Module bundle 

The online side’s last step: an AdvisorySet becomes a signed holger.update-bundle/v1 with product = holger.intel/v1.

Nothing here is a new format. The set is the bundle’s one payload, the feed record is its Advisory evidence, and update-bundle’s own Preparation, add_approval and finalize do the hashing, the approvals and the release signature — so holger-verify verifies an intel bundle exactly like a firmware one, and finalize refuses to emit one that does not verify.

Structs

BuildOptions

What the bundle says about itself, and who signs it.

BuiltBundle

The written bundle.

SignerFiles

One signer’s certificate (DER) and ed25519 key (PKCS#8 DER). The key never enters the bundle and is never printed.

Functions

build_bundle

Sign set into a bundle at opts.out.

sequence_for

The default sequence for a bundle built at t: YYYYMMDDHHMMSS, which only grows as long as the builder’s clock does.