fetch

package
v3.0.0-m.8 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 2, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Overview

Package fetch reads published Kit descriptors and image metadata from OCI registries. Credentials, transport, and platform selection belong to Client.

Assemble is the single-call runtime API: Kit requests and Options produce selected declarations, image metadata, and final container settings. It defaults to Docker credentials and known capabilities; supply Options.Loader for another store or Options.CapabilitySelector for the runtime's actual claims and policy. Options.OnProgress reports stages. Client.LoadKit supplies a loader with custom credentials and platform. Source-form references (directories, git URLs) use a custom loader that builds the Kit and supplies its runtime image reference in LoadedKit.Image. The caller's reference remains the identity for resolution, diagnostics and locks.

Layer validation is opt-in: set Options.LayerValidator to DefaultLayerValidator for the built-in integrity, safe-extraction, inventory-limit, and cross-Kit file collision checks. A custom LayerValidator can use a runtime's verified store. Nil enables metadata-only assembly for consent-time resolution or images already checked by the caller. It never calls LayerLoader and preserves metadata and descriptor validation and the same Result. The caller remains responsible for layer integrity, safe extraction, resource limits, and cross-Kit collisions before using the image.

Resolve fetches a closed set of requests, resolves create arguments, validates every input, orders the dependency graph, selects capability groups, reconciles the selected descriptors with spec.Compose, and validates the final descriptor. ResolvePartial performs the same checks while allowing a mixin-only set. There is no validation bypass.

WithCapabilitySelector supplies runtime decisions over expanded entries. Callbacks receive the operation context, the owning Kit's expanded descriptor (including DisplayName), and the capability, both passed by value. They return a spec.CapabilityDecision; messages survive in selection records and required-rejection diagnostics. The default selector accepts this library's known types; runtimes should supply their actual claims with spec.Supported or a stricter callback. Resolved.Selections retains published descriptors, their original bytes, and create-time decisions. Resolved.Kits retains only selected contributions, pinned image identities, resolved arguments, and each Kit's Env exports in dependency order. Resolved.ContainerEnv contains their conflict-checked union for container creation; these override image defaults at runtime. Resolved.Warnings contains advisory findings from final validation.

LoadImage implements assemble.ImageLoader using the same credentials and platform as descriptor resolution. Pass it to assemble.Assemble together with Resolved.Kits to load the pinned images and compose their metadata. Resolve reads manifests only; LoadImage also reads config blobs. Neither downloads filesystem layers or performs filesystem collision checks.

A complete runnable consumer lives in fetch/example. Publishing a flattened Kit remains spec.Merge's job, with staging owned by the BuildKit frontend.

Index

Constants

This section is empty.

Variables

View Source
var ErrNotAKit = fmt.Errorf("manifest carries no %s annotation", spec.AnnotationDescriptor)

ErrNotAKit is returned when a reference resolves to an image whose manifest carries no kit descriptor annotation.

Functions

func DefaultLayerValidator

func DefaultLayerValidator(ctx context.Context, kits []*resolve.Unit, loaded map[string]*LoadedKit, report func(Progress)) error

DefaultLayerValidator is the built-in LayerValidator. It verifies blob digests and diff IDs, enforces inventory limits, models safe extraction, and checks cross-Kit file collisions in workload-first image order. Every Kit needs a LayerLoader. It reports inventory and collision stages and closes all streams. Inputs must contain the validated metadata supplied by Assemble.

func DockerCredential

func DockerCredential() (auth.CredentialFunc, error)

DockerCredential reads the credential store `docker login` writes. Compose it inside WithCredential when only some registries should come from that store.

func Units

func Units(kits []*Kit) ([]*resolve.Unit, error)

Units builds the resolver's input from fetched kits.

Each descriptor is copied and its version set to the one the reference's tag supplies, so a merge records the same version the resolver judged. The fetched Kit is left as the registry served it. An explicit Kit.Image is used unchanged; otherwise Reference must be an image reference from which a digest-pinned image can be derived.

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client fetches Kit descriptors and image metadata. It is safe for concurrent use.

func New

func New(opts ...Option) (*Client, error)

New returns a client. With no options it reads public registries anonymously, over HTTPS except for a loopback registry.

func (*Client) Fetch

func (c *Client) Fetch(ctx context.Context, ref string) (*Kit, error)

Fetch reads one kit's published descriptor. It fetches manifests only.

func (*Client) LoadImage

func (c *Client) LoadImage(ctx context.Context, ref string) (assemble.Input, error)

LoadImage implements assemble.ImageLoader using this client's registry credentials and selected platform. It reads manifests and the config blob, verifies their sizes and digests, and never downloads filesystem layers. Pass the pinned image references in Resolved.Kits to avoid tag movement between descriptor resolution and image assembly.

func (*Client) LoadKit

func (c *Client) LoadKit(ctx context.Context, ref string) (*LoadedKit, error)

LoadKit implements KitLoader with this client's credentials and platform. Image metadata is loaded by the resolved digest to prevent tag movement between descriptor and image reads. Filesystem layers are opened lazily.

func (*Client) Resolve

func (c *Client) Resolve(ctx context.Context, reqs []Request, opts ...ResolveOption) (*Resolved, error)

Resolve fetches the requests, resolves them as a runnable set — exactly one workload — and merges their descriptors. The result is always validated in effective form before returning. WithEnvironment supplies image defaults and runtime overrides for kit.env references; without it, only Kit argument exports are available to environment expansion.

Each kit's create-phase args are resolved and expanded before the composition, which is what spec.Compose requires of a contribution. A required arg with no value is an error, and a value that is still a ${{ kit.args.* }} reference is refused: an assembled spec has no set declaration left to bound a re-export. Build-phase args are already baked into the annotation. An env: export is returned on Resolved.ContainerEnv, because clearing the declaration would otherwise drop it.

Contributions are ordered by the dependency graph, providers before the kits that require them, which is the order declaration merge means by "first".

func (*Client) ResolvePartial

func (c *Client) ResolvePartial(ctx context.Context, reqs []Request, opts ...ResolveOption) (*Resolved, error)

ResolvePartial is Resolve for a set that does not have to be runnable. A set of mixins yields a mixin descriptor and the expanded Kits. To add a workload later, resolve the original requests with that workload; the result's descriptor alone does not retain per-Kit declarations. More than one workload is still an error.

type Kit

type Kit struct {
	// Reference is the reference the caller named.
	Reference string

	// Digest is the digest the reference resolved to. A multi-platform
	// kit pins the index; a single-platform kit pins its manifest.
	Digest string

	// Image is the runtime-resolvable reference for this Kit's content.
	// When empty, Units derives a digest-pinned image from Reference and Digest.
	Image string

	// Descriptor is the published descriptor.
	Descriptor *spec.Descriptor

	// Raw is the annotation bytes Descriptor was decoded from, which
	// ValidatePublished needs alongside the struct.
	Raw []byte
}

Kit is one published kit with its consumption reference.

type KitLoader

type KitLoader func(context.Context, string) (*LoadedKit, error)

KitLoader supplies verified metadata for the requested reference. It owns authentication, platform selection, and its backing store. The returned digest pins the requested manifest or index, not a subsequently moved tag. Assemble always validates declarations. DefaultLayerValidator verifies both blob digests and diff IDs when selected as Options.LayerValidator.

type KitSelection

type KitSelection struct {
	Reference string

	// PublishedDescriptor is the decoded published descriptor before argument
	// and environment expansion or capability selection. It retains argument
	// declarations.
	PublishedDescriptor *spec.Descriptor

	// PublishedBytes holds the exact published descriptor bytes, preserving
	// source formatting for diagnostics and persistence.
	PublishedBytes []byte

	Selection spec.Selection
}

KitSelection retains the source needed to explain or persist a decision.

type LayerLoader

type LayerLoader func(ctx context.Context, layer ocispec.Descriptor) (io.ReadCloser, error)

LayerLoader opens a fresh stream of a manifest layer in its original compression. Reads must honor ctx; the caller closes the returned stream.

type LayerValidator

type LayerValidator func(ctx context.Context, kits []*resolve.Unit, loaded map[string]*LoadedKit, report func(Progress)) error

LayerValidator checks the whole Kit set, including cross-Kit effects. Assemble calls it once after validating metadata and resolving declarations. kits contains selected, dependency-ordered units; loaded maps their original references to verified metadata and optional layer readers. Treat both as read-only. A validator returns any failure and honors ctx. It may report progress synchronously through report when non-nil.

type LoadedKit

type LoadedKit struct {
	Digest   digest.Digest
	Manifest ocispec.Manifest
	Config   ocispec.Image

	// Image is the runtime-resolvable reference for this Kit's content, such
	// as the store-local tag a source Kit was built under. The loader must
	// keep it consistent with the returned digest and metadata. When empty,
	// Assemble derives a digest-pinned image from the request reference.
	Image string

	// Descriptor is the published annotation, including an index annotation when
	// present. If empty, Assemble reads the selected manifest's annotation.
	Descriptor []byte
	// LayerLoader opens a fresh stream of the blob as described by the manifest,
	// with its original compression. DefaultLayerValidator closes each returned stream.
	// Nil is allowed for metadata-only assembly; DefaultLayerValidator requires it.
	LayerLoader LayerLoader
}

LoadedKit keeps descriptor identity and image metadata together. Its data must remain stable for the duration of Assemble; Assemble does not mutate it.

type Option

type Option func(*config) error

Option configures a Client. Later options win.

func WithCredential

func WithCredential(fn auth.CredentialFunc) Option

WithCredential supplies registry credentials. Without it, requests are anonymous, which is enough for a public registry.

The function receives the registry host (host:port) the request is about to authenticate to. Return auth.EmptyCredential for a host that should stay anonymous.

func WithDockerCredentials

func WithDockerCredentials() Option

WithDockerCredentials authenticates with DockerCredential.

func WithPlainHTTP

func WithPlainHTTP() Option

WithPlainHTTP reaches every registry over HTTP.

A loopback registry does this without the option: the request never leaves the machine. Anywhere else, plain HTTP is a choice about a network someone else can be on, so it has to be asked for.

func WithPlatform

func WithPlatform(p ocispec.Platform) Option

WithPlatform selects the platform for descriptor and image reads. Descriptor resolution may use an index annotation without opening its platform manifest; LoadImage always reads the selected image and config. The default is linux on this process's architecture.

func WithTransport

func WithTransport(rt http.RoundTripper) Option

WithTransport sets the HTTP transport under the registry client. The default retry policy still wraps it. Nil uses http.DefaultTransport.

type Options

type Options struct {
	Loader KitLoader
	// CapabilitySelector receives the operation context, expanded owning Kit
	// descriptor (including DisplayName), and capability. It decides availability
	// and policy without applying effects. Descriptor and capability inputs are
	// passed by value.
	// Nil accepts KnownCapabilities; a runtime with fewer implementations supplies
	// spec.Supported with its actual claims. Groups remain atomic.
	CapabilitySelector spec.SelectCapability
	Overrides          Overrides
	// LayerValidator checks the complete set after metadata composition and
	// descriptor resolution. Nil skips layer checks without calling LayerLoader;
	// the caller is responsible for integrity, safe extraction, resource limits,
	// and cross-Kit collisions before using the image. Use DefaultLayerValidator for
	// the built-in checks or supply a validator backed by the runtime's store.
	LayerValidator LayerValidator
	// OnProgress receives serialized callbacks on the calling goroutine. It must
	// return promptly; cancellation uses Assemble's context. Nil disables events.
	OnProgress func(Progress)
}

Options configures Assemble. Its zero value loads from registries using Docker credentials and accepts the library's known capability types. Layer validation is opt-in; set LayerValidator to DefaultLayerValidator to run the built-in layer integrity, extraction, and collision checks.

type Overrides

type Overrides struct {
	// Env adds or replaces values after image defaults and Kit argument exports.
	Env map[string]string
	// WorkingDir replaces the workload working directory when non-nil.
	// A replacement must be an absolute container path.
	WorkingDir *string
}

Overrides applies to container creation, not the reusable image defaults.

type Progress

type Progress struct {
	Stage     Stage
	State     ProgressState
	Reference string
	Layer     digest.Digest
}

Progress describes one stage transition. Reference and Layer identify work when applicable. It never includes environment values or file contents; detailed errors are returned by Assemble. Inventory events include cache replays, which consume the operation budget without reopening the blob.

type ProgressState

type ProgressState string
const (
	ProgressStarted   ProgressState = "started"
	ProgressCompleted ProgressState = "completed"
	ProgressFailed    ProgressState = "failed"
)

type Request

type Request struct {
	// Reference is the caller's Kit identity. Client.Resolve requires an OCI
	// reference; Assemble can use source references with a custom KitLoader.
	Reference string
	Args      map[string]string
}

Request is one kit to resolve. Args are that kit's create-phase values, keyed by its own arg names, so two kits that declare the same name still receive their own values.

type ResolveOption

type ResolveOption func(*resolveOptions)

ResolveOption configures create-time descriptor selection.

func WithCapabilitySelector

func WithCapabilitySelector(selector spec.SelectCapability) ResolveOption

WithCapabilitySelector lets a runtime decide each expanded request. The callback receives the operation context and the owning Kit's expanded descriptor, including DisplayName and all declarations. Descriptor and capability inputs are passed by value. The library retains atomic groups, ordering, validation, and source records. Decision messages are recorded for each member and included in required rejection errors.

func WithEnvironment

func WithEnvironment(defaults, overrides map[string]string) ResolveOption

WithEnvironment supplies composed image defaults and runtime overrides for Resolve and ResolvePartial. Kit argument exports replace defaults, and overrides win last. Nil maps are empty; empty values are present values. The maps are copied when this option is constructed. Resolve does not load image configs or read the host environment. ContainerEnv still contains only Kit argument exports; callers apply the same precedence at container creation.

type Resolved

type Resolved struct {
	// Selections records decisions in dependency order, alongside the published
	// descriptors. Kits contains expanded, selected contributions.
	Selections []KitSelection

	// Descriptor is the reconciled, selected declaration set. It does not retain
	// per-Kit provenance; use Kits where a capability requires attribution.
	Descriptor *spec.Descriptor

	// Kits are selected, unmerged contributions in dependency order, providers before
	// requirers (including the workload wherever its dependencies put it).
	// Each retains its consumption reference, pinned image identity, and
	// resolved create arguments and their Env exports, including defaults.
	// Descriptor.Args is cleared because the values have already been applied.
	// This is declaration order; image layers start with the workload.
	// A Kit can contribute several selected lifecycle/context entries. Apply
	// lifecycle from Descriptor; use spec.AgentContextsOf for per-Kit bodies.
	Kits []*resolve.Unit

	// ContainerEnv contains resolved env: argument exports. Apply them as
	// environment overrides when creating the container, after the image's
	// environment defaults. They are not baked into the assembled image.
	// This is the union of Kits' Env maps. Two Kits exporting different
	// values for the same name is an error.
	ContainerEnv map[string]string

	// Warnings contains advisory findings from validating the merged
	// descriptor.
	Warnings []string
}

Resolved is a runtime composition. Keep Kits alongside Descriptor so capability handlers can inspect each contributor's declarations.

type Result

type Result struct {
	Image    *assemble.Image
	Resolved *Resolved
	// Environment is the full image-default + arg-export + override snapshot.
	// Values are literal; kit.env references in capability configs use this snapshot.
	Environment map[string]string
	WorkingDir  string
}

Result contains the image, selected declarations, and container settings. Persist Resolved.Descriptor and Resolved.Selections for restart; recreate resolves and selects afresh. Use Resolved.Kits with resolve.Resolve and resolve.LockFrom for permission checks and locking.

func Assemble

func Assemble(ctx context.Context, requests []Request, options Options) (*Result, error)

Assemble loads a closed set of Kit references, composes image defaults, expands and selects declarations using the final container environment, and invokes Options.LayerValidator when non-nil. It does not publish blobs, create a container, or apply capabilities. Image.Manifest and Image.WriteMetadata serialize consistent image metadata; Environment and WorkingDir are applied separately at container creation.

type Stage

type Stage string

Stage identifies work independently of a caller's display strings.

const (
	StageLoad Stage = "load"
	// StageResolve includes arg and environment expansion, validation, atomic
	// capability selection, and validation of the composed descriptor.
	StageResolve    Stage = "resolve"
	StageCompose    Stage = "compose"
	StageInventory  Stage = "inventory"
	StageCollisions Stage = "collisions"
)

Directories

Path Synopsis
Command example assembles published Kits and checks their layer file collisions through the runtime convenience API.
Command example assembles published Kits and checks their layer file collisions through the runtime convenience API.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL