crates/dwarves-slsa/Cargo.toml
[package]
name = "dwarves-slsa"
version = "0.1.0"
edition = "2021"
license = "MIT OR Apache-2.0"
repository = "https://git.gunnar.rs/nordisk/dwarves"
# Not published yet: the release runner is dwarf's own platform tool. Monetize's
# self-release and the media builds call the library (statement, DSSE, verify).
publish = false
description = "SLSA v1 Build L3 release runner for the nordisk constellation: each release builds in a fresh, network-off container from read-only pinned sources and a vendored, lock-checked crate set; the platform (not the build) writes the in-toto SLSA provenance, one statement per release, which the owner signs on a YubiKey (DSSE, ECDSA P-256). Verifies the signed bundle against the committed release key."
[lib]
name = "dwarves_slsa"
[[bin]]
name = "dwarves-slsa"
path = "src/main.rs"
# Small on purpose: no clap. A release build is a Runa pipeline (dwarves-runa): its
# program steps are sealed `Sandbox` containers and its own work `Forge` actions of this
# crate; the dwarves forge runs the pipeline (no container engine and no podman here).
# git (and git-lfs) are spawned for the checkouts only: no library does LFS.
[dependencies]
dwarves-runa = { version = "0.3.0", path = "../../../edda/crates/dwarves-runa" }
# crates.io's index and static crates (was curl)
ureq = { version = "3", default-features = false, features = ["rustls"] }
# staging a packaged .crate (was tar in the build container's shell script)
flate2 = "1"
tar = "0.4"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
toml = "0.8"
sha2 = "0.10"
hex = "0.4"
base64 = "0.22"
# ECDSA P-256 verify (the release key); the tests also sign with it.
ring = "0.17"
[dev-dependencies]
tempfile = "3"