Expand description
Bazel checksum-registry compilation (REQ-BAZEL-001).
rules_wasm_component pins tools with per-tool JSON checksum registries and a pure sha256 download path. This module compiles those registries FROM a verified layer manifest: the hashes Bazel enforces become transcriptions from a signed, counter-protected document instead of trust-on-first-use hashes of whatever a release page served. Bazel’s fetch path does not change; its trust anchor does.
The digests exported are the SOURCE-ASSET digests (the bytes Bazel downloads), recorded inside the signed payload at deposit time — the layer’s own entry digests cover the extracted binaries, which Bazel never sees.
Structs§
- Bazel
Export - One compiled registry per tool, plus what could not be compiled and why.
Constants§
- ANN_
RUNNER - ANN_
RUNNER_ ARGS - ANN_
RUNNER_ ARG_ PREFIX - ANN_
SRC_ ASSET - ANN_
SRC_ RELEASE - ANN_
SRC_ REPO - ANN_
SRC_ SHA256
Functions§
- bazel_
platform_ key - Map a target triple to rules_wasm_component’s platform-key vocabulary.
- export
- Compile the registries from a (verified-by-the-caller) layer manifest.