nordisk/holger

.nornir/assets/checksum-deploy-flow.svg

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 300" font-family="ui-sans-serif,system-ui,sans-serif" font-size="13">
  <defs>
    <marker id="arw" markerWidth="9" markerHeight="9" refX="7" refY="3" orient="auto" markerUnits="strokeWidth">
      <path d="M0,0 L7,3 L0,6 Z" fill="#64748b"/>
    </marker>
    <style>
      .box{fill:#0f172a;stroke:#334155;stroke-width:1.5;rx:8}
      .lbl{fill:#e2e8f0}
      .sub{fill:#94a3b8;font-size:11px}
      .ok{fill:#065f46;stroke:#10b981}
      .bad{fill:#7f1d1d;stroke:#ef4444}
      .edge{stroke:#64748b;stroke-width:1.5;fill:none}
      @media (prefers-color-scheme: light){
        .box{fill:#f1f5f9;stroke:#cbd5e1}
        .lbl{fill:#0f172a}.sub{fill:#475569}
        .ok{fill:#d1fae5;stroke:#059669}.bad{fill:#fee2e2;stroke:#dc2626}
      }
    </style>
  </defs>

  <text x="20" y="26" class="lbl" font-size="15" font-weight="700">Checksum-verify-on-deploy — the HTTP write gate</text>

  <rect class="box" x="20" y="60" width="150" height="56" rx="8"/>
  <text x="95" y="84" class="lbl" text-anchor="middle">PUT + body</text>
  <text x="95" y="102" class="sub" text-anchor="middle">X-Checksum-Sha256</text>

  <rect class="box" x="210" y="60" width="130" height="56" rx="8"/>
  <text x="275" y="84" class="lbl" text-anchor="middle">auth + RBAC</text>
  <text x="275" y="102" class="sub" text-anchor="middle">read-only gate</text>

  <rect class="box" x="380" y="60" width="150" height="56" rx="8"/>
  <text x="455" y="80" class="lbl" text-anchor="middle">recompute digest</text>
  <text x="455" y="98" class="sub" text-anchor="middle">sha256/sha512 of body</text>

  <rect class="box ok" x="590" y="30" width="150" height="52" rx="8"/>
  <text x="665" y="54" class="lbl" text-anchor="middle" font-weight="700">match → backend</text>
  <text x="665" y="71" class="sub" text-anchor="middle">write proceeds</text>

  <rect class="box bad" x="590" y="100" width="150" height="52" rx="8"/>
  <text x="665" y="124" class="lbl" text-anchor="middle" font-weight="700">mismatch → 400</text>
  <text x="665" y="141" class="sub" text-anchor="middle">audited, not stored</text>

  <path class="edge" d="M170,88 L206,88" marker-end="url(#arw)"/>
  <path class="edge" d="M340,88 L376,88" marker-end="url(#arw)"/>
  <path class="edge" d="M530,80 C560,70 560,60 586,56" marker-end="url(#arw)"/>
  <path class="edge" d="M530,96 C560,106 560,116 586,124" marker-end="url(#arw)"/>

  <text x="20" y="200" class="sub">Opt-in: no header ⇒ no-op (write proceeds unverified, as before).</text>
  <text x="20" y="220" class="sub">Strong digests only — sha1/md5 refused. Runs after the size cap, before dispatch.</text>
</svg>