feat: add store api and bld bin package inspectors
Metadata
Current evaluation
Merged after two approvals and passing CI. Introduces store API and bld bin package inspectors to verify SHA3-384 digests and extract metadata from xz tarballs. Changes span 16 files with over 1100 lines added.
Suggested action: —
No scores available.
Issue body
The bld bin package is a xz'ed tarball created by the bld tool, and
it contains a top-level metadata.yaml file. Craft applications can
donwload bld bin packages in parts by querying a store info API.
Approval of bld bin artifacts rely on state kept by the store API
inspector. When a bin package is downloaded, the store API inspector
checks its sha3-384 digest to determine if it is listed by the store
as a bin package. Actual package metadata is verified and extracted
by the bld bin inspector.
Signed-off-by: Claudio Matsuoka <claudio.matsuoka@canonical.com>
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged after two approvals and passing CI. Introduces store API and bld bin package inspectors to verify SHA3-384 digests and extract metadata from xz tarballs. Changes span 16 files with over 1100 lines added. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #477 fix: false positive in store info inspection | fetch-service | merged | Merged fix for false positives in store info inspection. Adjusts bld bin validation to accept non-tarball xz archives and relaxes artifact detection heuristics for JSON responses. Approved by three reviewers and passed all CI checks. | |
| #470 feat: add inspector for the store transforms api | fetch-service | merged | Merged a feature adding an inspector for the store transforms API endpoint. The implementation is intentionally simple due to anticipated format changes. Approved by two reviewers, passed all CI checks, and merged 334 days ago. | |
| #450 feat: add inspector for the store resolve API | fetch-service | merged | Merged feature adding a stateless inspector for the store resolve revisions API. Renamed the existing info API to prevent ambiguity. Approved by two reviewers and passed all CI checks. | |
| #439 fix(i/store): inspect bld bin requests in store inspector | fetch-service | merged | Merged a fix enabling the store inspector to validate and set build bin requests to pending for strict sessions. Approved by two reviewers, passed CI, and integrated. | |
| #60 feat: add checksum file to control tarball | debcraft | merged | Merged to add a checksum file to the control tarball. Approved by two reviewers with all CI checks passing. Changes modified three files, adding 80 lines and removing 8. |