lib

Core libraries for Radroots
git clone https://radroots.dev/git/lib.git
Log | Files | Refs | README

services_hardening_artifact_admission.v1.json (2601B)

      1 {
      2   "schema": "radroots.services-hardening.artifact-admission-decisions.v1",
      3   "contract_version": 1,
      4   "decision_state": "active",
      5   "owner_step": 304,
      6   "command_owner": "tools/xtask",
      7   "supported_binary_targets": [
      8     "aarch64-apple-darwin",
      9     "x86_64-unknown-linux-gnu"
     10   ],
     11   "binary": {
     12     "formats": {
     13       "aarch64-apple-darwin": "thin_macho64_arm64_execute",
     14       "x86_64-unknown-linux-gnu": "elf64_little_endian_x86_64_execute_or_pie"
     15     },
     16     "maximum_parse_bytes": 67108864,
     17     "architecture": "exact_target_match",
     18     "linkage": "parse_declared_dynamic_libraries_and_forbid_external_sqlite",
     19     "sqlite": "one_bundled_native_linkage_under_the_separate_sqlx_only_source_contract",
     20     "structural_smoke": "executable_type_nonzero_entrypoint_and_executable_segment",
     21     "runtime_smoke": "bounded_help_execution_on_the_matching_native_host",
     22     "fat_or_multi_arch": "forbidden"
     23   },
     24   "oci": {
     25     "format": "single_image_docker_archive_tar_gzip",
     26     "platform": "linux_amd64",
     27     "maximum_layers": 2,
     28     "outer_archive": "descriptor_bound_bounded_safe_materialization_with_exact_inventory",
     29     "manifest": "one_entry_exact_config_repo_tag_and_layer_references",
     30     "config": "content_addressed_json_with_exact_rootless_runtime_and_build_labels",
     31     "license": "Cargo.toml package license derived AGPL-3.0-or-later",
     32     "layers": "parse_only_bounded_tar_validation_with_content_digest_reconciliation",
     33     "entrypoint": "one_regular_executable_payload_at_the_configured_store_path",
     34     "unpacking": "forbidden"
     35   },
     36   "maximums": {
     37     "outer_compressed_bytes": 2147483648,
     38     "outer_expanded_bytes": 17179869184,
     39     "outer_members": 65536,
     40     "outer_member_bytes": 17179869184,
     41     "json_bytes": 1048576,
     42     "layer_members": 65536,
     43     "layer_payload_bytes": 17179869184,
     44     "path_bytes": 4096,
     45     "depth": 64,
     46     "runtime_seconds": 10,
     47     "runtime_stream_bytes": 65536
     48   },
     49   "required_negative_vectors": [
     50     "arbitrary_binary_bytes",
     51     "wrong_binary_architecture",
     52     "fat_macho",
     53     "missing_binary_entrypoint",
     54     "external_sqlite_linkage",
     55     "runtime_smoke_failure",
     56     "unsafe_outer_tar_member",
     57     "wrong_oci_license",
     58     "multiple_manifest_entries",
     59     "config_digest_mismatch",
     60     "wrong_oci_platform",
     61     "wrong_rootless_config",
     62     "unexpected_label",
     63     "missing_layer",
     64     "layer_digest_mismatch",
     65     "unsafe_layer_path",
     66     "missing_entrypoint_payload"
     67   ],
     68   "nonclaims": [
     69     "Linux artifact build on a macOS host without a Linux builder",
     70     "signature notarization publication deployment or production activation"
     71   ]
     72 }