Expand description
The verified install pipeline (REQ-VERIFY-001, REQ-ROLLBACK-001).
Order is the security argument, so it is fixed here and tested:
- fetch manifest bytes (by pin digest if pinned, else by name)
- verify the manifest signature against the trust root
- parse strictly; cross-check layer name, channel, pinned digest
- anti-rollback check against the per-line high-water mark
- fetch each blob; verify each digest against the signed manifest
- lay down in the core
- only now advance the high-water mark
Nothing a source returns reaches the core unverified, and a failed install leaves both the core and the high-water marks untouched. The kill-criterion (REQ-VERIFY-001): running the same bytes through two different sources yields identical verdicts — a source that could influence acceptance has joined the trusted base, and the design is broken.
Structs§
- Install
Outcome - A successful install.
- Install
Policy - Policy inputs the caller supplies; time is data, not something the pipeline samples.
- Verify
Error
Enums§
Traits§
- Manifest
Verifier - Signature verification over fetched manifest bytes, against the PulseEngine trust root. Returns the authenticated payload (the layer manifest itself) — for DSSE-enveloped transport the fetched bytes and the trusted bytes differ, and everything downstream must use only the latter. Implementations carry the trust root; callers cannot relax it per-source — the pipeline takes exactly one verifier for all sources.