604 lines
25 KiB
Text
604 lines
25 KiB
Text
|
#!/usr/bin/env nu
|
||
|
|
# Domain artifact OCI operations via oras subprocess.
|
||
|
|
# All push/pull/describe/verify operations use oras-cli; no curl fallback.
|
||
|
|
# Cache root: ~/.cache/ontoref/domains/<id>/<version>/
|
||
|
|
#
|
||
|
|
# ADR-017 — every oras invocation runs with an isolated DOCKER_CONFIG resolved
|
||
|
|
# via platform/oci/credentials.nu::resolve-registry-credential. No env-var
|
||
|
|
# fallback to ~/.docker/config.json. Authorization is gated through
|
||
|
|
# assert-actor-authorized before any push/pull touches the registry.
|
||
|
|
|
||
|
|
use primitives/io/logging.nu [log-debug log-error log-info]
|
||
|
|
use platform/oci/credentials.nu [
|
||
|
|
resolve-registry-credential
|
||
|
|
assert-actor-authorized
|
||
|
|
assert-target-in-scope
|
||
|
|
]
|
||
|
|
|
||
|
|
const DOMAIN_MEDIA_TYPE = "application/vnd.ontoref.domain.v1"
|
||
|
|
const CONTRACT_MEDIA_TYPE = "application/vnd.ontoref.domain.contract.v1"
|
||
|
|
const EXAMPLE_MEDIA_TYPE = "application/vnd.ontoref.domain.example.v1"
|
||
|
|
const MODE_MEDIA_TYPE = "application/vnd.ontoref.mode.v1"
|
||
|
|
const MODE_DECL_MEDIA_TYPE = "application/vnd.ontoref.mode.declaration.v1"
|
||
|
|
const MODE_LOCK_MEDIA_TYPE = "application/vnd.ontoref.mode.lock.v1"
|
||
|
|
const DEFAULT_REGISTRY = "reg.librecloud.online"
|
||
|
|
const CACHE_BASE = ".cache/ontoref/domains"
|
||
|
|
const MODE_CACHE_BASE = ".cache/ontoref/modes"
|
||
|
|
const GLOBAL_CONFIG_REL = ".config/ontoref/config.ncl"
|
||
|
|
|
||
|
|
def domain-cache-dir [participant: string, id: string, version: string]: nothing -> string {
|
||
|
|
$env.HOME | path join $CACHE_BASE $participant $id $version
|
||
|
|
}
|
||
|
|
|
||
|
|
def domain-ref [registry: string, participant: string, id: string, version: string]: nothing -> string {
|
||
|
|
$"($registry)/domains/($participant)/($id):($version)"
|
||
|
|
}
|
||
|
|
|
||
|
|
def require-oras []: nothing -> string {
|
||
|
|
let rows = (which oras)
|
||
|
|
if ($rows | is-empty) {
|
||
|
|
error make --unspanned { msg: "oras not found in PATH — install via: brew install oras" }
|
||
|
|
}
|
||
|
|
$rows | get path | first | into string
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
# Resolve the cosign public key path used to verify domain artifact signatures.
|
||
|
|
# Resolution order (declarative, ADR-017):
|
||
|
|
# 1. --cosign-key explicit flag (caller-provided)
|
||
|
|
# 2. ~/.config/ontoref/config.ncl::vault.cosign.pub_path (global declarative)
|
||
|
|
# 3. $PROVISIONING/catalog/domains/_signing/cosign.pub (legacy catalog signing key)
|
||
|
|
# Empty string when none resolves — caller decides whether unsigned-permitted.
|
||
|
|
def find-cosign-pubkey [explicit_key: string]: nothing -> string {
|
||
|
|
if ($explicit_key | is-not-empty) {
|
||
|
|
return $explicit_key
|
||
|
|
}
|
||
|
|
let global_cfg = ($env.HOME | path join $GLOBAL_CONFIG_REL)
|
||
|
|
if ($global_cfg | path exists) {
|
||
|
|
let import_path = ($env.NICKEL_IMPORT_PATH? | default ($env.PROVISIONING? | default ""))
|
||
|
|
let r = (do { ^nickel export --import-path $import_path $global_cfg } | complete)
|
||
|
|
if $r.exit_code == 0 {
|
||
|
|
let from_cfg = ($r.stdout | from json | get -o vault.cosign.pub_path | default "")
|
||
|
|
if ($from_cfg | is-not-empty) and ($from_cfg | path exists) {
|
||
|
|
return $from_cfg
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
let prov_root = ($env.PROVISIONING? | default "")
|
||
|
|
let from_prov = ($env.PROVISIONING_CATALOG_PATH? | default (if ($prov_root | is-not-empty) { $prov_root | path join "catalog" } else { "" }))
|
||
|
|
if ($from_prov | is-not-empty) {
|
||
|
|
let catalog_key = ($from_prov | path join "domains/_signing/cosign.pub")
|
||
|
|
if ($catalog_key | path exists) {
|
||
|
|
return $catalog_key
|
||
|
|
}
|
||
|
|
}
|
||
|
|
""
|
||
|
|
}
|
||
|
|
|
||
|
|
def cosign-verify-signature [ref: string, pubkey_path: string]: nothing -> record {
|
||
|
|
let rows = (which cosign)
|
||
|
|
if ($rows | is-empty) {
|
||
|
|
return { ok: false, msg: "cosign not in PATH — signature not checked" }
|
||
|
|
}
|
||
|
|
if not ($pubkey_path | path exists) {
|
||
|
|
return { ok: false, msg: $"cosign pubkey not found: ($pubkey_path)" }
|
||
|
|
}
|
||
|
|
# Read tlog policy from global config — symmetric with sign side.
|
||
|
|
# tlog=false → cosign verify needs --insecure-ignore-tlog (no Rekor entry expected).
|
||
|
|
let global_cfg = ($env.HOME | path join $GLOBAL_CONFIG_REL)
|
||
|
|
mut tlog_flag = ""
|
||
|
|
if ($global_cfg | path exists) {
|
||
|
|
let import_path = ($env.NICKEL_IMPORT_PATH? | default ($env.PROVISIONING? | default ""))
|
||
|
|
let r = (do { ^nickel export --import-path $import_path $global_cfg } | complete)
|
||
|
|
if $r.exit_code == 0 {
|
||
|
|
let tlog = ($r.stdout | from json | get -o vault.cosign.tlog | default false)
|
||
|
|
if not $tlog { $tlog_flag = "--insecure-ignore-tlog" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
let flag = $tlog_flag # immutable copy for closure capture
|
||
|
|
let result = if ($flag | is-empty) {
|
||
|
|
do { ^cosign verify --key $pubkey_path $ref } | complete
|
||
|
|
} else {
|
||
|
|
do { ^cosign verify $flag --key $pubkey_path $ref } | complete
|
||
|
|
}
|
||
|
|
if $result.exit_code == 0 {
|
||
|
|
{ ok: true, msg: "signature verified" }
|
||
|
|
} else {
|
||
|
|
let msg = ($result.stderr | str trim | lines | last | default "verification failed")
|
||
|
|
{ ok: false, msg: $msg }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Push a domain artifact directory to the registry.
|
||
|
|
# Directory must contain contract.ncl; example.json is optional.
|
||
|
|
# ref format: <registry>/domains/<participant>/<id>:<version>
|
||
|
|
# If --ref is omitted, reads id/version from manifest.ncl; participant must be supplied.
|
||
|
|
# Endpoint resolves via sentinel pattern: --registry "" → resolve-registry.
|
||
|
|
# Credentials resolve from manifest's registry_provides[--registry-id] (default "primary").
|
||
|
|
export def domain-push [
|
||
|
|
path: string
|
||
|
|
participant: string
|
||
|
|
--ref: string = ""
|
||
|
|
--registry: string = "" # sentinel — empty resolves via resolve-registry
|
||
|
|
--registry-id: string = "" # empty = use registries.default from manifest # which RegistryEntry to use for credentials
|
||
|
|
]: nothing -> record {
|
||
|
|
let oras = (require-oras)
|
||
|
|
let project_root = ($env.ONTOREF_PROJECT_ROOT? | default $env.PWD)
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
|
||
|
|
let resolved_ref = if ($ref | is-not-empty) {
|
||
|
|
$ref
|
||
|
|
} else {
|
||
|
|
let manifest_path = ($path | path join "manifest.ncl")
|
||
|
|
if not ($manifest_path | path exists) {
|
||
|
|
error make --unspanned { msg: $"No manifest.ncl in ($path) and --ref not provided" }
|
||
|
|
}
|
||
|
|
let import_path = ($env.NICKEL_IMPORT_PATH? | default ($env.PROVISIONING? | default ""))
|
||
|
|
let ncl = (do { ^nickel export --import-path $import_path $manifest_path } | complete)
|
||
|
|
if $ncl.exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"Failed to evaluate manifest.ncl: ($ncl.stderr)" }
|
||
|
|
}
|
||
|
|
let artifact = ($ncl.stdout | from json | get artifact)
|
||
|
|
domain-ref $reg $participant $artifact.id $artifact.version
|
||
|
|
}
|
||
|
|
|
||
|
|
let contract = ($path | path join "contract.ncl")
|
||
|
|
if not ($contract | path exists) {
|
||
|
|
error make --unspanned { msg: $"Domain directory ($path) missing required contract.ncl" }
|
||
|
|
}
|
||
|
|
|
||
|
|
# Build layer list; copy to immutable before capture in do{} below.
|
||
|
|
mut layer_list = [$"contract.ncl:($CONTRACT_MEDIA_TYPE)"]
|
||
|
|
let example = ($path | path join "example.json")
|
||
|
|
if ($example | path exists) {
|
||
|
|
$layer_list = ($layer_list | append $"example.json:($EXAMPLE_MEDIA_TYPE)")
|
||
|
|
}
|
||
|
|
let layers = $layer_list # immutable copy for closure capture
|
||
|
|
|
||
|
|
# ADR-017: gate by actor scope + namespace, then resolve isolated DOCKER_CONFIG.
|
||
|
|
assert-actor-authorized $project_root push
|
||
|
|
assert-target-in-scope $project_root $"domains/($participant)/"
|
||
|
|
let cred = (resolve-registry-credential $project_root $registry_id --op push)
|
||
|
|
|
||
|
|
log-info $"Pushing domain artifact → ($resolved_ref)"
|
||
|
|
|
||
|
|
let result = (with-env { DOCKER_CONFIG: $cred.docker_config_dir } {
|
||
|
|
do { cd $path; ^$oras push $resolved_ref --artifact-type $DOMAIN_MEDIA_TYPE ...$layers } | complete
|
||
|
|
})
|
||
|
|
rm --recursive --force $cred.docker_config_dir
|
||
|
|
if $result.exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"oras push failed:\n($result.stderr)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let all_output = $"($result.stdout)\n($result.stderr)"
|
||
|
|
let digest_lines = ($all_output | lines | where { |l| $l | str contains "Digest:" })
|
||
|
|
let digest = if ($digest_lines | is-empty) {
|
||
|
|
""
|
||
|
|
} else {
|
||
|
|
$digest_lines | first | str replace --regex '.*Digest:\s*' '' | str trim
|
||
|
|
}
|
||
|
|
|
||
|
|
{ ref: $resolved_ref, digest: $digest, status: "pushed" }
|
||
|
|
}
|
||
|
|
|
||
|
|
# Pull a domain artifact into the local cache.
|
||
|
|
# Returns the cache directory path.
|
||
|
|
export def domain-pull [
|
||
|
|
participant: string
|
||
|
|
id: string
|
||
|
|
version: string
|
||
|
|
--registry: string = ""
|
||
|
|
--registry-id: string = "" # empty = use registries.default from manifest
|
||
|
|
]: nothing -> string {
|
||
|
|
let oras = (require-oras)
|
||
|
|
let project_root = ($env.ONTOREF_PROJECT_ROOT? | default $env.PWD)
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let ref = (domain-ref $reg $participant $id $version)
|
||
|
|
let cache = (domain-cache-dir $participant $id $version)
|
||
|
|
|
||
|
|
# Authorize FIRST — cache hits without auth check would bypass scope enforcement.
|
||
|
|
# The cache is convenience for the registry round-trip, not a security boundary.
|
||
|
|
assert-actor-authorized $project_root pull
|
||
|
|
assert-target-in-scope $project_root $"domains/($participant)/"
|
||
|
|
|
||
|
|
let cached_manifest = ($cache | path join "oci-manifest.json")
|
||
|
|
if ($cache | path exists) and ($cached_manifest | path exists) {
|
||
|
|
log-debug $"Cache hit for ($id):($version) at ($cache)"
|
||
|
|
return $cache
|
||
|
|
}
|
||
|
|
|
||
|
|
let cred = (resolve-registry-credential $project_root $registry_id --op pull)
|
||
|
|
|
||
|
|
mkdir $cache
|
||
|
|
log-info $"Pulling ($ref) → ($cache)"
|
||
|
|
|
||
|
|
let result = (with-env { DOCKER_CONFIG: $cred.docker_config_dir } {
|
||
|
|
do { ^$oras pull $ref --output $cache } | complete
|
||
|
|
})
|
||
|
|
if $result.exit_code != 0 {
|
||
|
|
rm --recursive --force $cred.docker_config_dir
|
||
|
|
rm --recursive --force $cache
|
||
|
|
error make --unspanned { msg: $"oras pull failed:\n($result.stderr)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let manifest = (with-env { DOCKER_CONFIG: $cred.docker_config_dir } {
|
||
|
|
do { ^$oras manifest fetch $ref } | complete
|
||
|
|
})
|
||
|
|
rm --recursive --force $cred.docker_config_dir
|
||
|
|
if $manifest.exit_code == 0 {
|
||
|
|
$manifest.stdout | save --force ($cache | path join "oci-manifest.json")
|
||
|
|
}
|
||
|
|
|
||
|
|
$cache
|
||
|
|
}
|
||
|
|
|
||
|
|
# Fetch and return the OCI manifest for a domain artifact.
|
||
|
|
export def domain-describe [
|
||
|
|
participant: string
|
||
|
|
id: string
|
||
|
|
version: string
|
||
|
|
--registry: string = ""
|
||
|
|
--registry-id: string = "" # empty = use registries.default from manifest
|
||
|
|
]: nothing -> record {
|
||
|
|
let oras = (require-oras)
|
||
|
|
let project_root = ($env.ONTOREF_PROJECT_ROOT? | default $env.PWD)
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let ref = (domain-ref $reg $participant $id $version)
|
||
|
|
|
||
|
|
assert-actor-authorized $project_root pull
|
||
|
|
assert-target-in-scope $project_root $"domains/($participant)/"
|
||
|
|
let cred = (resolve-registry-credential $project_root $registry_id --op pull)
|
||
|
|
|
||
|
|
let result = (with-env { DOCKER_CONFIG: $cred.docker_config_dir } {
|
||
|
|
do { ^$oras manifest fetch $ref } | complete
|
||
|
|
})
|
||
|
|
rm --recursive --force $cred.docker_config_dir
|
||
|
|
if $result.exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"oras manifest fetch failed:\n($result.stderr)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let manifest = ($result.stdout | from json)
|
||
|
|
{
|
||
|
|
ref: $ref,
|
||
|
|
artifact_type: ($manifest | get -o artifactType | default ""),
|
||
|
|
layers: ($manifest | get -o layers | default []),
|
||
|
|
digest: ($manifest | get -o config.digest | default ""),
|
||
|
|
raw: $manifest,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Verify a domain artifact: pull to cache, check digest consistency,
|
||
|
|
# typecheck the contract.ncl layer, and verify cosign signature.
|
||
|
|
# Cosign key resolution order: --cosign-key flag → ONTOREF_COSIGN_PUBKEY env →
|
||
|
|
# $PROVISIONING/catalog/domains/_signing/cosign.pub. Unsigned artifacts pass
|
||
|
|
# when no key is resolvable; fail when a key is found but signature is absent.
|
||
|
|
export def domain-verify [
|
||
|
|
participant: string
|
||
|
|
id: string
|
||
|
|
version: string
|
||
|
|
--registry: string = ""
|
||
|
|
--registry-id: string = "" # empty = use registries.default from manifest
|
||
|
|
--cosign-key: string = ""
|
||
|
|
]: nothing -> record {
|
||
|
|
let project_root = ($env.ONTOREF_PROJECT_ROOT? | default $env.PWD)
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let cache = (domain-pull $participant $id $version --registry $reg --registry-id $registry_id)
|
||
|
|
let oras = (require-oras)
|
||
|
|
let ref = (domain-ref $reg $participant $id $version)
|
||
|
|
let manifest = (domain-describe $participant $id $version --registry $reg --registry-id $registry_id)
|
||
|
|
|
||
|
|
mut artifact_type_ok = false
|
||
|
|
mut contract_present_ok = false
|
||
|
|
mut contract_typechecks_ok = false
|
||
|
|
mut digest_ok = false
|
||
|
|
mut cosign_ok = true
|
||
|
|
mut errors = []
|
||
|
|
|
||
|
|
if $manifest.artifact_type == $DOMAIN_MEDIA_TYPE {
|
||
|
|
$artifact_type_ok = true
|
||
|
|
} else {
|
||
|
|
$errors = ($errors | append $"Expected artifactType ($DOMAIN_MEDIA_TYPE), got ($manifest.artifact_type)")
|
||
|
|
}
|
||
|
|
|
||
|
|
let contract_path = ($cache | path join "contract.ncl")
|
||
|
|
if ($contract_path | path exists) {
|
||
|
|
$contract_present_ok = true
|
||
|
|
|
||
|
|
let import_path = ($env.NICKEL_IMPORT_PATH? | default ($env.PROVISIONING? | default ""))
|
||
|
|
let ncl_check = (do { ^nickel typecheck --import-path $import_path $contract_path } | complete)
|
||
|
|
if $ncl_check.exit_code == 0 {
|
||
|
|
$contract_typechecks_ok = true
|
||
|
|
} else {
|
||
|
|
$errors = ($errors | append $"contract.ncl typecheck failed: ($ncl_check.stderr)")
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
$errors = ($errors | append "contract.ncl not found in pulled artifact")
|
||
|
|
}
|
||
|
|
|
||
|
|
# Live manifest fetch for digest comparison — needs its own DOCKER_CONFIG.
|
||
|
|
assert-actor-authorized $project_root pull
|
||
|
|
assert-target-in-scope $project_root $"domains/($participant)/"
|
||
|
|
let verify_cred = (resolve-registry-credential $project_root $registry_id --op pull)
|
||
|
|
let live = (with-env { DOCKER_CONFIG: $verify_cred.docker_config_dir } {
|
||
|
|
do { ^$oras manifest fetch $ref } | complete
|
||
|
|
})
|
||
|
|
rm --recursive --force $verify_cred.docker_config_dir
|
||
|
|
if $live.exit_code == 0 {
|
||
|
|
let cached_manifest_path = ($cache | path join "oci-manifest.json")
|
||
|
|
if ($cached_manifest_path | path exists) {
|
||
|
|
let cached_raw = (open $cached_manifest_path | to json --indent 0)
|
||
|
|
let live_raw = ($live.stdout | from json | to json --indent 0)
|
||
|
|
if $cached_raw == $live_raw {
|
||
|
|
$digest_ok = true
|
||
|
|
} else {
|
||
|
|
$errors = ($errors | append "Cached manifest diverges from live registry — re-pull needed")
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
$digest_ok = true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
let resolved_key = (find-cosign-pubkey $cosign_key)
|
||
|
|
let cosign_result = if ($resolved_key | is-not-empty) {
|
||
|
|
cosign-verify-signature $ref $resolved_key
|
||
|
|
} else {
|
||
|
|
{ ok: true, msg: "no cosign key configured — signature check skipped" }
|
||
|
|
}
|
||
|
|
if not $cosign_result.ok {
|
||
|
|
$cosign_ok = false
|
||
|
|
$errors = ($errors | append $"cosign: ($cosign_result.msg)")
|
||
|
|
}
|
||
|
|
|
||
|
|
let checks = {
|
||
|
|
artifact_type: $artifact_type_ok,
|
||
|
|
contract_present: $contract_present_ok,
|
||
|
|
contract_typechecks: $contract_typechecks_ok,
|
||
|
|
digest_ok: $digest_ok,
|
||
|
|
cosign_signature: $cosign_ok,
|
||
|
|
}
|
||
|
|
let pass = $artifact_type_ok and $contract_present_ok and $contract_typechecks_ok and $digest_ok and $cosign_ok
|
||
|
|
{ ref: $ref, pass: $pass, checks: $checks, errors: $errors, cosign_key: $resolved_key }
|
||
|
|
}
|
||
|
|
|
||
|
|
# List all domain artifacts in the registry (domains/<participant>/<id> namespace).
|
||
|
|
# Uses zot OCI catalog API; returns empty list if catalog is disabled.
|
||
|
|
# Registry resolution: --registry flag → PROVISIONING_REGISTRY env → capabilities.ncl → DEFAULT_REGISTRY
|
||
|
|
export def ecosystem-list-domains [
|
||
|
|
--registry: string = ""
|
||
|
|
]: nothing -> list {
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let catalog_url = $"https://($reg)/v2/_catalog"
|
||
|
|
|
||
|
|
let body = try {
|
||
|
|
http get $catalog_url
|
||
|
|
} catch {
|
||
|
|
log-error $"Registry catalog API unavailable at ($catalog_url)"
|
||
|
|
return []
|
||
|
|
}
|
||
|
|
|
||
|
|
let repos = ($body | get -o repositories | default [])
|
||
|
|
$repos
|
||
|
|
| where { |r| $r | str starts-with "domains/" }
|
||
|
|
| each { |r|
|
||
|
|
# repos are domains/<participant>/<id>
|
||
|
|
let parts = ($r | str replace "domains/" "" | split row "/")
|
||
|
|
let participant = ($parts | first)
|
||
|
|
let domain_id = ($parts | skip 1 | str join "/")
|
||
|
|
let tags = (domain-tags $participant $domain_id --registry $reg)
|
||
|
|
{ participant: $participant, id: $domain_id, versions: $tags, ref_prefix: $"($reg)/($r)" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
def domain-tags [participant: string, id: string, --registry: string = ""]: nothing -> list {
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let url = $"https://($reg)/v2/domains/($participant)/($id)/tags/list"
|
||
|
|
let body = try {
|
||
|
|
http get $url
|
||
|
|
} catch {
|
||
|
|
return []
|
||
|
|
}
|
||
|
|
$body | get -o tags | default []
|
||
|
|
}
|
||
|
|
|
||
|
|
def mode-ref [registry: string, participant: string, mode_id: string, version: string]: nothing -> string {
|
||
|
|
$"($registry)/modes/($participant)/($mode_id):($version)"
|
||
|
|
}
|
||
|
|
|
||
|
|
def mode-cache-dir [participant: string, mode_id: string, version: string]: nothing -> string {
|
||
|
|
$env.HOME | path join $MODE_CACHE_BASE $participant $mode_id $version
|
||
|
|
}
|
||
|
|
|
||
|
|
# Push a mode artifact to the registry.
|
||
|
|
# Mode directory must contain provisioning.ncl and domains.lock.ncl.
|
||
|
|
# ref format: <registry>/modes/<participant>/<mode-id>:<version>
|
||
|
|
export def mode-push [
|
||
|
|
path: string
|
||
|
|
participant: string
|
||
|
|
mode_id: string
|
||
|
|
version: string
|
||
|
|
--registry: string = ""
|
||
|
|
--registry-id: string = "" # empty = use registries.default from manifest
|
||
|
|
]: nothing -> record {
|
||
|
|
let oras = (require-oras)
|
||
|
|
let project_root = ($env.ONTOREF_PROJECT_ROOT? | default $env.PWD)
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let ref = (mode-ref $reg $participant $mode_id $version)
|
||
|
|
|
||
|
|
let decl_path = ($path | path join "provisioning.ncl")
|
||
|
|
let lock_path = ($path | path join "domains.lock.ncl")
|
||
|
|
|
||
|
|
if not ($decl_path | path exists) {
|
||
|
|
error make --unspanned { msg: $"Mode directory ($path) missing provisioning.ncl" }
|
||
|
|
}
|
||
|
|
if not ($lock_path | path exists) {
|
||
|
|
error make --unspanned { msg: $"Mode directory ($path) missing domains.lock.ncl" }
|
||
|
|
}
|
||
|
|
|
||
|
|
assert-actor-authorized $project_root push
|
||
|
|
assert-target-in-scope $project_root $"modes/($participant)/"
|
||
|
|
let cred = (resolve-registry-credential $project_root $registry_id --op push)
|
||
|
|
|
||
|
|
log-info $"Pushing mode artifact → ($ref)"
|
||
|
|
|
||
|
|
let decl_layer = $"provisioning.ncl:($MODE_DECL_MEDIA_TYPE)"
|
||
|
|
let lock_layer = $"domains.lock.ncl:($MODE_LOCK_MEDIA_TYPE)"
|
||
|
|
let result = (with-env { DOCKER_CONFIG: $cred.docker_config_dir } {
|
||
|
|
do { cd $path; ^$oras push $ref --artifact-type $MODE_MEDIA_TYPE $decl_layer $lock_layer } | complete
|
||
|
|
})
|
||
|
|
rm --recursive --force $cred.docker_config_dir
|
||
|
|
|
||
|
|
if $result.exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"oras push mode failed:\n($result.stderr)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let all_output = $"($result.stdout)\n($result.stderr)"
|
||
|
|
let digest_lines = ($all_output | lines | where { |l| $l | str contains "Digest:" })
|
||
|
|
let digest = if ($digest_lines | is-empty) {
|
||
|
|
""
|
||
|
|
} else {
|
||
|
|
$digest_lines | first | str replace --regex '.*Digest:\s*' '' | str trim
|
||
|
|
}
|
||
|
|
|
||
|
|
{ ref: $ref, digest: $digest, participant: $participant, mode_id: $mode_id, version: $version, status: "pushed" }
|
||
|
|
}
|
||
|
|
|
||
|
|
# Pull a mode artifact into the local cache.
|
||
|
|
export def mode-pull [
|
||
|
|
participant: string
|
||
|
|
mode_id: string
|
||
|
|
version: string
|
||
|
|
--registry: string = ""
|
||
|
|
--registry-id: string = "" # empty = use registries.default from manifest
|
||
|
|
]: nothing -> string {
|
||
|
|
let oras = (require-oras)
|
||
|
|
let project_root = ($env.ONTOREF_PROJECT_ROOT? | default $env.PWD)
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let ref = (mode-ref $reg $participant $mode_id $version)
|
||
|
|
let cache = (mode-cache-dir $participant $mode_id $version)
|
||
|
|
|
||
|
|
# Authorize FIRST — cache hits would bypass scope enforcement otherwise.
|
||
|
|
assert-actor-authorized $project_root pull
|
||
|
|
assert-target-in-scope $project_root $"modes/($participant)/"
|
||
|
|
|
||
|
|
let cached_manifest = ($cache | path join "oci-manifest.json")
|
||
|
|
if ($cache | path exists) and ($cached_manifest | path exists) {
|
||
|
|
log-debug $"Cache hit for mode ($participant)/($mode_id):($version) at ($cache)"
|
||
|
|
return $cache
|
||
|
|
}
|
||
|
|
|
||
|
|
let cred = (resolve-registry-credential $project_root $registry_id --op pull)
|
||
|
|
|
||
|
|
mkdir $cache
|
||
|
|
log-info $"Pulling mode ($ref) → ($cache)"
|
||
|
|
|
||
|
|
let result = (with-env { DOCKER_CONFIG: $cred.docker_config_dir } {
|
||
|
|
do { ^$oras pull $ref --output $cache } | complete
|
||
|
|
})
|
||
|
|
if $result.exit_code != 0 {
|
||
|
|
rm --recursive --force $cred.docker_config_dir
|
||
|
|
rm --recursive --force $cache
|
||
|
|
error make --unspanned { msg: $"oras pull mode failed:\n($result.stderr)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let manifest = (with-env { DOCKER_CONFIG: $cred.docker_config_dir } {
|
||
|
|
do { ^$oras manifest fetch $ref } | complete
|
||
|
|
})
|
||
|
|
rm --recursive --force $cred.docker_config_dir
|
||
|
|
if $manifest.exit_code == 0 {
|
||
|
|
$manifest.stdout | save --force ($cache | path join "oci-manifest.json")
|
||
|
|
}
|
||
|
|
|
||
|
|
$cache
|
||
|
|
}
|
||
|
|
|
||
|
|
# Walk up from CWD looking for infra/*/capabilities.ncl (workspace convention).
|
||
|
|
def _find-capabilities-ncl []: nothing -> string {
|
||
|
|
let ws_path = ($env | get -o PROVISIONING_WORKSPACE_PATH | default "")
|
||
|
|
if ($ws_path | is-not-empty) {
|
||
|
|
let candidates = (do { glob $"($ws_path)/infra/*/capabilities.ncl" } | default [])
|
||
|
|
if ($candidates | is-not-empty) {
|
||
|
|
return ($candidates | first)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
mut dir = $env.PWD
|
||
|
|
for _ in 0..6 {
|
||
|
|
# Skip filesystem root — glob "//infra/..." is malformed.
|
||
|
|
if $dir == "/" or ($dir | str trim) == "" { break }
|
||
|
|
let cur = $dir # immutable copy for closure capture in glob
|
||
|
|
let candidates = (try {
|
||
|
|
do { glob $"($cur)/infra/*/capabilities.ncl" } | default []
|
||
|
|
} catch { [] })
|
||
|
|
if ($candidates | is-not-empty) {
|
||
|
|
return ($candidates | first)
|
||
|
|
}
|
||
|
|
let parent = ($dir | path dirname)
|
||
|
|
if $parent == $dir { break }
|
||
|
|
$dir = $parent
|
||
|
|
}
|
||
|
|
""
|
||
|
|
}
|
||
|
|
|
||
|
|
# Resolve the active registry endpoint.
|
||
|
|
# Priority: PROVISIONING_REGISTRY env → capabilities.ncl provides.registries.default → DEFAULT_REGISTRY
|
||
|
|
export def resolve-registry []: nothing -> string {
|
||
|
|
let from_env = ($env | get -o PROVISIONING_REGISTRY | default "")
|
||
|
|
if ($from_env | is-not-empty) {
|
||
|
|
return $from_env
|
||
|
|
}
|
||
|
|
let caps_path = (_find-capabilities-ncl)
|
||
|
|
if ($caps_path | is-not-empty) {
|
||
|
|
let import_path = ($env.NICKEL_IMPORT_PATH? | default ($env.PROVISIONING? | default ""))
|
||
|
|
let ncl = (do { ^nickel export --import-path $import_path $caps_path } | complete)
|
||
|
|
if $ncl.exit_code == 0 {
|
||
|
|
let data = ($ncl.stdout | from json)
|
||
|
|
let reg_default = ($data | get -o provides.registries.default | default "")
|
||
|
|
let registries = ($data | get -o provides.registries.registries | default [])
|
||
|
|
if ($reg_default | is-not-empty) and ($registries | is-not-empty) {
|
||
|
|
let entry = ($registries | where { |e| $e.id == $reg_default } | first | default null)
|
||
|
|
if $entry != null {
|
||
|
|
return $entry.endpoint
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
$DEFAULT_REGISTRY
|
||
|
|
}
|
||
|
|
|
||
|
|
def mode-tags [participant: string, mode_id: string, --registry: string = ""]: nothing -> list {
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let url = $"https://($reg)/v2/modes/($participant)/($mode_id)/tags/list"
|
||
|
|
let body = try {
|
||
|
|
http get $url
|
||
|
|
} catch {
|
||
|
|
return []
|
||
|
|
}
|
||
|
|
$body | get -o tags | default []
|
||
|
|
}
|
||
|
|
|
||
|
|
# List all mode artifacts in the registry (modes/<participant>/<mode-id> namespace).
|
||
|
|
# Registry resolution: --registry flag → PROVISIONING_REGISTRY env → capabilities.ncl → DEFAULT_REGISTRY
|
||
|
|
export def ecosystem-list-modes [
|
||
|
|
--registry: string = ""
|
||
|
|
]: nothing -> list {
|
||
|
|
let reg = if ($registry | is-empty) { resolve-registry } else { $registry }
|
||
|
|
let catalog_url = $"https://($reg)/v2/_catalog"
|
||
|
|
|
||
|
|
let body = try {
|
||
|
|
http get $catalog_url
|
||
|
|
} catch {
|
||
|
|
log-error $"Registry catalog API unavailable at ($catalog_url)"
|
||
|
|
return []
|
||
|
|
}
|
||
|
|
|
||
|
|
let repos = ($body | get -o repositories | default [])
|
||
|
|
$repos
|
||
|
|
| where { |r| $r | str starts-with "modes/" }
|
||
|
|
| each { |r|
|
||
|
|
let parts = ($r | str replace "modes/" "" | split row "/")
|
||
|
|
let participant = ($parts | first)
|
||
|
|
let mode_id = ($parts | skip 1 | str join "/")
|
||
|
|
let tags = (mode-tags $participant $mode_id --registry $reg)
|
||
|
|
{ participant: $participant, id: $mode_id, versions: $tags, ref_prefix: $"($reg)/($r)" }
|
||
|
|
}
|
||
|
|
}
|