. There is no validation bypass.
WithCapabilitySelector supplies runtime decisions over expanded entries. Callbacks receive the operation context, the owning Kit's expanded descriptor (including DisplayName), and the capability, both passed by value. They return a spec.CapabilityDecision; messages survive in selection records and required-rejection diagnostics. The default selector accepts this library's known types; runtimes should supply their actual claims with spec.Supported or a stricter callback. Resolved.Selections retains published descriptors, their original bytes, and create-time decisions. Resolved.Kits retains only selected contributions, pinned image identities, resolved arguments, and each Kit's Env exports in dependency order. Resolved.ContainerEnv contains their conflict-checked union for container creation; these override image defaults at runtime. Resolved.Warnings contains advisory findings from final validation.
LoadImage implements assemble.ImageLoader using the same credentials and platform as descriptor resolution. Pass it to assemble.Assemble together with Resolved.Kits to load the pinned images and compose their metadata. Resolve reads manifests only; LoadImage also reads config blobs. Neither downloads filesystem layers or performs filesystem collision checks.
A complete runnable consumer lives in fetch/example. Publishing a flattened Kit remains spec.Merge's job, with staging owned by the BuildKit frontend.
Index ¶
- Variables
- func DefaultLayerValidator(ctx context.Context, kits []*resolve.Unit, loaded map[string]*LoadedKit, ...) error
- func DockerCredential() (auth.CredentialFunc, error)
- func Units(kits []*Kit) ([]*resolve.Unit, error)
- type Client
- func (c *Client) Fetch(ctx context.Context, ref string) (*Kit, error)
- func (c *Client) LoadImage(ctx context.Context, ref string) (assemble.Input, error)
- func (c *Client) LoadKit(ctx context.Context, ref string) (*LoadedKit, error)
- func (c *Client) Resolve(ctx context.Context, reqs []Request, opts ...ResolveOption) (*Resolved, error)
- func (c *Client) ResolvePartial(ctx context.Context, reqs []Request, opts ...ResolveOption) (*Resolved, error)
- type Kit
- type KitLoader
- type KitSelection
- type LayerLoader
- type LayerValidator
- type LoadedKit
- type Option
- type Options
- type Overrides
- type Progress
- type ProgressState
- type Request
- type ResolveOption
- type Resolved
- type Result
- type Stage
Constants ¶
This section is empty.
Variables ¶
var ErrNotAKit = fmt.Errorf("manifest carries no %s annotation", spec.AnnotationDescriptor)
ErrNotAKit is returned when a reference resolves to an image whose manifest carries no kit descriptor annotation.
Functions ¶
func DefaultLayerValidator ¶
func DefaultLayerValidator(ctx context.Context, kits []*resolve.Unit, loaded map[string]*LoadedKit, report func(Progress)) error
DefaultLayerValidator is the built-in LayerValidator. It verifies blob digests and diff IDs, enforces inventory limits, models safe extraction, and checks cross-Kit file collisions in workload-first image order. Every Kit needs a LayerLoader. It reports inventory and collision stages and closes all streams. Inputs must contain the validated metadata supplied by Assemble.
func DockerCredential ¶
func DockerCredential() (auth.CredentialFunc, error)
DockerCredential reads the credential store `docker login` writes. Compose it inside WithCredential when only some registries should come from that store.
func Units ¶
Units builds the resolver's input from fetched kits.
Each descriptor is copied and its version set to the one the reference's tag supplies, so a merge records the same version the resolver judged. The fetched Kit is left as the registry served it. An explicit Kit.Image is used unchanged; otherwise Reference must be an image reference from which a digest-pinned image can be derived.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client fetches Kit descriptors and image metadata. It is safe for concurrent use.
func New ¶
New returns a client. With no options it reads public registries anonymously, over HTTPS except for a loopback registry.
func (*Client) LoadImage ¶
LoadImage implements assemble.ImageLoader using this client's registry credentials and selected platform. It reads manifests and the config blob, verifies their sizes and digests, and never downloads filesystem layers. Pass the pinned image references in Resolved.Kits to avoid tag movement between descriptor resolution and image assembly.
func (*Client) LoadKit ¶
LoadKit implements KitLoader with this client's credentials and platform. Image metadata is loaded by the resolved digest to prevent tag movement between descriptor and image reads. Filesystem layers are opened lazily.
func (*Client) Resolve ¶
func (c *Client) Resolve(ctx context.Context, reqs []Request, opts ...ResolveOption) (*Resolved, error)
Resolve fetches the requests, resolves them as a runnable set — exactly one workload — and merges their descriptors. The result is always validated in effective form before returning. WithEnvironment supplies image defaults and runtime overrides for kit.env references; without it, only Kit argument exports are available to environment expansion.
Each kit's create-phase args are resolved and expanded before the composition, which is what spec.Compose requires of a contribution. A required arg with no value is an error, and a value that is still a ${{ kit.args.* }} reference is refused: an assembled spec has no set declaration left to bound a re-export. Build-phase args are already baked into the annotation. An env: export is returned on Resolved.ContainerEnv, because clearing the declaration would otherwise drop it.
Contributions are ordered by the dependency graph, providers before the kits that require them, which is the order declaration merge means by "first".
func (*Client) ResolvePartial ¶
func (c *Client) ResolvePartial(ctx context.Context, reqs []Request, opts ...ResolveOption) (*Resolved, error)
ResolvePartial is Resolve for a set that does not have to be runnable. A set of mixins yields a mixin descriptor and the expanded Kits. To add a workload later, resolve the original requests with that workload; the result's descriptor alone does not retain per-Kit declarations. More than one workload is still an error.
type Kit ¶
type Kit struct {
// Reference is the reference the caller named.
Reference string
// Digest is the digest the reference resolved to. A multi-platform
// kit pins the index; a single-platform kit pins its manifest.
Digest string
// Image is the runtime-resolvable reference for this Kit's content.
// When empty, Units derives a digest-pinned image from Reference and Digest.
Image string
// Descriptor is the published descriptor.
Descriptor *spec.Descriptor
// Raw is the annotation bytes Descriptor was decoded from, which
// ValidatePublished needs alongside the struct.
Raw []byte
}
Kit is one published kit with its consumption reference.
type KitLoader ¶
KitLoader supplies verified metadata for the requested reference. It owns authentication, platform selection, and its backing store. The returned digest pins the requested manifest or index, not a subsequently moved tag. Assemble always validates declarations. DefaultLayerValidator verifies both blob digests and diff IDs when selected as Options.LayerValidator.
type KitSelection ¶
type KitSelection struct {
Reference string
// PublishedDescriptor is the decoded published descriptor before argument
// and environment expansion or capability selection. It retains argument
// declarations.
PublishedDescriptor *spec.Descriptor
// PublishedBytes holds the exact published descriptor bytes, preserving
// source formatting for diagnostics and persistence.
PublishedBytes []byte
Selection spec.Selection
}
KitSelection retains the source needed to explain or persist a decision.
type LayerLoader ¶
type LayerLoader func(ctx context.Context, layer ocispec.Descriptor) (io.ReadCloser, error)
LayerLoader opens a fresh stream of a manifest layer in its original compression. Reads must honor ctx; the caller closes the returned stream.
type LayerValidator ¶
type LayerValidator func(ctx context.Context, kits []*resolve.Unit, loaded map[string]*LoadedKit, report func(Progress)) error
LayerValidator checks the whole Kit set, including cross-Kit effects. Assemble calls it once after validating metadata and resolving declarations. kits contains selected, dependency-ordered units; loaded maps their original references to verified metadata and optional layer readers. Treat both as read-only. A validator returns any failure and honors ctx. It may report progress synchronously through report when non-nil.
type LoadedKit ¶
type LoadedKit struct {
Digest digest.Digest
Manifest ocispec.Manifest
Config ocispec.Image
// Image is the runtime-resolvable reference for this Kit's content, such
// as the store-local tag a source Kit was built under. The loader must
// keep it consistent with the returned digest and metadata. When empty,
// Assemble derives a digest-pinned image from the request reference.
Image string
// Descriptor is the published annotation, including an index annotation when
// present. If empty, Assemble reads the selected manifest's annotation.
Descriptor []byte
// LayerLoader opens a fresh stream of the blob as described by the manifest,
// with its original compression. DefaultLayerValidator closes each returned stream.
// Nil is allowed for metadata-only assembly; DefaultLayerValidator requires it.
LayerLoader LayerLoader
}
LoadedKit keeps descriptor identity and image metadata together. Its data must remain stable for the duration of Assemble; Assemble does not mutate it.
type Option ¶
type Option func(*config) error
Option configures a Client. Later options win.
func WithCredential ¶
func WithCredential(fn auth.CredentialFunc) Option
WithCredential supplies registry credentials. Without it, requests are anonymous, which is enough for a public registry.
The function receives the registry host (host:port) the request is about to authenticate to. Return auth.EmptyCredential for a host that should stay anonymous.
func WithDockerCredentials ¶
func WithDockerCredentials() Option
WithDockerCredentials authenticates with DockerCredential.
func WithPlainHTTP ¶
func WithPlainHTTP() Option
WithPlainHTTP reaches every registry over HTTP.
A loopback registry does this without the option: the request never leaves the machine. Anywhere else, plain HTTP is a choice about a network someone else can be on, so it has to be asked for.
func WithPlatform ¶
WithPlatform selects the platform for descriptor and image reads. Descriptor resolution may use an index annotation without opening its platform manifest; LoadImage always reads the selected image and config. The default is linux on this process's architecture.
func WithTransport ¶
func WithTransport(rt http.RoundTripper) Option
WithTransport sets the HTTP transport under the registry client. The default retry policy still wraps it. Nil uses http.DefaultTransport.
type Options ¶
type Options struct {
Loader KitLoader
// CapabilitySelector receives the operation context, expanded owning Kit
// descriptor (including DisplayName), and capability. It decides availability
// and policy without applying effects. Descriptor and capability inputs are
// passed by value.
// Nil accepts KnownCapabilities; a runtime with fewer implementations supplies
// spec.Supported with its actual claims. Groups remain atomic.
CapabilitySelector spec.SelectCapability
Overrides Overrides
// LayerValidator checks the complete set after metadata composition and
// descriptor resolution. Nil skips layer checks without calling LayerLoader;
// the caller is responsible for integrity, safe extraction, resource limits,
// and cross-Kit collisions before using the image. Use DefaultLayerValidator for
// the built-in checks or supply a validator backed by the runtime's store.
LayerValidator LayerValidator
// OnProgress receives serialized callbacks on the calling goroutine. It must
// return promptly; cancellation uses Assemble's context. Nil disables events.
OnProgress func(Progress)
}
Options configures Assemble. Its zero value loads from registries using Docker credentials and accepts the library's known capability types. Layer validation is opt-in; set LayerValidator to DefaultLayerValidator to run the built-in layer integrity, extraction, and collision checks.
type Overrides ¶
type Overrides struct {
// Env adds or replaces values after image defaults and Kit argument exports.
Env map[string]string
// WorkingDir replaces the workload working directory when non-nil.
// A replacement must be an absolute container path.
WorkingDir *string
}
Overrides applies to container creation, not the reusable image defaults.
type Progress ¶
type Progress struct {
Stage Stage
State ProgressState
Reference string
Layer digest.Digest
}
Progress describes one stage transition. Reference and Layer identify work when applicable. It never includes environment values or file contents; detailed errors are returned by Assemble. Inventory events include cache replays, which consume the operation budget without reopening the blob.
type ProgressState ¶
type ProgressState string
const ( ProgressStarted ProgressState = "started" ProgressCompleted ProgressState = "completed" ProgressFailed ProgressState = "failed" )
type Request ¶
type Request struct {
// Reference is the caller's Kit identity. Client.Resolve requires an OCI
// reference; Assemble can use source references with a custom KitLoader.
Reference string
Args map[string]string
}
Request is one kit to resolve. Args are that kit's create-phase values, keyed by its own arg names, so two kits that declare the same name still receive their own values.
type ResolveOption ¶
type ResolveOption func(*resolveOptions)
ResolveOption configures create-time descriptor selection.
func WithCapabilitySelector ¶
func WithCapabilitySelector(selector spec.SelectCapability) ResolveOption
WithCapabilitySelector lets a runtime decide each expanded request. The callback receives the operation context and the owning Kit's expanded descriptor, including DisplayName and all declarations. Descriptor and capability inputs are passed by value. The library retains atomic groups, ordering, validation, and source records. Decision messages are recorded for each member and included in required rejection errors.
func WithEnvironment ¶
func WithEnvironment(defaults, overrides map[string]string) ResolveOption
WithEnvironment supplies composed image defaults and runtime overrides for Resolve and ResolvePartial. Kit argument exports replace defaults, and overrides win last. Nil maps are empty; empty values are present values. The maps are copied when this option is constructed. Resolve does not load image configs or read the host environment. ContainerEnv still contains only Kit argument exports; callers apply the same precedence at container creation.
type Resolved ¶
type Resolved struct {
// Selections records decisions in dependency order, alongside the published
// descriptors. Kits contains expanded, selected contributions.
Selections []KitSelection
// Descriptor is the reconciled, selected declaration set. It does not retain
// per-Kit provenance; use Kits where a capability requires attribution.
Descriptor *spec.Descriptor
// Kits are selected, unmerged contributions in dependency order, providers before
// requirers (including the workload wherever its dependencies put it).
// Each retains its consumption reference, pinned image identity, and
// resolved create arguments and their Env exports, including defaults.
// Descriptor.Args is cleared because the values have already been applied.
// This is declaration order; image layers start with the workload.
// A Kit can contribute several selected lifecycle/context entries. Apply
// lifecycle from Descriptor; use spec.AgentContextsOf for per-Kit bodies.
Kits []*resolve.Unit
// ContainerEnv contains resolved env: argument exports. Apply them as
// environment overrides when creating the container, after the image's
// environment defaults. They are not baked into the assembled image.
// This is the union of Kits' Env maps. Two Kits exporting different
// values for the same name is an error.
ContainerEnv map[string]string
// Warnings contains advisory findings from validating the merged
// descriptor.
Warnings []string
}
Resolved is a runtime composition. Keep Kits alongside Descriptor so capability handlers can inspect each contributor's declarations.
type Result ¶
type Result struct {
Image *assemble.Image
Resolved *Resolved
// Environment is the full image-default + arg-export + override snapshot.
// Values are literal; kit.env references in capability configs use this snapshot.
Environment map[string]string
WorkingDir string
}
Result contains the image, selected declarations, and container settings. Persist Resolved.Descriptor and Resolved.Selections for restart; recreate resolves and selects afresh. Use Resolved.Kits with resolve.Resolve and resolve.LockFrom for permission checks and locking.
func Assemble ¶
Assemble loads a closed set of Kit references, composes image defaults, expands and selects declarations using the final container environment, and invokes Options.LayerValidator when non-nil. It does not publish blobs, create a container, or apply capabilities. Image.Manifest and Image.WriteMetadata serialize consistent image metadata; Environment and WorkingDir are applied separately at container creation.
type Stage ¶
type Stage string
Stage identifies work independently of a caller's display strings.
const ( StageLoad Stage = "load" // StageResolve includes arg and environment expansion, validation, atomic // capability selection, and validation of the composed descriptor. StageResolve Stage = "resolve" StageCompose Stage = "compose" StageInventory Stage = "inventory" StageCollisions Stage = "collisions" )