Module workload_pkg 

Signed workload package manifests (mesh-placement-07; ADR-100 section 1, ADR-099 section 8).

A workload package is a directory holding a signed manifest envelope (cogpkg.json for cogs) plus the files it lists, each pinned by BLAKE3 hash and size. The envelope is kind-agnostic (kind = "cog" today; model manifests from ADR-101 reuse it with their own body), so signing and verification never look inside the body beyond what the kind requires.

Trust (ADR-099 section 8): at least one valid Ed25519 signature from the pinned WeftOS signer set or an operator-pinned key is required. A Cognitum ADR-154/155 release record is an optional, opt-in additional verifier (ADR-100 section 6.2): when enabled and its registry key is pinned, a valid record bound to one of the package binaries counts as a signature.

Layout of a cog package directory:

cogpkg.json                 signed envelope (schema weftos.workload-manifest.v1)
cog.toml                    unmodified upstream manifest
aarch64/cog-<id>            one binary per arch
armv7/cog-<id>
attestations/<name>.json    optional external attestations (Cognitum record)

Files are stored in crate::artifact_store::ArtifactStore by BLAKE3 hash; the package id is the BLAKE3 hash of the signed statement.

Re-exports

pub use manifest::AttestationRef;

pub use manifest::CogPackageBody;

pub use manifest::FileRef;

pub use manifest::KIND_COG;

pub use manifest::MANIFEST_FILE;

pub use manifest::MANIFEST_SCHEMA;

pub use manifest::MAX_MANIFEST_BYTES;

pub use manifest::ManifestEnvelope;

pub use manifest::ManifestError;

pub use manifest::PackageSource;

pub use manifest::SignatureEntry;

pub use pack::CogPackInput;

pub use pack::PackError;

pub use pack::pack_cog;

pub use pack::write_manifest;

pub use pack::write_source_build_provenance;

pub use sign::key_id_for;

pub use sign::sign_envelope;

pub use sign::signing_key_from_hex;

pub use store::StoredPackage;

pub use store::store_package;

pub use store::verify_stored;

pub use store::verify_stored_in;

pub use trust::KeyOrigin;

pub use trust::PinnedKey;

pub use trust::TrustAnchors;

pub use trust::TrustFile;

pub use verify::AcceptedSigner;

pub use verify::DirSource;

pub use verify::FileSource;

pub use verify::VerifiedPackage;

pub use verify::VerifyError;

pub use verify::VerifyPolicy;

pub use verify::verify_dir;

pub use verify::verify_dir_in;

pub use verify::verify_manifest_signatures;

pub use verify::verify_manifest_signatures_in;

pub use verify::verify_with_source;

pub use verify::verify_with_source_in;

Modules

canonical

Canonical JSON: recursively sorted object keys, compact separators, UTF-8, no trailing newline, integers only.

codec

Small, strict hex and base64 codecs (the kernel carries no hex/base64 crates, and these inputs are all short, bounded key material).

cognitum

Optional Cognitum ADR-154/155 release-record verifier (ADR-100 section 6.2). Off unless super::VerifyPolicy::accept_cognitum_release is set.

manifest

Manifest envelope and the cog package body (ADR-100 section 1).

pack

cog-pack: build a cog package directory from a cog source directory (vendor/cogs/src/cogs/<id>, holding the unmodified cog.toml) plus one binary per arch (from our fork build or upstream released binaries).

sign

Ed25519 signing of manifest envelopes (ADR-025 key type).

store

Persist verified packages in ArtifactStore and re-verify from it.

trust

Trust anchors: the pinned WeftOS signer set plus operator-pinned keys (ADR-099 section 8.1), and optionally pinned Cognitum release keys (ADR-100 section 6.2).

verify

Package verification: manifest frame, signatures against pinned anchors, then every listed file by size and BLAKE3.