Documentation
¶
Overview ¶
Package resolve turns a Source declaration into concrete, pinned, content-addressable code (or an integrity anchor for sources that cannot be hashed locally). A Router dispatches by source kind to per-kind resolvers: local, inline, npm, git, and url.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CertFetcher ¶
CertFetcher returns the SPKI pin (base64 SHA-256 of the leaf certificate's SubjectPublicKeyInfo) for the host of a URL.
type Container ¶
Container resolves container-image MCP sources. The image reference is the integrity anchor (ideally pinned to an @sha256: digest); a cosign signature, when present and verifiable, satisfies the top provenance rung. Like git, the tree is not hashed locally — the pinned ref makes drift detectable.
func NewContainer ¶
NewContainer builds a Container resolver.
type Git ¶
Git resolves git sources by pinning the requested ref to a concrete commit SHA — the SHA is the integrity anchor. Content hashing of cloned trees is a follow-up; the SHA alone makes drift detectable.
type Inline ¶
type Inline struct{}
Inline content-addresses literal text (hooks, rules, context). By convention the literal content is carried in Source.Ref.
type Local ¶
type Local struct{}
Local resolves a filesystem path to an absolute, hashable location.
type NPM ¶
NPM resolves npm/npx sources: it pins the exact version and npm integrity, and fetches the package code into a temp directory for hashing/analysis.
type Registry ¶ added in v0.4.1
type Registry struct {
Client *http.Client
Fetcher CertFetcher
}
Registry resolves a remote catalog entry (an app store listing).
Unlike npm or git, there is nothing to download: the listing points at a hosted application whose code the registry never exposes. The integrity anchor is therefore twofold — the canonical digest of the published manifest, and the TLS SPKI pin of the distribution host. Together they detect a silent manifest edit or a swapped backing deployment, which is the most that can be established without the bytes.
Schema coverage: this resolver reads the AgentOS `agentos.app.v1` record shape — a manifest object carrying entrypoint, permissions, requiredSecrets, commands and distribution.webUrl. It is named for the generic SourceRegistry kind because the *anchoring strategy* generalizes, but the field mapping does not. A record it cannot read is rejected outright rather than partially parsed: guessing would emit an anchor that pins nothing and findings drawn from fields that were never present. Supporting a second registry means adding a mapper here, not relying on the current one to cope.
func NewRegistry ¶ added in v0.4.1
func NewRegistry() Registry
NewRegistry builds a Registry resolver with the real TLS fetcher.
type Router ¶
type Router struct {
// contains filtered or unexported fields
}
Router dispatches resolution by Source.Kind.
type TLSCertFetcher ¶
type TLSCertFetcher struct {
// InsecureSkipVerify disables chain verification (used only in tests against
// httptest servers). Production leaves this false.
InsecureSkipVerify bool
}
TLSCertFetcher dials the host over TLS and pins the leaf certificate's SPKI.
type URL ¶
type URL struct {
Fetcher CertFetcher
}
URL resolves remote (SSE/HTTP) MCP sources. Remote code cannot be hashed, so the integrity anchor is the TLS certificate's SPKI pin; any change is drift.
func NewURL ¶
func NewURL(f CertFetcher) URL
NewURL builds a URL resolver with the real TLS fetcher.
Source Files