Module bundle 

OCI bundle layout and assembly.

The media types and in-tar paths of a stow artifact bundle, the manifest wire types the CLI reads after signature verification, and the assembler that builds the bundle tar the trusted publish stage pushes and the edge streams byte-for-byte.

Structs

ArtifactBlobConfig

Embedded JSON config describing one artifact bundle’s identity.

ArtifactBundleFile

One file inside an artifact bundle tar.

ArtifactBundleManifest

Manifest at manifest.json inside a bundle tar, describing the artifact the bundle carries and the signatures covering it.

BundleArtifactConfig

Config blob of the <tag>.bundle artifact: which signed artifact the bundle was assembled from.

BundleLayer

One layer payload handed to assemble_bundle.

BundleParts

Everything a bundle tar is assembled from.

BundleSignatureMaterial

One cosign signature as read off the signature image: the payload blob plus the annotations carried on its layer.

SigstoreSignature

One Sigstore (cosign) signature over a bundle’s OCI config.

Enums

BundleAssemblyError

Assembly failed: the parts do not describe one consistent artifact.

Constants

OCI_IMAGE_MANIFEST_MEDIA_TYPE

Media type of an OCI image manifest, which every stow artifact is pushed as.

SIGSTORE_BUNDLE_ANNOTATION

Layer annotation carrying the Rekor bundle JSON, when uploaded.

SIGSTORE_CERT_ANNOTATION

Layer annotation carrying the PEM Fulcio certificate of the signer.

SIGSTORE_OCI_MEDIA_TYPE

Media type cosign gives the simple-signing payload layer of a signature image.

SIGSTORE_SIGNATURE_ANNOTATION

Layer annotation carrying the base64 signature over the payload.

STOW_ARTIFACT_CONFIG_MEDIA_TYPE

Media type of the signed artifact’s OCI config blob.

STOW_BUNDLE_CONFIG_MEDIA_TYPE

Media type of the <tag>.bundle artifact’s OCI config blob.

STOW_BUNDLE_FILES_DIR

Directory inside a bundle tar holding the artifact’s layer payloads.

STOW_BUNDLE_MANIFEST_PATH

Path of the per-artifact manifest inside a bundle tar.

STOW_BUNDLE_MEDIA_TYPE

Media type of the single-artifact bundle tar layer.

STOW_DYLIB_MEDIA_TYPE

Media type of a dylib file inside a bundle.

STOW_NATIVE_ARCHIVE_MEDIA_TYPE

A tar of the build script’s OUT_DIR tree, carried as its own layer.

STOW_OCI_CONFIG_PATH

Path of the OCI config JSON inside a bundle tar — the document the cosign signature covers.

STOW_OCI_MANIFEST_PATH

Path of the OCI manifest JSON inside a bundle tar.

STOW_PROC_MACRO_MEDIA_TYPE

Media type of a proc-macro dynamic library inside a bundle.

STOW_RLIB_MEDIA_TYPE

Media type of an .rlib file inside a bundle.

STOW_RMETA_MEDIA_TYPE

Media type of an .rmeta file inside a bundle.

STOW_SIGSTORE_PAYLOAD_DIR

Directory inside a bundle tar holding Sigstore signature material.

STOW_ZSTD_MEDIA_TYPE_SUFFIX

Media type suffix marking a zstd-compressed blob.

Functions

assemble_bundle

Assemble the bundle tar for one signed artifact.

bundle_file_path

In-tar path of a layer payload.

sigstore_payload_path

In-tar path of the index-th sigstore payload.

sigstore_signature_tag

The tag cosign stores an artifact’s signature image under: the manifest digest with : replaced by -, plus .sig.