In the OmniBOR specification, Artifact Input Manifests record the identifiers of the inputs used to produce a software artifact. These identifiers are recorded in lexicographic order and may be stored in two distinct ways:
The full record embedded in the software artifact they describe.
Just the identifier of the manifest itself embedded in the artifact.
Either way, some embedding is happening, and the nature of the embedding is dependent on the type of artifact which is being embedded into.
For ELF files, the embedding involves a specified notes section being added
For text files, the embedding involves comments being added in a specified manner
Note that further embedding extensions can be added, and I believe the goal of the OmniBOR spec in general includes specifying embedding mechanisms for as many popular formats as possible. This is very important given that the exact nature of the embedding impacts identifier generation for the thing being embedded into. For things to be reproducible independently, they must be very carefully specified.
In the Rust code, we probably want to name the type something like ArtifactManifest or InputManifest rather than ArtifactInputManifest just because that name is enormous.
The specific operations for it are going to basically be constructing based on some bundle of inputs for which identifiers are produced, and then having some mechanism to embed in the output artifact.
The goal of the API is to make this as foolproof as possible.
In the OmniBOR specification, Artifact Input Manifests record the identifiers of the inputs used to produce a software artifact. These identifiers are recorded in lexicographic order and may be stored in two distinct ways:
Either way, some embedding is happening, and the nature of the embedding is dependent on the type of artifact which is being embedded into.
Note that further embedding extensions can be added, and I believe the goal of the OmniBOR spec in general includes specifying embedding mechanisms for as many popular formats as possible. This is very important given that the exact nature of the embedding impacts identifier generation for the thing being embedded into. For things to be reproducible independently, they must be very carefully specified.
In the Rust code, we probably want to name the type something like
ArtifactManifest
orInputManifest
rather thanArtifactInputManifest
just because that name is enormous.The specific operations for it are going to basically be constructing based on some bundle of inputs for which identifiers are produced, and then having some mechanism to embed in the output artifact.
The goal of the API is to make this as foolproof as possible.