omnibor / omnibor-rs

Reproducible identifiers & fine-grained build dependency tracking for software artifacts.
https://omnibor.io
Apache License 2.0
19 stars 9 forks source link

Define `ArtifactManifest` type which collects `ArtifactId`s for build inputs which produced an artifact. #176

Closed alilleybrinker closed 2 months ago

alilleybrinker commented 7 months ago

In the OmniBOR specification, Artifact Input Manifests record the identifiers of the inputs used to produce a software artifact. These identifiers are recorded in lexicographic order and may be stored in two distinct ways:

Either way, some embedding is happening, and the nature of the embedding is dependent on the type of artifact which is being embedded into.

Note that further embedding extensions can be added, and I believe the goal of the OmniBOR spec in general includes specifying embedding mechanisms for as many popular formats as possible. This is very important given that the exact nature of the embedding impacts identifier generation for the thing being embedded into. For things to be reproducible independently, they must be very carefully specified.

In the Rust code, we probably want to name the type something like ArtifactManifest or InputManifest rather than ArtifactInputManifest just because that name is enormous.

The specific operations for it are going to basically be constructing based on some bundle of inputs for which identifiers are produced, and then having some mechanism to embed in the output artifact.

The goal of the API is to make this as foolproof as possible.

alilleybrinker commented 2 months ago

This has actually been done, though embedding mode is not yet implemented.