Repository navigation
Conversation
A build publishes its own signed targets_<arch>.json next to its files, but a client could only consume full TUF repositories with snapshot and timestamp metadata. Reading one build's artifacts, as the CVE scanner does, therefore required a whole repository per build. A repository can now be configured with targets_url pointing at such a signed targets file, which is verified against the targets keys of the trusted root. It has no freshness guarantees, which is acceptable for a build's own listing. A Repo type covers both kinds, and quarry-client uses it for refreshing, expiry and target lookups.
pothos
force-pushed
the
barerepo-hardhat-helpers-sysupdate-rework
branch
from
October 12, 2026 11:40
f9b92d4 to
e929f89
Compare
quarry-sysupdate takes the sysupdate definitions of a component from special targets under .quarry/sysupdate[.<component>].d/, but every producer had to lay out these paths and inline the files itself. That duplicates the layout detail and can drift from what the client expects. hardhat targets gains --quarry-transfer-dir <component dir>=<source>, which publishes the files of a definitions directory as inline targets in that layout. A source may also be confext:<name>, for which hardhat generates the transfer installing the confext DDI, and several sources merge into one directory. A named component without its own component file gets a generated one, which is enabled like sysupdate's default. The layout rules live in internal/transferlayout so that quarry-sysupdate can share them.
A build has to mark its targets for consumers, for example which version they belong to. hardhat could hash the files but offered no way to attach such metadata, so a producer would have to post-process the signed targets file and resign. Add hardhat targets --custom-from <file>, which merges per-target "custom" objects from a JSON file and fails on a path that is not a target, so that a typo cannot drop metadata silently. --custom-version sets custom.quarry.version on every file target.
pothos
force-pushed
the
barerepo-hardhat-helpers-sysupdate-rework
branch
from
October 13, 2026 04:12
e929f89 to
54f64bb
Compare
pothos
marked this pull request as ready for review
October 13, 2026 04:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This introduces support for bare repos as build system outputs that are then imported into proper repositories and function as build system contract binding all files together. They can also be used directly for development purposes. A few helper options are added to hardhat to embed the transfer files (with a shorthand for confexts) and custom metadata such as the versions.