varve_core/
lib.rs

1//! Layer manifests, resolution, the core store, and verification wiring.
2//!
3//! `varve` reads two manifests and must never conflate them:
4//!
5//! * **the pin** (`varve.toml`) — human-written, checked into a consuming repo,
6//!   naming the layer that project is frozen on;
7//! * **the layer manifest** — CI-written, signed, immutable, describing exactly
8//!   what a layer contains.
9//!
10//! The pin is a preference; the layer manifest is evidence.
11//!
12//! # The invariant
13//!
14//! Where bytes come from is pluggable — a public registry, a private one, an
15//! archived core. **Whether they are accepted is not.** Signature and digest
16//! verification run against the PulseEngine trust root on every path, and
17//! swapping the source must not change any verdict. A source that could
18//! influence acceptance would have joined the trusted base.
19//!
20//! See `docs/manifest-format.md`. Nothing here is implemented yet.
21
22#![forbid(unsafe_code)]
23
24pub mod archive;
25pub mod attest;
26pub mod attestcarry;
27pub mod bazel;
28pub mod compose;
29pub mod crateexport;
30pub mod deposit;
31pub mod discover;
32pub mod exportstamp;
33pub mod install;
34pub mod keys;
35pub mod kind;
36pub mod layer;
37pub mod lineindex;
38pub mod linestatus;
39pub mod lockpin;
40pub mod manifest;
41pub mod pin;
42pub mod platform;
43pub mod realm;
44pub mod registry;
45pub mod resolve;
46pub mod reverify;
47pub mod rollback;
48pub mod sbom;
49pub mod selfverify;
50pub mod shadow;
51pub mod source;
52pub mod store;
53pub mod update;
54pub mod verify;
55pub mod vsixexport;
56
57pub use archive::{ArchiveError, ExportSummary, OciLayoutSource, export as export_archive};
58pub use deposit::{
59    DepositError, DepositFileSpec, DepositOutcome, DepositSpec, DepositTool, RunnerSpec,
60    ToolSource, deposit, parse_deposit_spec,
61};
62pub use install::{
63    InstallError, InstallOutcome, InstallPolicy, ManifestVerifier, VerifyError, install,
64};
65pub use kind::{ANN_KIND, PayloadKind, UnknownKind};
66pub use layer::{LayerId, LayerIdError, Line};
67pub use lineindex::{
68    IndexCache, IndexError, IndexPolicy, IndexedLayer, LineIndex,
69    attach_envelope_to_layout as attach_index_envelope_to_layout,
70    attach_to_layout as attach_index_to_layout, read_from_layout as read_index_from_layout,
71};
72pub use linestatus::{
73    KnownProblem, LayerStatusReport, LineStatus, LineStatusError, StatusCache,
74    attach_envelope_to_layout as attach_status_envelope_to_layout,
75    attach_to_layout as attach_status_to_layout,
76    cache_baseline_from_source as cache_baseline_line_status,
77    read_any_from_layout as read_any_status_from_layout,
78    read_from_layout as read_status_from_layout,
79};
80pub use manifest::{LayerManifest, ManifestError};
81pub use pin::{Channel, Pin, PinError};
82pub use platform::host_platform;
83pub use realm::{Realm, RealmError, resolve_realm};
84pub use registry::{RegistryRef, RegistrySource};
85pub use resolve::{ResolveError, Resolved, RunnerContract, resolve};
86pub use reverify::{ReverifyError, verify_installed};
87pub use rollback::{HighWaterMarks, RollbackError, RollbackVerdict, staleness_warning};
88pub use selfverify::{
89    RELEASE_SUMS_PAYLOAD_TYPE, SelfVerifyError, sign_release_sums, verify_release_file,
90};
91pub use source::{DirSource, LayerRef, LayerSource, MemorySource, SourceError};
92pub use store::{InstalledLayer, Store, StoreError, manifest_digest};
93pub use verify::{
94    LAYER_PAYLOAD_TYPE, PinnedKeyVerifier, generate_root_keypair, sign_layer_manifest,
95};
96pub use vsixexport::{VsixEntry, VsixExportError, export_vsix};
varve_core/lib.rs

varve_core/
lib.rs
