Crate eggup_core 

Policy-neutral local mechanics for verified multi-artifact updates.

The core crate deliberately does not fetch bytes, manage services, or choose release policy. Callers acquire artifacts and prove destination ownership; the core provides validated preparation, SHA-256 integrity verification, bounded candidate validation, locked ownership revalidation, staged-digest revalidation, and atomic-feeling multi-artifact commit with rollback.

Integrity here is checksum evidence only. No authenticity or signature claim is made: there is no authenticity verifier in this crate.

Runnable flows live in examples/: one-member, multi-member, custom validator, ownership verifier, and receipt interpretation.

Structs

AbsentOnlyVerifier

A verifier that permits creation only: Absent when missing, Foreign when anything exists. Useful for first-install flows that must never replace an existing file.

AllValidators

A validator composition that requires every contained validator to pass.

ArtifactMember

One explicitly acquired local artifact and its intended destination.

ArtifactSet

A non-empty set of artifact members with unique member identities.

BoundSources

Already-open member objects staged without pathname re-resolution.

CommandOutput

A bounded child-process result with timeout and overflow state.

CommandSpec

An argv-based candidate command with bounded execution policy.

CommitOwnership

Commit-time ownership contract: who proves ownership and whether absent destinations may be created.

CrossMemberAgreementValidator

A named helper for requiring one exact identity across all bundle members.

CurrentExecutable

The exact executable that is currently running, bound once to a canonical target.

ExactDigestVerifier

A verifier that proves ownership by exact prior SHA-256 content.

ExactIdentityValidator

A strict exact-output check for one or more staged member programs.

ExistingAsOwnedVerifier

A verifier that treats an existing regular file as owned.

FailureReport

A bounded structured report describing one transaction failure.

InstallPlan

An explicit installation root and a coherent artifact set ready for private preparation.

IntegrityResult

One member’s bounded integrity result.

LockObservation

A bounded, read-only observation of one exact lock record.

MemberId

A stable identity for one member of a deployment bundle.

MutationLock

An exclusive ownership record for one installation domain.

PreparedTransaction

A validated, privately staged transaction that has not performed live mutation.

ProductId

A validated opaque product identifier owned by the consumer.

ReleaseId

A validated opaque release identifier owned by the consumer.

Sha256Manifest

A parsed single-entry SHA-256 sidecar or manifest line.

TransactionReceipt

Evidence describing the terminal result of a transaction attempt.

ValidatedTransaction

A transaction whose integrity-verified candidates passed a consumer validator.

VerifiedTransaction

A prepared transaction whose declared integrity requirements have passed.

Enums

AbsentPolicy

Authorization to create a destination that is currently Ownership::Absent.

CleanupDisposition

How transaction-owned temporary evidence was handled.

Error

Errors produced while validating a local update plan or preparing private stage state.

FailureCategory

A stable machine-readable failure category.

FailurePhase

The transaction phase that produced a failure.

FileKind

The file kind expected for an artifact member.

IntegrityRequirement

A declared integrity requirement. Computation is provided by the verification layer.

IntegrityStatus

The result of applying a member’s integrity declaration to staged bytes.

LockStatus

The observable state of an installation-domain lock record.

Ownership

The canonical ownership classification for a live destination.

PermissionsIntent

The permission intent to apply to a staged member.

PostCommitFailurePolicy

Caller policy for a failed post-commit check.

RecoveryError

The result type used by the recovery-aware entry points.

StagePlacement

Where transaction-owned staging state is created for a plan.

StaleLockDecision

The caller’s verdict about one observed lock record.

TransactionDisposition

The terminal disposition of a commit attempt.

Traits

CandidateValidator

A candidate validator supplied by a consumer or by eggup-core helpers.

OwnershipVerifier

Consumer-supplied proof that a live destination belongs to this deployment.

StaleLockVerifier

Consumer-supplied proof that one observed lock record is stale.

Functions

hash_file

Streams a local file through SHA-256 without buffering the complete artifact.

parse_sha256_sidecar

Parses exactly one strict SHA-256 sidecar line.

run_bounded

Executes a command with cleared environment, null stdin, bounded output, and kill/reap.

verify_file

Verifies a local file against a parsed SHA-256 declaration.

Type Aliases

RecoveryResult

The result type returned by the recovery-aware entry points.

Result

The result type used by eggup-core.