jobs/runner/Cargo.toml
[package]
name = "holger-job-runner"
version = "4.0.0"
edition = "2021"
authors = ["Ignalina ApS", "Vetra Automation AB"]
description = "Holger's job runners behind the Heimdall job API: ContainerRunner, the interim runner over Holger's own sandbox (podman, its API, crun, the sidecar; a fresh container per job, no network, a read-only root, signed per-boot results), the caller's acceptance check (the pinned key, the job id, the listed outputs), and a test runner that no release build carries."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
categories = ["development-tools"]
keywords = ["sandbox", "jobs", "airgap"]
# NETWORK-FREE.
[dependencies]
# Heimdall's job API: its own crate from crates.io (published and SLSA-attested by the
# Heimdall project), named `heimdall-core` in code. Nothing of Heimdall is vendored here.
heimdall-core = { package = "nordisk-heimdall-core", version = "0.2" }
holger-sandbox = { version = "4.0.0", path = "../../server/sandbox" }
holger-errcode = { version = "3.0.0", path = "../../errcode" }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
# The runner hashes every output itself, in pieces (a bundle's copy can be large).
sha2 = "0.11"
hex = "0.4"
# Feature `heimdall` (lane HOL-HEIMDALL-02): Heimdall's protected native runner and its
# `youki-plain` fallback, from crates.io (SLSA-attested). The shims (`--features youki`,
# libseccomp) are separate programs the runner starts; nothing here links libcontainer.
heimdall-container = { package = "nordisk-heimdall-container", version = "0.2.1", optional = true }
heimdall-plain = { package = "nordisk-heimdall-plain", version = "0.2.1", optional = true }
# Feature `heimdall-wasm`: heimdall-run 0.2 loads the vendored verify-bundle guests (the split
# pair) under the korp root with Holger's own BLAKE3 pins (`guests`).
heimdall-run = { package = "nordisk-heimdall-run", version = "0.2", optional = true }
blake3 = { version = "1", optional = true }
[features]
# **`test-runner`**: [`InProcessRunner`], the job's program in the caller's own process.
# For unit tests only: server-lib's `sandbox-off` (a test build) turns it on, and no
# shipped build names it (`server/cli/tests/release_has_no_test_runner.rs`).
test-runner = []
# **`heimdall`**: [`heimdall::HeimdallJobs`], Holger's worker under Heimdall's runner
# (`engine: heimdall`), with `youki-plain` where Heimdall cannot start.
heimdall = ["dep:heimdall-container", "dep:heimdall-plain", "dep:blake3"]
# **`heimdall-wasm`**: [`guests`], Heimdall's released verify-bundle guests, pinned and loaded.
heimdall-wasm = ["dep:heimdall-run", "dep:blake3"]
[dev-dependencies]
tempfile = "3"
# tests/heimdall_from_crates_io.rs reads the lock and the manifests.
toml = "1"
# heimdall_tests.rs: a worker rootfs tar to mint, and the `heimdall:` block read as RON.
tar = "0.4"
ron = "0.12"
# tests/vendored_heimdall_guests.rs: the korp root PEM read as DER, PINS.toml, and the
# release's SLSA statement verified by Holger's own provenance verifier.
base64 = "0.23"
holger-provenance = { version = "3.0.0", path = "../../provenance" }
[[test]]
name = "vendored_heimdall_guests"
required-features = ["heimdall-wasm"]