README
¶
artifacts
Describe completed package files with canonical package coordinates, an OCI-compatible content digest, and a byte count. Optional filename and media type labels stay attached to the value without being treated as paths or detected content.
Install
go get github.com/git-pkgs/artifacts
Construction
Use New after a package file has been read and hashed:
artifact, err := artifacts.New(
"pkg:npm/lodash@4.17.21",
digest.Digest("sha256:9e15e8133c3c58e28e70fb5b3f62f74c2fb542f4391fb4128a4d5656d57e7606"),
318961,
"lodash-4.17.21.tgz",
"application/gzip",
)
New parses the package URL and stores its canonical form. It accepts package URL qualifiers and subpaths. SHA-256, SHA-384, and SHA-512 digests use the OCI form algorithm:hex.
The digest identifies the bytes. The package URL, filename, and media type describe how those bytes are used, so two artifacts may share a digest while carrying different package metadata.
Validation
Call Validate on values received from another component:
artifact := artifacts.Artifact{
PURL: "pkg:pypi/charset-normalizer@3.3.2",
Digest: digest.Digest("sha256:f30c3d80b4c84420e54e1b5f80e5d1db6f39ccf62f5c2b9ea308c67c9cb4f4c1"),
Size: 142373,
Filename: "charset_normalizer-3.3.2-py3-none-any.whl",
MediaType: "application/zip",
}
if err := artifact.Validate(); err != nil {
return err
}
Validation rejects malformed package URLs, unavailable or malformed digest algorithms, and negative sizes. Filename and media type are optional labels. Download URLs, storage paths, hashing, MIME detection, and policy belong to callers.
Development
Run tests, benchmarks, fuzzing, and static checks:
make test
make bench
make fuzz
make lint
License
MIT
Documentation
¶
Overview ¶
Package artifacts describes completed package files.
An Artifact binds package coordinates and optional client metadata to a validated content digest and byte count. Fetching, hashing, storage, and policy remain the caller's responsibility.
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Artifact ¶
type Artifact struct {
PURL string
Digest digest.Digest
Size int64
Filename string
MediaType string
}
Artifact describes a completed package file.
func New ¶
func New(packageURL string, contentDigest digest.Digest, size int64, filename, mediaType string) (Artifact, error)
New constructs a validated Artifact and stores the canonical package URL.
Example ¶
package main
import (
"fmt"
"github.com/git-pkgs/artifacts"
"github.com/opencontainers/go-digest"
)
func main() {
artifact, err := artifacts.New(
"pkg:npm/lodash@4.17.21",
digest.Digest("sha256:9e15e8133c3c58e28e70fb5b3f62f74c2fb542f4391fb4128a4d5656d57e7606"),
318961,
"lodash-4.17.21.tgz",
"application/gzip",
)
if err != nil {
panic(err)
}
fmt.Println(artifact.PURL)
fmt.Println(artifact.Digest)
}
Output: pkg:npm/lodash@4.17.21 sha256:9e15e8133c3c58e28e70fb5b3f62f74c2fb542f4391fb4128a4d5656d57e7606
func (Artifact) Validate ¶
Validate checks that an Artifact has valid package coordinates, digest, and size.
Example ¶
package main
import (
"fmt"
"github.com/git-pkgs/artifacts"
"github.com/opencontainers/go-digest"
)
func main() {
artifact := artifacts.Artifact{
PURL: "pkg:pypi/charset-normalizer@3.3.2",
Digest: digest.Digest("sha256:f30c3d80b4c84420e54e1b5f80e5d1db6f39ccf62f5c2b9ea308c67c9cb4f4c1"),
Size: 142373,
Filename: "charset_normalizer-3.3.2-py3-none-any.whl",
MediaType: "application/zip",
}
fmt.Println(artifact.Validate() == nil)
}
Output: true
Source Files
Directories