OXYGENHUB
# 4cf0c99a1486 oxygenflow / crates / flow-core / src / canonical.rs
4.9 KiB · Rust · last changed Architecture awareness: image manifests, arch on a sandbox, archs on the claim 1 month ago source blame history raw
1 
//! The canonical job graph (spec §3.2) and object hashes. Pipelines,
2 
//! jobs and receipts are encoded with Oxygen's deterministic CBOR profile
3 
//! (Oxygen spec §5.1: unsigned integer map keys in order) and hashed the
4 
//! way Oxygen hashes objects: `BLAKE3("oxy1 " || type || " " || len || 0x00 || body)`.
5
6 
use crate::pipeline::{Job, Pipeline, Sandbox};
7 
use oxy_core::cbor::{encode, Value};
8
9 
/// A 32-byte object reference, shown as hex.
10 
pub type Hash = [u8; 32];
11
12 
/// Oxygen's object hash construction for a Flow object type.
13 
pub fn object_hash(ty: &str, body: &[u8]) -> Hash {
14 
    let mut h = blake3::Hasher::new();
15 
    h.update(format!("oxy1 {ty} {}\0", body.len()).as_bytes());
16 
    h.update(body);
17 
    *h.finalize().as_bytes()
18 
}
19
20 
fn text(s: &str) -> Value {
21 
    Value::Text(s.to_string())
22 
}
23
24 
fn texts(v: &[String]) -> Value {
25 
    Value::Array(v.iter().map(|s| text(s)).collect())
26 
}
27
28 
fn hex32(s: &str) -> Value {
29 
    Value::Bytes(hex::decode(s).unwrap_or_default())
30 
}
31
32 
pub fn sandbox_value(s: &Sandbox) -> Value {
33 
    let mut fields = vec![
34 
        (0, text(&s.name)),
35 
        (1, text(s.runtime.as_str())),
36 
        (2, hex32(&s.rootfs)),
37 
        (3, Value::Uint(s.memory_mib as u64)),
38 
        (4, Value::Uint(s.cpus as u64)),
39 
        (5, text(s.network.as_str())),
40 
    ];
41 
    // Environment as sorted [name, value] pairs; absent when empty, so
42 
    // sandboxes without one hash as before.
43 
    if !s.env.is_empty() {
44 
        fields.push((6, Value::Array(s.env.iter().map(|(k, v)| Value::Array(vec![text(k), text(v)])).collect())));
45 
    }
46 
    // The architecture asked for; absent when the image decides.
47 
    if let Some(a) = &s.arch {
48 
        fields.push((7, text(a)));
49 
    }
50 
    Value::map(fields)
51 
}
52
53 
pub fn job_value(j: &Job) -> Value {
54 
    let mut fields = vec![
55 
        (0, text(&j.name)),
56 
        (1, text(&j.sandbox)),
57 
        (2, texts(&j.scope)),
58 
        (3, texts(&j.depends_on)),
59 
        // Environment as sorted [name, value] pairs: the profile has integer map keys only.
60 
        (4, Value::Array(j.env.iter().map(|(k, v)| Value::Array(vec![text(k), text(v)])).collect())),
61 
        (5, texts(&j.exec)),
62 
    ];
63 
    // Mounts as [source, target, size MiB] sorted by target; absent when
64 
    // there are none, so jobs without mounts hash as before.
65 
    if !j.mounts.is_empty() {
66 
        fields.push((
67 
            6,
68 
            Value::Array(
69 
                j.mounts
70 
                    .iter()
71 
                    .map(|m| Value::Array(vec![text(m.source.as_str()), text(&m.target), Value::Uint(m.size_mib as u64)]))
72 
                    .collect(),
73 
            ),
74 
        ));
75 
    }
76 
    // Artifacts as [name, path] sorted by name; absent when there are none.
77 
    if !j.outputs.is_empty() {
78 
        fields.push((7, Value::Array(j.outputs.iter().map(|o| Value::Array(vec![text(&o.name), text(&o.path)])).collect())));
79 
    }
80 
    // Secrets as [name, mount path] sorted by name; absent when there are none.
81 
    if !j.secrets.is_empty() {
82 
        fields.push((8, Value::Array(j.secrets.iter().map(|s| Value::Array(vec![text(&s.name), text(&s.mount_path)])).collect())));
83 
    }
84 
    // Identities as [audience, mount path] sorted by audience; absent when none.
85 
    if !j.identities.is_empty() {
86 
        fields.push((9, Value::Array(j.identities.iter().map(|i| Value::Array(vec![text(&i.audience), text(&i.mount_path)])).collect())));
87 
    }
88 
    Value::map(fields)
89 
}
90
91 
impl Pipeline {
92 
    /// The canonical CBOR job graph: sandboxes and jobs in name order.
93 
    pub fn canonical(&self) -> Vec<u8> {
94 
        encode(&Value::map([
95 
            (0, Value::Uint(self.schema_version as u64)),
96 
            (1, Value::Array(self.sandboxes.values().map(sandbox_value).collect())),
97 
            (2, Value::Array(self.jobs.values().map(job_value).collect())),
98 
        ]))
99 
    }
100
101 
    /// `pipeline_hash` of receipts and provenance.
102 
    pub fn hash(&self) -> Hash {
103 
        object_hash("pipeline", &self.canonical())
104 
    }
105 
}
106
107 
impl Job {
108 
    /// `Hash(J)` of spec §6.2: the job with its sandbox, so a change to
109 
    /// either is a different job.
110 
    pub fn hash(&self, sandbox: &Sandbox) -> Hash {
111 
        object_hash("job", &encode(&Value::Array(vec![job_value(self), sandbox_value(sandbox)])))
112 
    }
113 
}
114
115 
/// BLAKE3 tree hash of the files a scope selects (spec §6.2): sorted
116 
/// `(path, content hash)` pairs. An empty scope selects every file.
117 
pub fn scope_tree_hash<'a>(scope: &[String], files: impl IntoIterator<Item = (&'a str, Hash)>) -> Hash {
118 
    let set = {
119 
        let mut b = globset::GlobSetBuilder::new();
120 
        for g in scope {
121 
            if let Ok(g) = globset::Glob::new(g) {
122 
                b.add(g);
123 
            }
124 
        }
125 
        b.build().unwrap_or_else(|_| globset::GlobSet::empty())
126 
    };
127 
    let mut picked: Vec<(&str, Hash)> = files.into_iter().filter(|(p, _)| scope.is_empty() || set.is_match(p)).collect();
128 
    picked.sort();
129 
    let body = encode(&Value::Array(picked.iter().map(|(p, h)| Value::Array(vec![text(p), Value::Bytes(h.to_vec())])).collect()));
130 
    object_hash("scope", &body)
131 
}