nordisk/Skidbladnir

move — design

Class: design · Function axis: f3 (AIRGAP3: transfer + receive). States only the shape we ship.

Transfer is out-of-band; receipt is a local gate

The bundle crosses the gap by any means (disk, diode, courier) — Skidbladnir does zero network I/O. The fetch module is the receive side: a pure, local verify that gates the unpack.

Verify-on-receipt

fetch::verify_on_receipt(bundle, archive, expected_bundle_sha) -> VerifyReport (fetch.rs:42) runs three checks, all offline:

1. recompute the manifest root hash (fetch.rs:50);
2. an optional out-of-band whole-file SHA the manifest cannot self-attest (fetch.rs:52);
3. per-entry verification, delegated to Archive::verify_entries in a single pass (fetch.rs:61).

VerifyReport { bundle_hash_ok, manifest_root_ok, bad_entries } (fetch.rs:20); is_ok() (fetch.rs:30) is the AND of all three.

fetch::fetch_and_verify(bundle, archive) -> Bundle (fetch.rs:74) verifies (no out-of-band SHA) and hands back a Bundle handle, or bails naming exactly what failed.

Per-OS specialization + unpack

platform::Platform (platform.rs:15) is Rhel | Debian | Other.

• Platform::detect() (platform.rs:23) reads /etc/os-release offline; from_os_release (platform.rs:29) is the pure parse (rhel/centos/fedora/rocky/almalinux → Rhel; debian/ubuntu → Debian; else Other). uses_selinux() (platform.rs:47) is true only for Rhel.
• platform::specialize(p, disable_selinux) -> Vec<String> (platform.rs:56) — per-platform prep; the SELinux toggle is written 100% in Rust as echo 0 > /sys/fs/selinux/enforce (platform.rs:62), non-fatal, returning the actions taken ("selinux:permissive" / "selinux:skip(...)").
• platform::unpack(archive, bundle, software_dir) (platform.rs:75) — a thin wrapper over Archive::extract_all into the software dir.

Contract (inject-assert tests)

faithful_bundle_verifies_on_receipt (fetch.rs:108), tampered_manifest_is_rejected (fetch.rs:122), wrong_out_of_band_sha_is_rejected (fetch.rs:141), manifest_entry_absent_from_bundle_is_reported_bad (fetch.rs:179), os_release_detects_family_and_selinux (platform.rs:92), specialize_only_touches_selinux_on_rhel (platform.rs:107).