server/repository/znippy-build-thing/Cargo.toml
[package]
name = "holger-znippy-build-thing-repository"
version.workspace = true
edition = "2021"
authors = ["Ignalina ApS", "Vetra Automation AB"]
description = "The znippy-build-thing repository backend for holger — serves a forge's BUILD HISTORY out of a .znippy archive: one build-provenance attestation per built artifact, addressed by the artifact's own sha256, plus the derived recipe→artifacts lookup a CVE sweep reads. Read-only, pure path mapping, no shared types with the writer."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
categories = ["command-line-utilities", "development-tools"]
keywords = ["znippy", "provenance", "attestation", "slsa", "artifacts"]
[dependencies]
anyhow = "1.0.104"
traits = { package = "holger-traits", version = "3.0.0", path = "../../../traits" }
znippy-common = { version = "0.10.4", features = ["host-decompressors"] }
log = "0.4"
# The manifest is parsed for ONE thing: `list()`'s human-facing coordinates. Every
# serving route is pure path mapping and touches no JSON, so a manifest this holger
# does not understand degrades `list()` to the archive-path fallback rather than
# taking the repo down. Unknown fields are ignored by default, which is what makes
# the writer free to add some.
serde = { version = "1", features = ["derive"] }
serde_json = "1"
[dev-dependencies]
traits = { package = "holger-traits", path = "../../../traits", features = ["test-support"] }
tempfile = "3"