Module build_consume 

The verified cache-consumption chain stow-build reuses (stow#299).

Signed index fetch, digest-checked bundle download, cosign verification and artifact injection — one implementation for the user CLI and the trusted builder alike. The verified cache-consumption machinery stow-build reuses: the same signed-index → digest-check → cosign-verify → inject chain the user CLI runs, as a narrow facade over the CLI’s internal modules. One implementation serves both callers, so the builder cannot drift from the verification a stranger’s machine gets.

Structs

ConsumeConfig

The edge/registry/verify-mode configuration the consumption path loads the same way the CLI does — opaque so the builder goes through the same entry points a user invocation would.

IndexSlice

A verified index slice: the decoded rows plus the manifest digest that carried them, so callers can report what they resolved against.

ServedBundle

A verified published bundle staged for a build task’s sandbox, with the two identity fields the capture wrapper cross-checks before injecting.

Enums

StageFailure

Why a row the signed index names could not be staged.

Functions

ensure_slice

Pull and signature-verify the index slice for (target, rustc_version) — the same fetch the resolver runs before any lookup.

load_served_bundle

Load a bundle stage_verified_bundle staged under store_dir, when the entry exists and parses — a miss is exactly a cold cache and the calling unit compiles.

serve_bundle_outputs

Inject a served bundle’s outputs as the artifacts parsed requested — the same write the user’s wrapper performs on a cache hit.

stage_verified_bundle

Download, digest-check, cosign-verify and stage the bundle row names under entry_dir, for the build sandbox’s read-only grant.