varve_core/
lib.rs

1//! Layer manifests, resolution, the core store, and verification wiring.
2//!
3//! `varve` reads two manifests and must never conflate them:
4//!
5//! * **the pin** (`varve.toml`) — human-written, checked into a consuming repo,
6//!   naming the layer that project is frozen on;
7//! * **the layer manifest** — CI-written, signed, immutable, describing exactly
8//!   what a layer contains.
9//!
10//! The pin is a preference; the layer manifest is evidence.
11//!
12//! # The invariant
13//!
14//! Where bytes come from is pluggable — a public registry, a private one, an
15//! archived core. **Whether they are accepted is not.** Signature and digest
16//! verification run against the PulseEngine trust root on every path, and
17//! swapping the source must not change any verdict. A source that could
18//! influence acceptance would have joined the trusted base.
19//!
20//! See `docs/manifest-format.md`. Nothing here is implemented yet.
21
22#![forbid(unsafe_code)]
23
24pub mod archive;
25pub mod attest;
26pub mod attestcarry;
27pub mod bazel;
28pub mod compose;
29pub mod consumer;
30pub mod crateexport;
31pub mod deposit;
32pub mod discover;
33pub mod exportstamp;
34pub mod ingest;
35pub mod install;
36pub mod keys;
37pub mod kind;
38pub mod layer;
39pub mod layerspec;
40pub mod lineindex;
41pub mod linestatus;
42pub mod lockpin;
43pub mod manifest;
44pub mod manifestversions;
45pub mod mirror;
46pub mod mutationscope;
47pub mod pin;
48pub mod platform;
49pub mod realm;
50pub mod referrers;
51pub mod registry;
52pub mod resolve;
53pub mod reverify;
54pub mod rollback;
55pub mod sbom;
56pub mod sdkexport;
57pub mod selfverify;
58pub mod shadow;
59pub mod source;
60pub mod store;
61pub mod support;
62pub mod update;
63pub mod verify;
64pub mod vsixexport;
65
66pub use archive::{
67    ArchiveError, ArchiveOptions, ExportSummary, OciLayoutSource, export as export_archive,
68    export_with_options as export_archive_with_options,
69};
70pub use deposit::{
71    DepositError, DepositFileSpec, DepositOptions, DepositOutcome, DepositSpec, DepositTool,
72    RunnerSpec, ToolSource, deposit, deposit_with_options, parse_deposit_spec,
73};
74pub use ingest::{ANN_PROOF, ANN_PROOF_ASSERTS, ANN_PROOF_SIGNER, IngestProof, UnknownProof};
75pub use install::{
76    InstallError, InstallOutcome, InstallPolicy, ManifestVerifier, VerifyError, install,
77};
78pub use kind::{ANN_KIND, PayloadKind, UnknownKind};
79pub use layer::{LayerId, LayerIdError, Line};
80pub use lineindex::{
81    IndexCache, IndexError, IndexPolicy, IndexedLayer, LineIndex,
82    attach_envelope_to_layout as attach_index_envelope_to_layout,
83    attach_to_layout as attach_index_to_layout, read_from_layout as read_index_from_layout,
84};
85pub use linestatus::{
86    KnownLayers, KnownProblem, LayerStatusReport, LineStatus, LineStatusError, RefCheck,
87    StatusCache, attach_envelope_to_layout as attach_status_envelope_to_layout,
88    attach_envelope_to_layout_checked as attach_status_envelope_to_layout_checked,
89    attach_to_layout as attach_status_to_layout,
90    cache_baseline_from_source as cache_baseline_line_status, known_layers_from_index,
91    known_layers_in_layout, known_layers_in_layout_dirs,
92    read_any_from_layout as read_any_status_from_layout,
93    read_from_layout as read_status_from_layout,
94};
95pub use manifest::{LayerManifest, ManifestError};
96pub use pin::{
97    Channel, DeclaredExportStatus, ExportDecl, ExportEnv, ExportKind, Pin, PinError,
98    ShadowDeclaration, ShimOrder, check_declared_export, classify_shadowing, env_lines,
99};
100pub use platform::host_platform;
101pub use realm::{Realm, RealmError, resolve_realm};
102pub use referrers::{
103    CarriedWork, WouldDestroy, guard as guard_layout, scan as scan_layout_referrers,
104};
105pub use registry::{RegistryRef, RegistrySource};
106pub use resolve::{ResolveError, Resolved, RunnerContract, resolve};
107pub use reverify::{ReverifyError, verify_installed};
108pub use rollback::{HighWaterMarks, RollbackError, RollbackVerdict, staleness_warning};
109pub use sdkexport::{
110    ANN_SDK_PREFIX, Member, MemberBody, Relocation, SdkExportError, SdkExportReport,
111    check_destination_fits, export_sdk, relocate_bytes,
112};
113pub use selfverify::{
114    RELEASE_SUMS_PAYLOAD_TYPE, SelfVerifyError, sign_release_sums, verify_release_file,
115};
116pub use source::{DirSource, LayerRef, LayerSource, MemorySource, SourceError};
117pub use store::{InstalledLayer, Store, StoreError, manifest_digest};
118pub use verify::{
119    LAYER_PAYLOAD_TYPE, PinnedKeyVerifier, generate_root_keypair, sign_layer_manifest,
120};
121pub use vsixexport::{VsixEntry, VsixExportError, export_vsix};
varve_core/lib.rs

varve_core/
lib.rs
