Documentation
¶
Overview ¶
Package conformance is an independent reader for the DevProof bundle format.
It exists to answer one question: does the format specification, read on its own, describe the artifacts DevProof actually produces? A test that checks a writer against its own reader proves only that the two agree. If both share a constant, a sort order, or an encoding helper, they share its bugs, and a round trip passes while the artifact is unreadable by anyone else.
So this package is deliberately built from nothing but the standard library and docs/bundle-format.md. It imports no other DevProof package — not the media-type constants, not the canonical encoders, not the digest helpers. Every value it compares against is written out here from the specification text, and every structure it parses it parses again from scratch. Where this package and the main implementation disagree, one of them is wrong, and finding out which is the entire point.
It is intentionally simple and unoptimized. It buffers what a streaming reader would not, because being obviously correct matters more here than being fast, and a second implementation that is clever enough to be wrong in the same way as the first has no value.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BlobFetcher ¶
BlobFetcher supplies a blob by digest.
The digest is the caller's to verify or not; this package verifies every blob it receives regardless, which is what lets the same code check a layout on disk and a response from a registry.
type FileRecord ¶
FileRecord is one canonical file.
type Report ¶
type Report struct {
// ManifestDigest is the subject identity: sha256 over the manifest bytes.
ManifestDigest string
// TreeDigest is recomputed here from the layer, not read from the config.
TreeDigest string
// ConfigTreeDigest is what the config claimed.
ConfigTreeDigest string
FileCount int64
TotalSize int64
// Files is the inventory as recomputed from the layer.
Files []FileRecord
}
Report is what an independent read established.
func VerifyLayout ¶
VerifyLayout reads a bundle from an OCI image layout and checks it against the format specification.
reference selects the subject: a tag matched against org.opencontainers.image.ref.name, or a "sha256:..." digest. An empty reference is accepted only when the layout holds exactly one manifest, because guessing which of several a caller meant is how the wrong artifact gets verified.
func VerifyManifest ¶
func VerifyManifest(manifestBytes []byte, fetch BlobFetcher) (*Report, error)
VerifyManifest checks a manifest and everything it references.
Source Files