Crate varve_core 

Layer manifests, resolution, the core store, and verification wiring.

varve reads two manifests and must never conflate them:

• the pin (varve.toml) — human-written, checked into a consuming repo, naming the layer that project is frozen on;
• the layer manifest — CI-written, signed, immutable, describing exactly what a layer contains.

The pin is a preference; the layer manifest is evidence.

The invariant

Where bytes come from is pluggable — a public registry, a private one, an archived core. Whether they are accepted is not. Signature and digest verification run against the PulseEngine trust root on every path, and swapping the source must not change any verdict. A source that could influence acceptance would have joined the trusted base.

See docs/manifest-format.md. Nothing here is implemented yet.

Re-exports

pub use archive::ArchiveError;

pub use archive::ArchiveOptions;

pub use archive::ExportSummary;

pub use archive::OciLayoutSource;

pub use archive::export as export_archive;

pub use archive::export_with_options as export_archive_with_options;

pub use deposit::DepositError;

pub use deposit::DepositFileSpec;

pub use deposit::DepositOptions;

pub use deposit::DepositOutcome;

pub use deposit::DepositSpec;

pub use deposit::DepositTool;

pub use deposit::RunnerSpec;

pub use deposit::ToolSource;

pub use deposit::deposit;

pub use deposit::deposit_with_options;

pub use deposit::parse_deposit_spec;

pub use install::InstallError;

pub use install::InstallOutcome;

pub use install::InstallPolicy;

pub use install::ManifestVerifier;

pub use install::VerifyError;

pub use install::install;

pub use kind::ANN_KIND;

pub use kind::PayloadKind;

pub use kind::UnknownKind;

pub use layer::LayerId;

pub use layer::LayerIdError;

pub use layer::Line;

pub use lineindex::IndexCache;

pub use lineindex::IndexError;

pub use lineindex::IndexPolicy;

pub use lineindex::IndexedLayer;

pub use lineindex::LineIndex;

pub use lineindex::attach_envelope_to_layout as attach_index_envelope_to_layout;

pub use lineindex::attach_to_layout as attach_index_to_layout;

pub use lineindex::read_from_layout as read_index_from_layout;

pub use linestatus::KnownLayers;

pub use linestatus::KnownProblem;

pub use linestatus::LayerStatusReport;

pub use linestatus::LineStatus;

pub use linestatus::LineStatusError;

pub use linestatus::RefCheck;

pub use linestatus::StatusCache;

pub use linestatus::attach_envelope_to_layout as attach_status_envelope_to_layout;

pub use linestatus::attach_envelope_to_layout_checked as attach_status_envelope_to_layout_checked;

pub use linestatus::attach_to_layout as attach_status_to_layout;

pub use linestatus::cache_baseline_from_source as cache_baseline_line_status;

pub use linestatus::known_layers_from_index;

pub use linestatus::known_layers_in_layout;

pub use linestatus::known_layers_in_layout_dirs;

pub use linestatus::read_any_from_layout as read_any_status_from_layout;

pub use linestatus::read_from_layout as read_status_from_layout;

pub use manifest::LayerManifest;

pub use manifest::ManifestError;

pub use pin::Channel;

pub use pin::DeclaredExportStatus;

pub use pin::ExportDecl;

pub use pin::ExportEnv;

pub use pin::ExportKind;

pub use pin::Pin;

pub use pin::PinError;

pub use pin::ShadowDeclaration;

pub use pin::ShimOrder;

pub use pin::check_declared_export;

pub use pin::classify_shadowing;

pub use pin::env_lines;

pub use platform::host_platform;

pub use realm::Realm;

pub use realm::RealmError;

pub use realm::resolve_realm;

pub use referrers::CarriedWork;

pub use referrers::WouldDestroy;

pub use referrers::guard as guard_layout;

pub use referrers::scan as scan_layout_referrers;

pub use registry::RegistryRef;

pub use registry::RegistrySource;

pub use resolve::ResolveError;

pub use resolve::Resolved;

pub use resolve::RunnerContract;

pub use resolve::resolve;

pub use reverify::ReverifyError;

pub use reverify::verify_installed;

pub use rollback::HighWaterMarks;

pub use rollback::RollbackError;

pub use rollback::RollbackVerdict;

pub use rollback::staleness_warning;

pub use sdkexport::ANN_SDK_PREFIX;

pub use sdkexport::Member;

pub use sdkexport::MemberBody;

pub use sdkexport::Relocation;

pub use sdkexport::SdkExportError;

pub use sdkexport::SdkExportReport;

pub use sdkexport::check_destination_fits;

pub use sdkexport::export_sdk;

pub use sdkexport::relocate_bytes;

pub use selfverify::RELEASE_SUMS_PAYLOAD_TYPE;

pub use selfverify::SelfVerifyError;

pub use selfverify::sign_release_sums;

pub use selfverify::verify_release_file;

pub use source::DirSource;

pub use source::LayerRef;

pub use source::LayerSource;

pub use source::MemorySource;

pub use source::SourceError;

pub use store::InstalledLayer;

pub use store::Store;

pub use store::StoreError;

pub use store::manifest_digest;

pub use verify::LAYER_PAYLOAD_TYPE;

pub use verify::PinnedKeyVerifier;

pub use verify::generate_root_keypair;

pub use verify::sign_layer_manifest;

pub use vsixexport::VsixEntry;

pub use vsixexport::VsixExportError;

pub use vsixexport::export_vsix;

Modules

archive

The archived core (REQ-OFFLINE-001) — the artifact of record.

attest

Attestations carried with a layer (REQ-ATTEST-001).

attestcarry

Carrying attestations with the layer (REQ-ATTEST-002).

bazel

Bazel checksum-registry compilation (REQ-BAZEL-001).

compose

Layer composition (REQ-COMPOSE-001).

crateexport

Cargo local-registry export (REQ-CRATE-001).

deposit

Deposit — how a layer comes into being (REQ-DEPOSIT-001).

discover

Pin discovery — walk up from the working directory (DD-006).

exportstamp

Export provenance stamp (REQ-EXPORT-SYNC-001).

install

The verified install pipeline (REQ-VERIFY-001, REQ-ROLLBACK-001).

keys

Signing-key material (REQ-KEYGEN-001).

kind

Payload kinds (REQ-KIND-001) — what a layer entry is.

layer

Layer identifiers — YYYY.MM.P, three-part from day one (DD-004).

lineindex

The signed line index (REQ-INDEXAUTH-001) — which layers a line HAS.

linestatus

Line-status documents (REQ-KP-001, DD-008) — signed, updatable evidence beside immutable layers.

lockpin

Lockfile agreement (REQ-LOCKPIN-001).

manifest

The layer manifest as seen at acceptance time (DD-005).

pin

The pin — varve.toml, the human-written half of the two manifests.

platform

The platform dimension (REQ-PLATFORM-001, DD-001).

realm

Realms (REQ-REALM-001) — the pin names its trust universe.

referrers

What signed work an OCI image layout already carries (REQ-NODESTROY-001).

registry

The public-registry source (REQ-REGISTRY-001, REQ-REGISTRY-002, DD-003).

resolve

Resolution — pin + core → exactly one layer, or a loud failure.

reverify

Re-verification of an installed layer (REQ-VERIFY-001) — varve verify.

rollback

Anti-rollback and staleness verdicts (REQ-ROLLBACK-001, DD-005).

sbom

SBOM emission from the signed layer manifest (REQ-SBOM-001).

sdkexport

Tree-shaped payload export and relocation (REQ-SDK-001).

selfverify

Self-verification (REQ-SELF-001, DD-009) — the tool that gates the toolchain clears its own gate.

shadow

PATH shadowing (REQ-SHADOW-001) — does the name actually reach our binary?

source

Sources — where bytes come from. Pluggable by design; trusted by nobody (DD-003).

store

The core — the local content-addressed store (REQ-COEXIST-001, DD-006).

update

Self-update (REQ-UPDATE-001) — updating the updater, without a flag day.

verify

Manifest signature verification against the PulseEngine trust root (REQ-VERIFY-001, DD-003).

vsixexport

VS Code extension export (REQ-VSIX-001 clause 3).