Release assets link to the receipt that built them 10708ab8f54d

    /// The OxygenFlow run and job whose artifact has this content, if any.

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub built_by: Option<AssetBuild>,

}

/// Where a release asset was built (hub spec §9): a job's artifact with the

/// same BLAKE3, and that job's signed receipt when one was kept.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct AssetBuild {

    pub run: i64,

    pub job: String,

    pub artifact: String,

    pub run_url: String,

    /// The receipt attestation, hex; `None` when the receipt was not signed.

    pub receipt: Option<String>,

    pub receipt_url: Option<String>,

    pub signer: Option<String>,

/// Where an artifact with given content came from: the run and job that

/// built it, and the job's signed receipt when one was kept.

#[derive(Clone, Debug, FromRow)]

pub struct Provenance {

    pub run_number: i64,

    pub job: String,

    pub name: String,

    pub receipt_attest: String,

    pub receipt_signer: String,

}

/// The build of the bytes whose BLAKE3 is `content` in repository

/// `repo_id`: a passed job, one with a kept signed receipt first, newest

/// run first.

pub async fn provenance(pool: &Pool, repo_id: i64, content: &str) -> sqlx::Result<Option<Provenance>> {

    sqlx::query_as(

        "SELECT r.number AS run_number, j.name AS job, a.name AS name, j.receipt_attest, j.receipt_signer \

         FROM flow_artifacts a JOIN flow_jobs j ON j.id = a.job_id JOIN flow_runs r ON r.id = j.run_id \

         WHERE r.repo_id = ? AND a.content = ? AND j.status = 'passed' \

         ORDER BY (j.receipt_attest != '') DESC, r.number DESC LIMIT 1",

    )

    .bind(repo_id)

    .bind(content)

    .fetch_optional(pool)

    .await

}

    /// Releases a writer may attach this run's artifacts to.

    releases: Vec<db::releases::Release>,

    };

    let releases = if viewer.account().is_some() && role >= Role::Write && logs.iter().any(|l| !l.artifacts.is_empty()) {

        db::releases::list(&app.db, row.id).await.unwrap_or_default()

    } else {

        vec![]

    Ok(Page(RunPage {

        shell,

        repo: RepoShell::new(&app, &row, "flow").with_role(role),

        run,

        graph,

        logs,

        duration,

        can_rerun,

        queue,

        releases,

    }))

}

#[derive(Deserialize)]

pub struct AttachForm {

    _csrf: String,

    release: i64,

}

/// `POST /{owner}/{name}/flow/{id}/artifacts/{job}/{artifact}/attach`: add

/// an artifact to a release as an asset, named after its path; the release

/// page then shows the run and receipt that built it.

pub async fn attach(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name, id, job, artifact)): Path<(String, String, i64, String, String)>,

    Form(f): Form<AttachForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/flow/{id}"), &viewer);

    require(&viewer, &shell)?;

    csrf(&viewer, &f._csrf, &shell)?;

    let (repo, row, _) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Write).await?;

    let run = fdb::run(&app.db, row.id, id)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?

        .ok_or_else(|| Error::not_found(shell.clone()))?;

    let jobs = fdb::jobs(&app.db, run.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let Some(j) = jobs.iter().find(|j| j.name == job) else { return Err(Error::not_found(shell)) };

    let arts = fdb::artifacts(&app.db, j.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let Some(a) = arts.into_iter().find(|a| a.name == artifact) else { return Err(Error::not_found(shell)) };

    let releases = db::releases::list(&app.db, row.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let Some(rel) = releases.into_iter().find(|r| r.id == f.release) else { return Err(Error::not_found(shell)) };

    let Some(blob) = oxy_core::hash::ObjectRef::from_hex(&a.blob) else { return Err(Error::not_found(shell)) };

    let bytes = app.repos.read(&repo, move |r, _| Ok(r.read_blob(&blob)?)).await.map_err(|e| Error::from_repo(shell.clone(), e))?;

    let file = a.path.rsplit('/').next().unwrap_or(&a.name).to_string();

    super::releases::store_asset(&app, rel.id, &file, "application/octet-stream", &bytes)

        .await

        .map_err(|m| Error::bad(shell.clone(), m))?;

    Ok(Redirect::to(&format!("/{owner}/{name}/releases/tag/{}", rel.tag)).into_response())

        .route("/{owner}/{name}/flow/{id}/artifacts/{job}/{artifact}/attach", post(flow::attach))

    /// Where each asset was built, by asset id (hub spec §9).

    pub built: HashMap<i64, db::flow::Provenance>,

}

impl ReleaseView {

    pub fn built_by(&self, asset: &i64) -> Option<&db::flow::Provenance> {

        self.built.get(asset)

    }

        let mut built = HashMap::new();

        for a in &assets {

            if let Some(p) = db::flow::provenance(&app.db, row.id, &a.hash).await? {

                built.insert(a.id, p);

            }

        }

        out.push(ReleaseView { latest: Some(r.id) == latest, r, notes_html, assets, heads, signer, built });

                built_by: v.built_by(&a.id).map(|p| {

                    let signed = !p.receipt_attest.is_empty();

                    hub_api::AssetBuild {

                        run: p.run_number,

                        job: p.job.clone(),

                        artifact: p.name.clone(),

                        run_url: format!("{base}/flow/{}", p.run_number),

                        receipt: signed.then(|| p.receipt_attest.clone()),

                        receipt_url: signed.then(|| format!("{base}/receipts/{}", p.receipt_attest)),

                        signer: signed.then(|| p.receipt_signer.clone()),

                    }

                }),

    config.registration.mode = "open".into();

    // A writer attaches the artifact to a release from the run page; the

    // release then names the run and job that built it, as does the API.

    let form = |f: String| {

        Request::post("/register").header(header::CONTENT_TYPE, "application/x-www-form-urlencoded").body(Body::from(f)).unwrap()

    };

    let res = oxygenhub::router(h.app.clone())

        .oneshot(form("username=andy&email=a%40example.com&password=correct-horse-battery".into()))

        .await

        .unwrap();

    let cookie = res.headers().get(header::SET_COOKIE).unwrap().to_str().unwrap().split(';').next().unwrap().to_string();

    let with_cookie = |method: &str, path: &str, body: Option<String>| {

        let mut req = Request::builder().method(method).uri(path).header(header::COOKIE, cookie.clone());

        if body.is_some() {

            req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");

        }

        req.body(body.map(Body::from).unwrap_or_else(Body::empty)).unwrap()

    };

    let row = db::repos::get(&h.app.db, "andy", "demo").await.unwrap().unwrap();

    db::releases::create(&h.app.db, row.id, "v1", "One", "", false, None).await.unwrap();

    let res = oxygenhub::router(h.app.clone()).oneshot(with_cookie("GET", &format!("/andy/demo/flow/{}", run.number), None)).await.unwrap();

    let page = String::from_utf8_lossy(&res.into_body().collect().await.unwrap().to_bytes()).into_owned();

    let attach = format!("/andy/demo/flow/{}/artifacts/build/tool/attach", run.number);

    assert!(page.contains(&attach), "a writer is offered the release");

    let i = page.find("name=\"_csrf\" value=\"").unwrap() + "name=\"_csrf\" value=\"".len();

    let csrf = page[i..].split('"').next().unwrap().to_string();

    let release_id = db::releases::list(&h.app.db, row.id).await.unwrap()[0].id;

    let res = oxygenhub::router(h.app.clone())

        .oneshot(with_cookie("POST", &attach, Some(format!("_csrf={csrf}&release={release_id}"))))

        .await

        .unwrap();

    assert_eq!(res.status(), StatusCode::SEE_OTHER);

    let (_, page) = call(&h.app, "GET", "/andy/demo/releases/tag/v1", None, None).await;

    assert!(

        page.contains(">tool</a>") && page.contains(&format!("built by <a href=\"/andy/demo/flow/{0}\">run #{0}</a> build", run.number)),

        "{page}"

    );

    let (_, api) = call(&h.app, "GET", "/api/v1/repos/andy/demo/releases", None, None).await;

    let api: serde_json::Value = serde_json::from_str(&api).unwrap();

    let asset = &api[0]["assets"][0];

    assert_eq!(

        (asset["name"].as_str(), asset["built_by"]["run"].as_i64(), asset["built_by"]["job"].as_str()),

        (Some("tool"), Some(run.number), Some("build"))

    );

    assert!(asset["built_by"]["receipt"].is_null(), "that receipt was not signed");

**Built by.** A release asset links to the build that produced it: the passed OxygenFlow job of this repository with an artifact of the same BLAKE3 (hub spec §13.2). A job with a kept signed receipt comes first, then the newest run. The release page shows the run, the job and the signed receipt with its signer, and the API gives the same as `built_by` on each asset. On a run page, a writer can attach an artifact to a release; it becomes an asset named after the artifact's path, so the link follows by content. A file uploaded by hand links the same way when its bytes match.

  <summary><span class="flow-glyph st-{{ l.j.status }}" data-glyph>{{ crate::web::flow::glyph(l.j.status) }}</span> <strong>{{ l.j.name }}</strong> <span class="small mute" data-meta>{{ l.j.status }}{% if let Some(c) = l.j.exit_code %} · exit {{ c }}{% endif %} · {{ l.duration }}{% if !l.j.runner.is_empty() %} · on {{ l.j.runner }}{% endif %}</span>{% if !l.j.receipt_attest.is_empty() %} <span class="small mute">· <a href="{{ repo.url }}/receipts/{{ l.j.receipt_attest }}" title="Receipt {{ l.j.receipt_hash }}, kept in the repository; check it with oxy receipt verify">signed receipt</a> by {{ l.j.receipt_signer }}</span>{% else if !l.j.receipt_note.is_empty() %} <span class="small warn" title="{{ l.j.receipt_note }}">· receipt not kept: {{ l.j.receipt_note }}</span>{% else if !l.j.receipt_hash.is_empty() %} <span class="small mute">· unsigned receipt <code title="{{ l.j.receipt_hash }}">{{ l.j.receipt_hash|short }}</code></span>{% endif %}{% if !l.artifacts.is_empty() %} <span class="small mute">· {{ l.artifacts.len()|plural("artifact", "artifacts") }}</span>{% endif %}</summary>

  {% if !l.artifacts.is_empty() %}<ul class="flow-artifacts small">{% for a in l.artifacts %}<li><a href="{{ repo.url }}/flow/{{ run.number }}/artifacts/{{ l.j.name }}/{{ a.name }}">{{ a.name }}</a> <span class="mute">{{ a.path }} · {{ a.size|bytes }} · blob <code title="{{ a.blob }}">{{ a.blob|short }}</code></span>{% if !releases.is_empty() %} <form class="tiny inline" method="post" action="{{ repo.url }}/flow/{{ run.number }}/artifacts/{{ l.j.name }}/{{ a.name }}/attach"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><select name="release" aria-label="Release to attach {{ a.name }} to">{% for r in releases %}<option value="{{ r.id }}">{{ r.tag }}</option>{% endfor %}</select> <button>Attach to release</button></form>{% endif %}</li>{% endfor %}</ul>{% endif %}

    {% for a in v.assets %}<li><a href="{{ repo.url }}/asset/{{ a.id }}/{{ a.name }}">{{ a.name }}</a> <span class="small mute">{{ a.size|bytes }} · blake3 <code title="{{ a.hash }}">{{ a.hash|short }}</code> · {{ a.downloads }} downloads</span>{% if let Some(p) = v.built_by(a.id) %} <span class="small" data-built>· built by <a href="{{ repo.url }}/flow/{{ p.run_number }}">run #{{ p.run_number }}</a> {{ p.job }}{% if p.receipt_attest.is_empty() %} <span class="mute">(unsigned receipt)</span>{% else %} · <a href="{{ repo.url }}/receipts/{{ p.receipt_attest }}" title="Check it with oxy receipt verify">signed receipt</a> by {{ p.receipt_signer }}{% endif %}</span>{% endif %}

ul.flow-artifacts { list-style: none; margin: 0; padding: 6px 12px; border-top: 1px solid var(--line); }

ul.flow-artifacts li { padding: 2px 0; overflow-wrap: anywhere; }

ul.flow-artifacts select { font-size: 11px; }