clawft_kernel/workload_pkg/
mod.rs

1//! Signed workload package manifests (mesh-placement-07; ADR-100 section 1,
2//! ADR-099 section 8).
3//!
4//! A workload package is a directory holding a signed manifest envelope
5//! (`cogpkg.json` for cogs) plus the files it lists, each pinned by BLAKE3
6//! hash and size. The envelope is kind-agnostic (`kind = "cog"` today; model
7//! manifests from ADR-101 reuse it with their own body), so signing and
8//! verification never look inside the body beyond what the kind requires.
9//!
10//! Trust (ADR-099 section 8): at least one valid Ed25519 signature from the
11//! pinned WeftOS signer set or an operator-pinned key is required. A
12//! Cognitum ADR-154/155 release record is an optional, opt-in additional
13//! verifier (ADR-100 section 6.2): when enabled and its registry key is
14//! pinned, a valid record bound to one of the package binaries counts as a
15//! signature.
16//!
17//! Layout of a cog package directory:
18//!
19//! ```text
20//! cogpkg.json                 signed envelope (schema weftos.workload-manifest.v1)
21//! cog.toml                    unmodified upstream manifest
22//! aarch64/cog-<id>            one binary per arch
23//! armv7/cog-<id>
24//! attestations/<name>.json    optional external attestations (Cognitum record)
25//! ```
26//!
27//! Files are stored in [`crate::artifact_store::ArtifactStore`] by BLAKE3
28//! hash; the package id is the BLAKE3 hash of the signed statement.
29
30pub mod canonical;
31pub mod codec;
32pub mod cognitum;
33pub mod manifest;
34pub mod pack;
35pub mod sign;
36pub mod store;
37pub mod trust;
38pub mod verify;
39
40#[cfg(test)]
41mod tests;
42
43pub use manifest::{
44    AttestationRef, CogPackageBody, FileRef, KIND_COG, MANIFEST_FILE, MANIFEST_SCHEMA,
45    MAX_MANIFEST_BYTES, ManifestEnvelope, ManifestError, PackageSource, SignatureEntry,
46};
47pub use pack::{CogPackInput, PackError, pack_cog, write_manifest, write_source_build_provenance};
48pub use sign::{key_id_for, sign_envelope, signing_key_from_hex};
49pub use store::{StoredPackage, store_package, verify_stored, verify_stored_in};
50pub use trust::{KeyOrigin, PinnedKey, TrustAnchors, TrustFile};
51pub use verify::{
52    AcceptedSigner, DirSource, FileSource, VerifiedPackage, VerifyError, VerifyPolicy, verify_dir,
53    verify_dir_in, verify_manifest_signatures, verify_manifest_signatures_in, verify_with_source,
54    verify_with_source_in,
55};
clawft_kernel/workload_pkg/mod.rs

clawft_kernel/workload_pkg/
mod.rs
