Module vsixexport 

VS Code extension export (REQ-VSIX-001 clause 3).

A vsix-kind entry carries one .vsix file — a zip, nothing more, which is why extensions could ship in this release while the tree-shaped SDK store (varve#67) could not. export-vsix lays the verified bytes out as files code --install-extension <file> consumes directly:

D/rust-lang.rust-analyzer-0.3.2260.vsix
D/vadimcn.vscode-lldb-1.11.4.vsix
D/.varve-export.json

The trust chain needs nothing new. A .vsix is signed like any blob (its digest is in the DSSE-signed layer manifest) and the digest check is kind-agnostic (DD-003). What this module owes the caller is the FILE NAME: code dispatches on the .vsix suffix, refusing anything else outright, and a human reading the directory has only the name to tell one extension from another. So the marketplace convention — publisher.name-version.vsix — is reproduced exactly, with the entry’s payload name supplying the publisher.name half.

Names come out of a SIGNED manifest, which makes them attributable, not benign: ../../evil signed by a realm root must not place bytes outside the export directory, and a name starting with - must not reach code’s argument parser as a flag. Both are refused before anything is written.

Structs

VsixEntry

One extension to lay out: its marketplace identity and the .vsix bytes.

Enums

VsixExportError

Why an extension could not be exported.

Constants

VSIX_SUFFIX

The file extension code --install-extension dispatches on. It accepts a path only when it ends in this; anything else is treated as a marketplace ID and fetched from the network — the exact behaviour this export exists to avoid.

Functions

export_vsix

Lay the verified extensions out in out as publisher.name-version.vsix files. Returns the number written.

validate_extension_id

Refuse an extension id that cannot be a file name — before a byte is written, so a bad entry leaves the export directory untouched rather than half-populated.

validate_extension_version

Refuse a version that cannot be a file name, for the same reasons.

vsix_file_name

The file name for an extension: publisher.name-version.vsix, the marketplace’s own asset convention, so the file a user sees in the export directory reads the same as the one they would have downloaded.