cic-module-oracle-cloud/project.yaml at main · CentralInfraCore/cic-module-oracle-cloud · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
---
metadata:
  name: cic-module-oracle-cloud
  description: CIC provisioner module for Oracle Cloud Infrastructure (OCI) — a WASM guest driving the OCI REST API through the relay's http/vault host functions
  version: 0.1.0
  license: CC-BY-NC-SA-4.0
  main_branch: main
  owner: Gabor Zoltan Sinko
  tags:
    - wasm
    - isdk
    - provisioner
    - oracle-cloud
  validatedBy:
    name: TBD
    version: TBD
    checksum: TBD
  # createdBy/issuer_certificate/cicSign/cicSignedCA/checksum/sign below are
  # template placeholders. A real release replaces them with the author's
  # Vault-issued certificate, the CIC Root CA issuer certificate, and the
  # corresponding signatures — produced by `make release` / tools/infra.py
  # (ReleaseManager._resign_with_build_hash and the Vault signing chain).
  # The placeholders keep project.yaml schema-valid (project.schema.yaml
  # treats these as opaque strings) without embedding any real credential.
  createdBy:
    name: TBD
    email: TBD
    certificate: "TBD — filled by the release process with the author's PEM certificate"
    issuer_certificate: "TBD — filled by the release process with the CIC Root CA issuer certificate"
  build_timestamp: 'TBD'
  validity:
    from: 'TBD'
    until: 'TBD'
  checksum: 'TBD'
  sign: 'TBD'
  # buildHash is intentionally empty in the template — `make wasm.build` /
  # wasm.buildhash (mk/wasm.mk) fills it from sha256(module/module.wasm) in
  # the build-gap between the prepare and finalize release phases. The
  # finalization phase (tools/infra.py: _resign_with_build_hash) requires
  # this to be non-empty and re-signs metadata.sign to cover it.
  buildHash: 7080b3423beded8b64891afdcf2e6f6d8bec6ebeaa88aecbb1b06e149b54ef86
  cicSign: 'TBD'
  cicSignedCA:
    certificate: "TBD — filled by the release process with the CIC Root CA certificate"
compiler_settings:
  repo_type: module
  component_name: cic-module-oracle-cloud
  meta_schemas_dir: ./
  meta_schema_file: md.meta.schema.yaml
  canonical_source_file: schemas/index.yaml
  vault_key_name: cic-my-sign-key
  cic_root_ca_key_name: cic-root-ca-key
  source_dir: ./
  vault_cert_mount: cic-my-sign-key
  vault_cert_secret_name: crt
  vault_cert_secret_key: bar
# abi describes the WASM guest <-> relay host contract (KB c689). It is
# checked against the compiled module/module.wasm exports by
# module/abi_manifest_test.go — a mismatch fails `make wasm.test`.
# See docs/contracts/en/wasm-abi.md for the full contract.
abi:
  name: cic-module-oracle-cloud
  version: "1.0.0"
  envelopeVersion: 1
  # Functions module/module.wasm must export (cicwasm.go:243-247).
  exports:
    - allocate
    - deallocate
    - Call
  # cic:provider ABI op-strings dispatched by module/abi.go's Call
  # (docs/design/specs/provider-abi.md). describe/validate/plan are host-boundary
  # "none"; observe/execute/poll/invoke/destroy are "sign+send".
  operations:
    - describe
    - validate
    - observe
    - plan
    - execute
    - poll
    - invoke
    - destroy
  # Host functions this module REQUIRES for the sign+send ops (observe/execute/
  # poll/invoke/destroy). Declaration only — the module does not define the host
  # side. Names are provisional until settled with the relay (relay-requirements.md
  # R1/R2); today the trust-flow is native-FFI, not a wasm import, so nothing is
  # imported at the wasm level yet. describe() reports this surface.
  imports:
    - module: cic-flow
      functions:
        - sign
        - actuate
# capability_manifest declares what this module needs from the host; the host
# enforces exactly this (relay-requirements.md R3). This is the OCI provisioner's
# target reach — egress to OCI's REST endpoints and a sign-only OCI key handle.
# The module is a scaffold and does not actuate yet; the declaration is the
# contract a reviewer approves. host_functions/limits finalize with the relay
# host surface (R1/R2). See docs/design/specs/capability-manifest.md.
capability_manifest:
  version: v0.1.0
  egress:
    - host: "*.oraclecloud.com"
      methods: [GET, POST, PUT, DELETE, PATCH]
  secrets:
    - handle: "oci/*"
      ops: [sign]