lib

Core libraries for Radroots
git clone https://radroots.dev/git/lib.git
Log | Files | Refs | README

services_hardening_release_artifacts.v3.json (3234B)

      1 {
      2   "schema": "radroots.services-hardening.release-artifacts-decisions.v3",
      3   "contract_version": 3,
      4   "decision_state": "active",
      5   "predecessor": {
      6     "schema": "radroots.services-hardening.release-artifacts-decisions.v2",
      7     "filename": "services_hardening_release_artifacts.v2.json",
      8     "transition": "forward_only_replace"
      9   },
     10   "command": "cargo xtask service-release-artifacts",
     11   "modes": ["check", "write"],
     12   "required_arguments": ["mode", "service_root", "input_root", "output_root", "target", "source_date_epoch"],
     13   "service_metadata_path": "Cargo.toml.workspace.metadata.radroots.service_release",
     14   "service_metadata_fields": ["service", "service_package", "binary_name", "version"],
     15   "service_license_path": "Cargo.toml.workspace.package.license_or_package.license",
     16   "artifact_admission_contract": "contracts/architecture/decisions/services_hardening_artifact_admission.v1.json",
     17   "supported_targets": ["aarch64-apple-darwin", "x86_64-unknown-linux-gnu"],
     18   "binary_admission": "exact_format_architecture_linkage_structural_and_native_bounded_help_smoke",
     19   "oci_admission": "safe_materialization_exact_manifest_config_AGPL_labels_layers_and_entrypoint",
     20   "input_inventory": ["config.example.toml", "config.schema.json", "lib-source.bundle", "nixos-module.nix", "oci-image.tar.gz", "service-binary", "service-source.bundle", "systemd.service"],
     21   "excluded_parent_owned_inputs": ["backup_restore_runbook", "operator_runbook"],
     22   "service_root_inventory": ["LICENSE-APACHE", "LICENSE-MIT", "radroots.service.source-lock.v2.toml"],
     23   "output_inventory": ["LICENSE-APACHE", "LICENSE-MIT", "SHA256SUMS", "THIRD-PARTY-NOTICES.txt", "artifact-manifest.v1.json", "binary.tar.gz", "config.example.toml", "config.schema.json", "lib-source.bundle", "nixos-module.nix", "oci-image.tar.gz", "oci-image.v1.json", "provenance-input.v1.json", "radroots.service.source-lock.v2.toml", "sbom.cdx.json", "service-source.bundle", "source-bundles.v2.json", "systemd.service"],
     24   "canonical_json": "compact_utf8_json_with_one_final_lf",
     25   "checksum_format": "sha256_lower_hex_two_spaces_path_lf_sorted_by_path",
     26   "sbom_format": "cyclonedx_json_1_5_locked_cargo_graph",
     27   "provenance_posture": "deterministic_unsigned_slsa_v1_signing_input_external_keys_only",
     28   "protected_material_scan_scope": "all_textual_release_inputs_and_generated_documents",
     29   "source_cleanliness": "no_tracked_staged_or_untracked_changes",
     30   "revision_stability": "same_service_head_before_and_after_generation",
     31   "no_protected_material": true,
     32   "maximums": {
     33     "text_input_bytes": 1048576,
     34     "generated_document_bytes": 16777216,
     35     "service_cargo_lock_bytes": 16777216,
     36     "service_flake_lock_bytes": 4194304,
     37     "binary_bytes": 536870912,
     38     "source_bundle_bytes": 1073741824,
     39     "oci_bytes": 2147483648,
     40     "cargo_metadata_bytes": 33554432,
     41     "packages": 8192,
     42     "workspace_packages": 64
     43   },
     44   "negative_error_codes": ["invalid_contract", "invalid_service_root", "dirty_service_source", "invalid_service_metadata", "invalid_input_root", "invalid_input_artifact", "invalid_source_lock", "invalid_source_bundle", "invalid_package_inventory", "protected_material_detected", "invalid_output_root", "stale_output", "generation_failure"]
     45 }