Documentation
¶
Overview ¶
Package strata provides a Go library API for Strata environment resolution.
It is the integration surface for external tools (e.g. spore.host/spawn) that need to resolve a software selection into a deployable lockfile without importing internal packages directly.
Typical usage:
c, err := strata.NewClient(ctx, strata.Options{RegistryURL: "s3://strata-registry"})
lockfile, err := c.Resolve(ctx, profile, strata.ResolveOptions{})
uri, err := c.UploadLockfile(ctx, lockfile)
// set EC2 tag strata:lockfile-s3-uri = uri, then launch instance
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LockfileUserData ¶
LockfileUserData YAML-encodes the lockfile for direct use as EC2 user-data.
strata-agent treats user-data containing a valid YAML LockFile as the highest-priority lockfile source — no S3 tag needed. This is simpler than UploadLockfile for small environments but returns an error if the encoded YAML exceeds the 16 KB EC2 user-data hard limit. Use UploadLockfile for large lockfiles or when keeping user-data free for other content.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client provides Strata catalog and resolution operations backed by an S3 registry.
func (*Client) Resolve ¶
func (c *Client) Resolve(ctx context.Context, profile *spec.Profile, opts ResolveOptions) (*spec.LockFile, error)
Resolve transforms a Profile into a fully resolved LockFile.
Base capabilities are synthesised from profile.Base.OS without a live AWS probe, so resolution succeeds offline.
This offline resolve does NOT verify any signature. The resolver is built with no Rekor verifier, and stage 7 in that configuration only checks that each layer names a non-empty Bundle and RekorEntry — it parses no bundle, checks no signature, and inspects no certificate identity. A placeholder such as "pending-initial-build" passes. So a lockfile produced here is not a trust decision: verify it out of band (e.g. "strata verify --rekor", which fetches and checks the bundle) before relying on it. Making the offline path verify bundle payloads is tracked in #60/#62.
profile.Base.OS must be a recognised alias ("al2023", "rocky9", "ubuntu24").
func (*Client) UploadLockfile ¶
UploadLockfile stores the lockfile in S3 under locks/<environmentID>.yaml and returns its S3 URI (e.g. "s3://strata-registry/locks/abc123.yaml").
Set the returned URI as EC2 instance tag strata:lockfile-s3-uri; strata-agent fetches and applies the lockfile at boot.
UploadLockfile requires a Client created with NewClient (it needs a real S3Client).
type Options ¶
type Options struct {
// RegistryURL is the S3 URL of the Strata registry bucket.
// Example: "s3://strata-registry"
RegistryURL string
// StrataVersion is embedded in generated lockfiles.
// Optional; defaults to empty string.
StrataVersion string
// Warnings, if non-nil, receives the resolver's advisory warnings — most
// importantly that a resolved formation carries a placeholder attestation
// ("pending-initial-build") and so has no Rekor entry, which is the only
// signal that the environment is not cryptographically verifiable (the
// placeholder is never written into the lockfile, #46/#138). It is left nil
// by default deliberately: a library that writes to the process's stderr
// unbidden is a surprise, so the caller opts in by supplying a writer
// (e.g. os.Stderr).
Warnings io.Writer
}
Options configures a Client.
type ResolveOptions ¶
type ResolveOptions struct {
// AMI is the EC2 AMI ID to embed in the lockfile's BaseCapabilities.
// Optional; if empty, "ami-unknown" is used. Does not affect which
// layers are selected — only the recorded metadata.
AMI string
}
ResolveOptions controls how a Profile is resolved to a LockFile.
Source Files