Module source 

Sources — where bytes come from. Pluggable by design; trusted by nobody (DD-003).

A source can obtain bytes: a manifest by layer name or digest, a blob by digest. It has no voice in whether those bytes are accepted — signature and digest verification run against the trust root after every fetch, so swapping the source can change availability, never a verdict. The install pipeline (crate::install) enforces this by construction: nothing a LayerSource returns reaches the core without passing the same checks.

Structs

DirSource

Directory-shaped source: <root>/manifests/sha256-<hex> and <root>/blobs/sha256-<hex>. The reading half of the archived core — and, in tests, the second transport for the two-sources-same-verdict kill-criterion.

MemorySource

In-memory source — the test double, and the reference for how little a source is trusted to do.

Enums

LayerRef

Reference to a layer a source should produce the manifest for.

SourceError

Failures a source may report. NotFound is honest absence; everything else is transport trouble. There is deliberately no way for a source to report “trust me” — trust is not its department.

Traits

LayerSource

Where bytes come from. Implementations ship in varve (public registry, archived core, test doubles); the trait is the seam an entitlement plug-in would use — and the reason none of them can influence acceptance.