hatchery_build/lib.rs
1//! Remote build and sign for hatchery nodes.
2//!
3//! A node that must not compile locally and must not hold signing secrets asks C2
4//! (`POST /v1/build` on the enrollment listener, signed with its identity key). C2 checks the
5//! node's status and the `build` capability, then asks the build host, which checks admission
6//! again, runs a configured recipe, hashes the artifact and signs a receipt with a key that
7//! never leaves the host.
8
9#[cfg(unix)]
10pub mod host;
11pub mod http;
12pub mod wire;
13
14#[cfg(unix)]
15pub use host::{serve, Admission, BuildError, BuildHost, C2Admission, Recipe, Recipes, Signer};
16pub use wire::{BuildReceipt, BuildResponse, HostRequest, ReceiptError, SignedBuildRequest};