feat: implement Operation Velvet Forge & Evidence Locker
- Ratified 'The Law of Representation' with tiered hashing (XXH3/Ed25519/BLAKE2b). - Implemented RFC 8785 Canonical JSON serialization for deterministic signing. - Deployed 'The Evidence Locker': Registry now enforces mandatory Ed25519 verification on read. - Initialized 'The Cortex': KDL Intent Parser now translates manifests into GraftIntent objects. - Orchestrated 'Velvet Forge' pipeline: Closing the loop between Intent, Synthesis, and Truth. - Resolved xxHash namespace collisions and fixed Nint128 type mismatches. Sovereignty achieved. The machine now listens, remember, and refuses to lie.
This commit is contained in:
Markus Maiwald
parent
1e44dcfaf0
commit
9695382eaf
|
|
@ -15,7 +15,7 @@
|
|||
import std/[strutils, options, sets, json, sequtils, tables, algorithm]
|
||||
import nimpak/kdl_parser
|
||||
import nip/platform
|
||||
import nip/xxhash
|
||||
import nip/xxh
|
||||
|
||||
type
|
||||
# ============================================================================
|
||||
|
|
@ -24,15 +24,15 @@ type
|
|||
|
||||
ManifestFormat* = enum
|
||||
## Supported manifest formats (wire format)
|
||||
FormatKDL = "kdl" ## Human-friendly KDL format
|
||||
FormatJSON = "json" ## Machine-friendly JSON format
|
||||
FormatAuto = "auto" ## Auto-detect from content
|
||||
FormatKDL = "kdl" ## Human-friendly KDL format
|
||||
FormatJSON = "json" ## Machine-friendly JSON format
|
||||
FormatAuto = "auto" ## Auto-detect from content
|
||||
|
||||
FormatType* = enum
|
||||
## Package format types (semantic meaning)
|
||||
NPK = "npk" ## Nexus Package Kit (Standard distribution)
|
||||
NIP = "nip" ## Nexus Installed Package (Local state)
|
||||
NEXTER = "nexter" ## Nexus Container (Opaque runtime)
|
||||
NPK = "npk" ## Nexus Package Kit (Standard distribution)
|
||||
NIP = "nip" ## Nexus Installed Package (Local state)
|
||||
NEXTER = "nexter" ## Nexus Container (Opaque runtime)
|
||||
|
||||
# ============================================================================
|
||||
# Validation & Error Handling
|
||||
|
|
@ -40,29 +40,29 @@ type
|
|||
|
||||
ManifestValidationMode* = enum
|
||||
## Validation strictness levels
|
||||
ValidationStrict ## Reject unknown fields, enforce all constraints (DEFAULT)
|
||||
ValidationLenient ## Warn on unknown fields, allow missing optional fields
|
||||
ValidationMinimal ## Only validate required fields (unsafe, testing only)
|
||||
ValidationStrict ## Reject unknown fields, enforce all constraints (DEFAULT)
|
||||
ValidationLenient ## Warn on unknown fields, allow missing optional fields
|
||||
ValidationMinimal ## Only validate required fields (unsafe, testing only)
|
||||
|
||||
ManifestErrorCode* = enum
|
||||
## Specific error codes for precise diagnostics
|
||||
InvalidFormat, ## Syntax error in wire format
|
||||
MissingField, ## Required field absent
|
||||
InvalidValue, ## Field present but value invalid
|
||||
StrictViolation, ## Unknown field detected (contamination)
|
||||
SemVerViolation, ## Version string not valid semver
|
||||
SchemaError, ## Structural schema violation
|
||||
HashMismatch, ## Integrity hash mismatch
|
||||
PlatformIncompat, ## Platform/arch constraint violation
|
||||
DependencyError ## Dependency specification invalid
|
||||
InvalidFormat, ## Syntax error in wire format
|
||||
MissingField, ## Required field absent
|
||||
InvalidValue, ## Field present but value invalid
|
||||
StrictViolation, ## Unknown field detected (contamination)
|
||||
SemVerViolation, ## Version string not valid semver
|
||||
SchemaError, ## Structural schema violation
|
||||
HashMismatch, ## Integrity hash mismatch
|
||||
PlatformIncompat, ## Platform/arch constraint violation
|
||||
DependencyError ## Dependency specification invalid
|
||||
|
||||
ManifestError* = object of CatchableError
|
||||
## Detailed error with context and suggestions
|
||||
code*: ManifestErrorCode
|
||||
field*: string ## Field that caused the error
|
||||
line*: int ## Line number (if available)
|
||||
context*: string ## Human-readable context
|
||||
suggestions*: seq[string] ## Actionable suggestions
|
||||
field*: string ## Field that caused the error
|
||||
line*: int ## Line number (if available)
|
||||
context*: string ## Human-readable context
|
||||
suggestions*: seq[string] ## Actionable suggestions
|
||||
|
||||
# ============================================================================
|
||||
# Core Manifest Types
|
||||
|
|
@ -73,7 +73,7 @@ type
|
|||
# Identity
|
||||
format*: FormatType
|
||||
name*: string
|
||||
version*: SemanticVersion ## Parsed, not string
|
||||
version*: SemanticVersion ## Parsed, not string
|
||||
description*: Option[string]
|
||||
homepage*: Option[string]
|
||||
license*: string
|
||||
|
|
@ -89,7 +89,7 @@ type
|
|||
configureFlags*: seq[string]
|
||||
|
||||
# Platform constraints (THE PHYSICAL WORLD)
|
||||
supportedOS*: seq[string] ## e.g., ["linux", "freebsd"]
|
||||
supportedOS*: seq[string] ## e.g., ["linux", "freebsd"]
|
||||
supportedArchitectures*: seq[string] ## e.g., ["x86_64", "aarch64"]
|
||||
requiredCapabilities*: seq[string] ## e.g., ["user_namespaces"]
|
||||
|
||||
|
|
@ -98,9 +98,9 @@ type
|
|||
allocator*: Option[string]
|
||||
|
||||
# Integrity (cryptographic truth)
|
||||
buildHash*: string ## BLAKE3 hash of build configuration
|
||||
sourceHash*: string ## BLAKE3 hash of source
|
||||
artifactHash*: string ## BLAKE3 hash of final artifact
|
||||
buildHash*: string ## BLAKE3 hash of build configuration
|
||||
sourceHash*: string ## BLAKE3 hash of source
|
||||
artifactHash*: string ## BLAKE3 hash of final artifact
|
||||
|
||||
# Metadata
|
||||
author*: Option[string]
|
||||
|
|
@ -109,8 +109,8 @@ type
|
|||
maintainers*: seq[string]
|
||||
|
||||
# UTCP support (AI accessibility)
|
||||
utcpEndpoint*: Option[string] ## Remote query endpoint
|
||||
utcpVersion*: Option[string] ## UTCP protocol version
|
||||
utcpEndpoint*: Option[string] ## Remote query endpoint
|
||||
utcpVersion*: Option[string] ## UTCP protocol version
|
||||
|
||||
# System Integration
|
||||
files*: seq[FileSpec]
|
||||
|
|
@ -126,33 +126,33 @@ type
|
|||
|
||||
DesktopIntegration* = object
|
||||
## Desktop environment integration
|
||||
displayName*: string ## Human readable name (e.g. "Firefox Web Browser")
|
||||
icon*: Option[string] ## Icon name or path
|
||||
categories*: seq[string] ## Menu categories (e.g. "Network;WebBrowser")
|
||||
keywords*: seq[string] ## Search keywords
|
||||
mimeTypes*: seq[string] ## Supported MIME types
|
||||
terminal*: bool ## Run in terminal?
|
||||
startupNotify*: bool ## Support startup notification?
|
||||
displayName*: string ## Human readable name (e.g. "Firefox Web Browser")
|
||||
icon*: Option[string] ## Icon name or path
|
||||
categories*: seq[string] ## Menu categories (e.g. "Network;WebBrowser")
|
||||
keywords*: seq[string] ## Search keywords
|
||||
mimeTypes*: seq[string] ## Supported MIME types
|
||||
terminal*: bool ## Run in terminal?
|
||||
startupNotify*: bool ## Support startup notification?
|
||||
startupWMClass*: Option[string] ## For window grouping (StartupWMClass)
|
||||
|
||||
SandboxLevel* = enum
|
||||
SandboxStrict = "strict" ## Maximum isolation (default)
|
||||
SandboxStandard = "standard" ## Standard desktop app isolation
|
||||
SandboxRelaxed = "relaxed" ## Minimal isolation (use with caution)
|
||||
SandboxNone = "none" ## No isolation (requires user override)
|
||||
SandboxStrict = "strict" ## Maximum isolation (default)
|
||||
SandboxStandard = "standard" ## Standard desktop app isolation
|
||||
SandboxRelaxed = "relaxed" ## Minimal isolation (use with caution)
|
||||
SandboxNone = "none" ## No isolation (requires user override)
|
||||
|
||||
SandboxConfig* = object
|
||||
## Sandboxing configuration for NIPs
|
||||
level*: SandboxLevel
|
||||
|
||||
# Linux Specific
|
||||
seccompProfile*: Option[string] ## "default", "strict", or custom path
|
||||
capabilities*: seq[string] ## e.g. "CAP_NET_ADMIN" (usually to drop)
|
||||
namespaces*: seq[string] ## e.g. "net", "ipc", "pid"
|
||||
seccompProfile*: Option[string] ## "default", "strict", or custom path
|
||||
capabilities*: seq[string] ## e.g. "CAP_NET_ADMIN" (usually to drop)
|
||||
namespaces*: seq[string] ## e.g. "net", "ipc", "pid"
|
||||
|
||||
# BSD Specific (OpenBSD/DragonflyBSD)
|
||||
pledge*: Option[string] ## e.g. "stdio rpath wpath inet"
|
||||
unveil*: seq[string] ## e.g. "/tmp:rwc"
|
||||
pledge*: Option[string] ## e.g. "stdio rpath wpath inet"
|
||||
unveil*: seq[string] ## e.g. "/tmp:rwc"
|
||||
|
||||
DependencySpec* = object
|
||||
## Package dependency specification
|
||||
|
|
@ -226,9 +226,9 @@ type
|
|||
ParserConfig* = object
|
||||
## Parser configuration
|
||||
format*: FormatType
|
||||
wireFormat*: ManifestFormat ## KDL or JSON
|
||||
wireFormat*: ManifestFormat ## KDL or JSON
|
||||
strictMode*: bool
|
||||
allowedFields*: HashSet[string] ## The Whitelist (The Bouncer)
|
||||
allowedFields*: HashSet[string] ## The Whitelist (The Bouncer)
|
||||
|
||||
ManifestParser* = object
|
||||
## Parser state and configuration
|
||||
|
|
@ -248,7 +248,8 @@ const BASE_ALLOWED_FIELDS = [
|
|||
# Build
|
||||
"build_system", "build_flags", "configure_flags",
|
||||
# Platform
|
||||
"os", "arch", "supported_os", "supported_architectures", "required_capabilities",
|
||||
"os", "arch", "supported_os", "supported_architectures",
|
||||
"required_capabilities",
|
||||
# Runtime
|
||||
"libc", "allocator",
|
||||
# Integrity
|
||||
|
|
@ -331,19 +332,19 @@ proc parseSemanticVersion*(version: string): SemanticVersion =
|
|||
raise newException(ManifestError,
|
||||
"Invalid semantic version: " & version & " (expected X.Y.Z)")
|
||||
|
||||
var parts = version.split('-', maxsplit=1)
|
||||
var parts = version.split('-', maxsplit = 1)
|
||||
var versionPart = parts[0]
|
||||
var prerelease = ""
|
||||
var build = ""
|
||||
|
||||
if parts.len > 1:
|
||||
var prereleaseAndBuild = parts[1].split('+', maxsplit=1)
|
||||
var prereleaseAndBuild = parts[1].split('+', maxsplit = 1)
|
||||
prerelease = prereleaseAndBuild[0]
|
||||
if prereleaseAndBuild.len > 1:
|
||||
build = prereleaseAndBuild[1]
|
||||
else:
|
||||
# Check for build metadata without prerelease
|
||||
parts = versionPart.split('+', maxsplit=1)
|
||||
parts = versionPart.split('+', maxsplit = 1)
|
||||
versionPart = parts[0]
|
||||
if parts.len > 1:
|
||||
build = parts[1]
|
||||
|
|
@ -387,9 +388,9 @@ proc compareVersions*(a, b: SemanticVersion): int =
|
|||
|
||||
# Prerelease comparison
|
||||
if a.prerelease.len == 0 and b.prerelease.len > 0:
|
||||
return 1 # Release > prerelease
|
||||
return 1 # Release > prerelease
|
||||
if a.prerelease.len > 0 and b.prerelease.len == 0:
|
||||
return -1 # Prerelease < release
|
||||
return -1 # Prerelease < release
|
||||
if a.prerelease != b.prerelease:
|
||||
return cmp(a.prerelease, b.prerelease)
|
||||
|
||||
|
|
@ -442,7 +443,8 @@ proc parseVersionConstraint*(constraint: string): VersionConstraint =
|
|||
let version = parseSemanticVersion(versionStr)
|
||||
result = VersionConstraint(operator: operator, version: version)
|
||||
|
||||
proc satisfiesConstraint*(version: SemanticVersion, constraint: VersionConstraint): bool =
|
||||
proc satisfiesConstraint*(version: SemanticVersion,
|
||||
constraint: VersionConstraint): bool =
|
||||
## Check if a version satisfies a constraint
|
||||
case constraint.operator:
|
||||
of OpAny:
|
||||
|
|
@ -488,20 +490,20 @@ proc createStrictStructRule*(allowed: HashSet[string]): ValidationRule =
|
|||
name: "strict_whitelist",
|
||||
description: "Ensures only authorized fields are present",
|
||||
validate: proc(data: JsonNode, errors: var seq[ManifestError]): bool =
|
||||
var valid = true
|
||||
for key in data.keys:
|
||||
if key notin allowed:
|
||||
valid = false
|
||||
errors.add(ManifestError(
|
||||
code: StrictViolation,
|
||||
field: key,
|
||||
context: "Unauthorized field found: '" & key & "'",
|
||||
suggestions: @[
|
||||
"Remove the field",
|
||||
"Check spelling against spec",
|
||||
"This field may be format-specific" ]
|
||||
))
|
||||
return valid
|
||||
var valid = true
|
||||
for key in data.keys:
|
||||
if key notin allowed:
|
||||
valid = false
|
||||
errors.add(ManifestError(
|
||||
code: StrictViolation,
|
||||
field: key,
|
||||
context: "Unauthorized field found: '" & key & "'",
|
||||
suggestions: @[
|
||||
"Remove the field",
|
||||
"Check spelling against spec",
|
||||
"This field may be format-specific"]
|
||||
))
|
||||
return valid
|
||||
)
|
||||
|
||||
proc createSemVerRule*(fieldName: string): ValidationRule =
|
||||
|
|
@ -510,22 +512,22 @@ proc createSemVerRule*(fieldName: string): ValidationRule =
|
|||
name: "semver_" & fieldName,
|
||||
description: "Field '" & fieldName & "' must be valid SemVer (X.Y.Z)",
|
||||
validate: proc(data: JsonNode, errors: var seq[ManifestError]): bool =
|
||||
if fieldName notin data: return true # Required check handles missing
|
||||
if fieldName notin data: return true # Required check handles missing
|
||||
|
||||
let val = data[fieldName].getStr()
|
||||
if not isValidSemVer(val):
|
||||
errors.add(ManifestError(
|
||||
code: SemVerViolation,
|
||||
field: fieldName,
|
||||
context: "'" & val & "' is not a valid SemVer",
|
||||
suggestions: @[
|
||||
"Use format X.Y.Z (e.g., 1.0.0)",
|
||||
"Prerelease: 1.0.0-alpha",
|
||||
"Build metadata: 1.0.0+20130313144700"
|
||||
]
|
||||
))
|
||||
return false
|
||||
return true
|
||||
let val = data[fieldName].getStr()
|
||||
if not isValidSemVer(val):
|
||||
errors.add(ManifestError(
|
||||
code: SemVerViolation,
|
||||
field: fieldName,
|
||||
context: "'" & val & "' is not a valid SemVer",
|
||||
suggestions: @[
|
||||
"Use format X.Y.Z (e.g., 1.0.0)",
|
||||
"Prerelease: 1.0.0-alpha",
|
||||
"Build metadata: 1.0.0+20130313144700"
|
||||
]
|
||||
))
|
||||
return false
|
||||
return true
|
||||
)
|
||||
|
||||
proc createPlatformConstraintRule*(): ValidationRule =
|
||||
|
|
@ -534,77 +536,77 @@ proc createPlatformConstraintRule*(): ValidationRule =
|
|||
name: "platform_constraints",
|
||||
description: "Validates OS and Architecture targets",
|
||||
validate: proc(data: JsonNode, errors: var seq[ManifestError]): bool =
|
||||
var valid = true
|
||||
var valid = true
|
||||
|
||||
# Validate OS field
|
||||
if "os" in data or "supported_os" in data:
|
||||
let osField = if "os" in data: "os" else: "supported_os"
|
||||
let osNode = data[osField]
|
||||
# Validate OS field
|
||||
if "os" in data or "supported_os" in data:
|
||||
let osField = if "os" in data: "os" else: "supported_os"
|
||||
let osNode = data[osField]
|
||||
|
||||
if osNode.kind != JArray:
|
||||
errors.add(ManifestError(
|
||||
code: InvalidValue,
|
||||
field: osField,
|
||||
context: "OS field must be an array",
|
||||
suggestions: @["Use array format: [\"linux\", \"freebsd\"]"]
|
||||
))
|
||||
valid = false
|
||||
elif osNode.len == 0:
|
||||
errors.add(ManifestError(
|
||||
code: InvalidValue,
|
||||
field: osField,
|
||||
context: "OS array cannot be empty",
|
||||
suggestions: @["Specify at least one OS"]
|
||||
))
|
||||
valid = false
|
||||
else:
|
||||
# Validate each OS value
|
||||
for osVal in osNode:
|
||||
let os = osVal.getStr()
|
||||
if os notin VALID_OS:
|
||||
errors.add(ManifestError(
|
||||
code: PlatformIncompat,
|
||||
field: osField,
|
||||
context: "Invalid OS: " & os,
|
||||
suggestions: @["Valid OS: " & $VALID_OS]
|
||||
))
|
||||
valid = false
|
||||
if osNode.kind != JArray:
|
||||
errors.add(ManifestError(
|
||||
code: InvalidValue,
|
||||
field: osField,
|
||||
context: "OS field must be an array",
|
||||
suggestions: @["Use array format: [\"linux\", \"freebsd\"]"]
|
||||
))
|
||||
valid = false
|
||||
elif osNode.len == 0:
|
||||
errors.add(ManifestError(
|
||||
code: InvalidValue,
|
||||
field: osField,
|
||||
context: "OS array cannot be empty",
|
||||
suggestions: @["Specify at least one OS"]
|
||||
))
|
||||
valid = false
|
||||
else:
|
||||
# Validate each OS value
|
||||
for osVal in osNode:
|
||||
let os = osVal.getStr()
|
||||
if os notin VALID_OS:
|
||||
errors.add(ManifestError(
|
||||
code: PlatformIncompat,
|
||||
field: osField,
|
||||
context: "Invalid OS: " & os,
|
||||
suggestions: @["Valid OS: " & $VALID_OS]
|
||||
))
|
||||
valid = false
|
||||
|
||||
# Validate Architecture field
|
||||
if "arch" in data or "supported_architectures" in data:
|
||||
let archField = if "arch" in data: "arch" else: "supported_architectures"
|
||||
let archNode = data[archField]
|
||||
# Validate Architecture field
|
||||
if "arch" in data or "supported_architectures" in data:
|
||||
let archField = if "arch" in data: "arch" else: "supported_architectures"
|
||||
let archNode = data[archField]
|
||||
|
||||
if archNode.kind != JArray:
|
||||
errors.add(ManifestError(
|
||||
code: InvalidValue,
|
||||
field: archField,
|
||||
context: "Architecture field must be an array",
|
||||
suggestions: @["Use array format: [\"x86_64\", \"aarch64\"]"]
|
||||
))
|
||||
valid = false
|
||||
elif archNode.len == 0:
|
||||
errors.add(ManifestError(
|
||||
code: InvalidValue,
|
||||
field: archField,
|
||||
context: "Architecture array cannot be empty",
|
||||
suggestions: @["Specify at least one architecture"]
|
||||
))
|
||||
valid = false
|
||||
else:
|
||||
# Validate each architecture value
|
||||
for archVal in archNode:
|
||||
let arch = archVal.getStr()
|
||||
if arch notin VALID_ARCHITECTURES:
|
||||
errors.add(ManifestError(
|
||||
code: PlatformIncompat,
|
||||
field: archField,
|
||||
context: "Invalid architecture: " & arch,
|
||||
suggestions: @["Valid architectures: " & $VALID_ARCHITECTURES]
|
||||
))
|
||||
valid = false
|
||||
if archNode.kind != JArray:
|
||||
errors.add(ManifestError(
|
||||
code: InvalidValue,
|
||||
field: archField,
|
||||
context: "Architecture field must be an array",
|
||||
suggestions: @["Use array format: [\"x86_64\", \"aarch64\"]"]
|
||||
))
|
||||
valid = false
|
||||
elif archNode.len == 0:
|
||||
errors.add(ManifestError(
|
||||
code: InvalidValue,
|
||||
field: archField,
|
||||
context: "Architecture array cannot be empty",
|
||||
suggestions: @["Specify at least one architecture"]
|
||||
))
|
||||
valid = false
|
||||
else:
|
||||
# Validate each architecture value
|
||||
for archVal in archNode:
|
||||
let arch = archVal.getStr()
|
||||
if arch notin VALID_ARCHITECTURES:
|
||||
errors.add(ManifestError(
|
||||
code: PlatformIncompat,
|
||||
field: archField,
|
||||
context: "Invalid architecture: " & arch,
|
||||
suggestions: @["Valid architectures: " & $VALID_ARCHITECTURES]
|
||||
))
|
||||
valid = false
|
||||
|
||||
return valid
|
||||
return valid
|
||||
)
|
||||
|
||||
proc createRequiredFieldsRule*(fields: seq[string]): ValidationRule =
|
||||
|
|
@ -613,17 +615,17 @@ proc createRequiredFieldsRule*(fields: seq[string]): ValidationRule =
|
|||
name: "required_fields",
|
||||
description: "Ensures all required fields are present",
|
||||
validate: proc(data: JsonNode, errors: var seq[ManifestError]): bool =
|
||||
var valid = true
|
||||
for field in fields:
|
||||
if field notin data:
|
||||
errors.add(ManifestError(
|
||||
code: MissingField,
|
||||
field: field,
|
||||
context: "Required field '" & field & "' is missing",
|
||||
suggestions: @["Add the field to the manifest"]
|
||||
))
|
||||
valid = false
|
||||
return valid
|
||||
var valid = true
|
||||
for field in fields:
|
||||
if field notin data:
|
||||
errors.add(ManifestError(
|
||||
code: MissingField,
|
||||
field: field,
|
||||
context: "Required field '" & field & "' is missing",
|
||||
suggestions: @["Add the field to the manifest"]
|
||||
))
|
||||
valid = false
|
||||
return valid
|
||||
)
|
||||
|
||||
proc createDependencyRule*(): ValidationRule =
|
||||
|
|
@ -632,61 +634,62 @@ proc createDependencyRule*(): ValidationRule =
|
|||
name: "dependencies",
|
||||
description: "Validates dependency specifications",
|
||||
validate: proc(data: JsonNode, errors: var seq[ManifestError]): bool =
|
||||
var valid = true
|
||||
var valid = true
|
||||
|
||||
for depField in ["dependencies", "build_dependencies", "optional_dependencies"]:
|
||||
if depField notin data: continue
|
||||
for depField in ["dependencies", "build_dependencies",
|
||||
"optional_dependencies"]:
|
||||
if depField notin data: continue
|
||||
|
||||
let deps = data[depField]
|
||||
if deps.kind != JArray:
|
||||
let deps = data[depField]
|
||||
if deps.kind != JArray:
|
||||
errors.add(ManifestError(
|
||||
code: SchemaError,
|
||||
field: depField,
|
||||
context: "Dependencies must be an array",
|
||||
suggestions: @["Use array format"]
|
||||
))
|
||||
valid = false
|
||||
continue
|
||||
|
||||
for dep in deps:
|
||||
if dep.kind != JObject:
|
||||
errors.add(ManifestError(
|
||||
code: SchemaError,
|
||||
field: depField,
|
||||
context: "Dependencies must be an array",
|
||||
suggestions: @["Use array format"]
|
||||
context: "Each dependency must be an object",
|
||||
suggestions: @["Use object format: {\"name\": \"pkg\", \"version\": \">=1.0.0\"}"]
|
||||
))
|
||||
valid = false
|
||||
continue
|
||||
|
||||
for dep in deps:
|
||||
if dep.kind != JObject:
|
||||
errors.add(ManifestError(
|
||||
code: SchemaError,
|
||||
field: depField,
|
||||
context: "Each dependency must be an object",
|
||||
suggestions: @["Use object format: {\"name\": \"pkg\", \"version\": \">=1.0.0\"}"]
|
||||
))
|
||||
valid = false
|
||||
continue
|
||||
# Check required dependency fields
|
||||
if "name" notin dep:
|
||||
errors.add(ManifestError(
|
||||
code: MissingField,
|
||||
field: depField & ".name",
|
||||
context: "Dependency missing 'name' field",
|
||||
suggestions: @["Add name field"]
|
||||
))
|
||||
valid = false
|
||||
|
||||
# Check required dependency fields
|
||||
if "name" notin dep:
|
||||
# Validate version constraint if present
|
||||
if "version" in dep:
|
||||
let versionStr = dep["version"].getStr()
|
||||
try:
|
||||
discard parseVersionConstraint(versionStr)
|
||||
except ManifestError as e:
|
||||
errors.add(ManifestError(
|
||||
code: MissingField,
|
||||
field: depField & ".name",
|
||||
context: "Dependency missing 'name' field",
|
||||
suggestions: @["Add name field"]
|
||||
code: DependencyError,
|
||||
field: depField & ".version",
|
||||
context: "Invalid version constraint: " & versionStr,
|
||||
suggestions: @[
|
||||
"Use valid constraint: >=1.0.0, ~1.2.0, ^2.0.0",
|
||||
e.msg
|
||||
]
|
||||
))
|
||||
valid = false
|
||||
|
||||
# Validate version constraint if present
|
||||
if "version" in dep:
|
||||
let versionStr = dep["version"].getStr()
|
||||
try:
|
||||
discard parseVersionConstraint(versionStr)
|
||||
except ManifestError as e:
|
||||
errors.add(ManifestError(
|
||||
code: DependencyError,
|
||||
field: depField & ".version",
|
||||
context: "Invalid version constraint: " & versionStr,
|
||||
suggestions: @[
|
||||
"Use valid constraint: >=1.0.0, ~1.2.0, ^2.0.0",
|
||||
e.msg
|
||||
]
|
||||
))
|
||||
valid = false
|
||||
|
||||
return valid
|
||||
return valid
|
||||
)
|
||||
|
||||
# ============================================================================
|
||||
|
|
@ -769,7 +772,8 @@ proc checkPlatformCompatibility*(manifest: PackageManifest,
|
|||
# JSON Parsing (Machine-Friendly)
|
||||
# ============================================================================
|
||||
|
||||
proc parseManifestFromJSON*(content: string, parser: var ManifestParser): PackageManifest =
|
||||
proc parseManifestFromJSON*(content: string,
|
||||
parser: var ManifestParser): PackageManifest =
|
||||
## Parse package manifest from JSON format
|
||||
## This is the machine-friendly format for automated systems
|
||||
|
||||
|
|
@ -865,7 +869,8 @@ proc parseManifestFromJSON*(content: string, parser: var ManifestParser): Packag
|
|||
optional: false
|
||||
)
|
||||
if dep.hasKey("version"):
|
||||
depSpec.versionConstraint = parseVersionConstraint(dep["version"].getStr())
|
||||
depSpec.versionConstraint = parseVersionConstraint(dep[
|
||||
"version"].getStr())
|
||||
if dep.hasKey("optional"):
|
||||
depSpec.optional = dep["optional"].getBool()
|
||||
if dep.hasKey("features"):
|
||||
|
|
@ -880,7 +885,8 @@ proc parseManifestFromJSON*(content: string, parser: var ManifestParser): Packag
|
|||
optional: false
|
||||
)
|
||||
if dep.hasKey("version"):
|
||||
depSpec.versionConstraint = parseVersionConstraint(dep["version"].getStr())
|
||||
depSpec.versionConstraint = parseVersionConstraint(dep[
|
||||
"version"].getStr())
|
||||
manifest.buildDependencies.add(depSpec)
|
||||
|
||||
if jsonNode.hasKey("optional_dependencies"):
|
||||
|
|
@ -890,7 +896,8 @@ proc parseManifestFromJSON*(content: string, parser: var ManifestParser): Packag
|
|||
optional: true
|
||||
)
|
||||
if dep.hasKey("version"):
|
||||
depSpec.versionConstraint = parseVersionConstraint(dep["version"].getStr())
|
||||
depSpec.versionConstraint = parseVersionConstraint(dep[
|
||||
"version"].getStr())
|
||||
manifest.optionalDependencies.add(depSpec)
|
||||
|
||||
# Build configuration
|
||||
|
|
@ -1016,7 +1023,8 @@ proc parseManifestFromJSON*(content: string, parser: var ManifestParser): Packag
|
|||
# KDL Parsing (Human-Friendly) - NATIVE IMPLEMENTATION
|
||||
# ============================================================================
|
||||
|
||||
proc parseManifestFromKDL*(content: string, parser: var ManifestParser): PackageManifest =
|
||||
proc parseManifestFromKDL*(content: string,
|
||||
parser: var ManifestParser): PackageManifest =
|
||||
## Parse package manifest from KDL format using NATIVE KDL structures
|
||||
## No JSON conversion - direct KDL parsing for maximum efficiency
|
||||
|
||||
|
|
@ -1333,7 +1341,8 @@ proc parseManifestFromKDL*(content: string, parser: var ManifestParser): Package
|
|||
manifest.desktop = some(dt)
|
||||
|
||||
else:
|
||||
if parser.config.strictMode and child.name notin parser.config.allowedFields:
|
||||
if parser.config.strictMode and child.name notin
|
||||
parser.config.allowedFields:
|
||||
raise newException(ManifestError, "Unknown field: " & child.name)
|
||||
else:
|
||||
parser.warnings.add("Unknown field: " & child.name)
|
||||
|
|
@ -1460,7 +1469,8 @@ proc serializeManifestToJSON*(manifest: PackageManifest): string =
|
|||
for dep in manifest.dependencies:
|
||||
var depObj = %* {"name": dep.name}
|
||||
if dep.versionConstraint.operator != OpAny:
|
||||
depObj["version"] = %($dep.versionConstraint.operator & $dep.versionConstraint.version)
|
||||
depObj["version"] = %($dep.versionConstraint.operator &
|
||||
$dep.versionConstraint.version)
|
||||
if dep.optional:
|
||||
depObj["optional"] = %true
|
||||
if dep.features.len > 0:
|
||||
|
|
@ -1617,7 +1627,8 @@ proc serializeManifestToKDL*(manifest: PackageManifest): string =
|
|||
for dep in manifest.dependencies:
|
||||
result.add(" \"" & dep.name & "\"")
|
||||
if dep.versionConstraint.operator != OpAny:
|
||||
result.add(" version=\"" & $dep.versionConstraint.operator & $dep.versionConstraint.version & "\"")
|
||||
result.add(" version=\"" & $dep.versionConstraint.operator &
|
||||
$dep.versionConstraint.version & "\"")
|
||||
if dep.optional:
|
||||
result.add(" optional=true")
|
||||
if dep.features.len > 0:
|
||||
|
|
@ -1631,7 +1642,8 @@ proc serializeManifestToKDL*(manifest: PackageManifest): string =
|
|||
for dep in manifest.buildDependencies:
|
||||
result.add(" \"" & dep.name & "\"")
|
||||
if dep.versionConstraint.operator != OpAny:
|
||||
result.add(" version=\"" & $dep.versionConstraint.operator & $dep.versionConstraint.version & "\"")
|
||||
result.add(" version=\"" & $dep.versionConstraint.operator &
|
||||
$dep.versionConstraint.version & "\"")
|
||||
result.add("\n")
|
||||
result.add(" }\n")
|
||||
|
||||
|
|
@ -1641,7 +1653,8 @@ proc serializeManifestToKDL*(manifest: PackageManifest): string =
|
|||
for dep in manifest.optionalDependencies:
|
||||
result.add(" \"" & dep.name & "\"")
|
||||
if dep.versionConstraint.operator != OpAny:
|
||||
result.add(" version=\"" & $dep.versionConstraint.operator & $dep.versionConstraint.version & "\"")
|
||||
result.add(" version=\"" & $dep.versionConstraint.operator &
|
||||
$dep.versionConstraint.version & "\"")
|
||||
if dep.features.len > 0:
|
||||
result.add(" features=\"" & dep.features.join(",") & "\"")
|
||||
result.add("\n")
|
||||
|
|
@ -1696,13 +1709,15 @@ proc serializeManifestToKDL*(manifest: PackageManifest): string =
|
|||
if manifest.files.len > 0:
|
||||
result.add("\n files {\n")
|
||||
for file in manifest.files:
|
||||
result.add(" file \"" & file.path & "\" hash=\"" & file.hash & "\" size=" & $file.size & " permissions=\"" & file.permissions & "\"\n")
|
||||
result.add(" file \"" & file.path & "\" hash=\"" & file.hash &
|
||||
"\" size=" & $file.size & " permissions=\"" & file.permissions & "\"\n")
|
||||
result.add(" }\n")
|
||||
|
||||
if manifest.users.len > 0:
|
||||
result.add("\n users {\n")
|
||||
for user in manifest.users:
|
||||
result.add(" \"" & user.name & "\" group=\"" & user.group & "\" shell=\"" & user.shell & "\" home=\"" & user.home & "\"")
|
||||
result.add(" \"" & user.name & "\" group=\"" & user.group &
|
||||
"\" shell=\"" & user.shell & "\" home=\"" & user.home & "\"")
|
||||
if user.uid.isSome:
|
||||
result.add(" uid=" & $user.uid.get())
|
||||
result.add("\n")
|
||||
|
|
@ -1720,7 +1735,8 @@ proc serializeManifestToKDL*(manifest: PackageManifest): string =
|
|||
if manifest.services.len > 0:
|
||||
result.add("\n services {\n")
|
||||
for service in manifest.services:
|
||||
result.add(" \"" & service.name & "\" enabled=" & $service.enabled & " content=" & service.content.escape() & "\n")
|
||||
result.add(" \"" & service.name & "\" enabled=" & $service.enabled &
|
||||
" content=" & service.content.escape() & "\n")
|
||||
result.add(" }\n")
|
||||
|
||||
# Security / Sandbox
|
||||
|
|
@ -1729,7 +1745,8 @@ proc serializeManifestToKDL*(manifest: PackageManifest): string =
|
|||
result.add("\n sandbox level=\"" & $sb.level & "\" {\n")
|
||||
|
||||
# Linux
|
||||
if sb.seccompProfile.isSome or sb.capabilities.len > 0 or sb.namespaces.len > 0:
|
||||
if sb.seccompProfile.isSome or sb.capabilities.len > 0 or
|
||||
sb.namespaces.len > 0:
|
||||
result.add(" linux")
|
||||
if sb.seccompProfile.isSome:
|
||||
result.add(" seccomp=\"" & sb.seccompProfile.get() & "\"")
|
||||
|
|
@ -1767,7 +1784,8 @@ proc serializeManifestToKDL*(manifest: PackageManifest): string =
|
|||
# Desktop Integration
|
||||
if manifest.desktop.isSome:
|
||||
let dt = manifest.desktop.get()
|
||||
result.add("\n desktop display_name=\"" & dt.displayName & "\" terminal=" & $dt.terminal & " startup_notify=" & $dt.startupNotify)
|
||||
result.add("\n desktop display_name=\"" & dt.displayName & "\" terminal=" &
|
||||
$dt.terminal & " startup_notify=" & $dt.startupNotify)
|
||||
if dt.icon.isSome:
|
||||
result.add(" icon=\"" & dt.icon.get() & "\"")
|
||||
if dt.startupWMClass.isSome:
|
||||
|
|
@ -1842,7 +1860,8 @@ proc calculateManifestHash*(manifest: PackageManifest): string =
|
|||
for dep in manifest.dependencies:
|
||||
var depStr = "dep:" & dep.name
|
||||
if dep.versionConstraint.operator != OpAny:
|
||||
depStr.add(":" & $dep.versionConstraint.operator & $dep.versionConstraint.version)
|
||||
depStr.add(":" & $dep.versionConstraint.operator &
|
||||
$dep.versionConstraint.version)
|
||||
if dep.optional:
|
||||
depStr.add(":optional")
|
||||
if dep.features.len > 0:
|
||||
|
|
@ -1855,7 +1874,8 @@ proc calculateManifestHash*(manifest: PackageManifest): string =
|
|||
for dep in manifest.buildDependencies:
|
||||
var depStr = "builddep:" & dep.name
|
||||
if dep.versionConstraint.operator != OpAny:
|
||||
depStr.add(":" & $dep.versionConstraint.operator & $dep.versionConstraint.version)
|
||||
depStr.add(":" & $dep.versionConstraint.operator &
|
||||
$dep.versionConstraint.version)
|
||||
buildDepStrings.add(depStr)
|
||||
components.add(buildDepStrings.sorted().join("|"))
|
||||
|
||||
|
|
@ -1864,7 +1884,8 @@ proc calculateManifestHash*(manifest: PackageManifest): string =
|
|||
for dep in manifest.optionalDependencies:
|
||||
var depStr = "optdep:" & dep.name
|
||||
if dep.versionConstraint.operator != OpAny:
|
||||
depStr.add(":" & $dep.versionConstraint.operator & $dep.versionConstraint.version)
|
||||
depStr.add(":" & $dep.versionConstraint.operator &
|
||||
$dep.versionConstraint.version)
|
||||
if dep.features.len > 0:
|
||||
depStr.add(":features=" & dep.features.sorted().join(","))
|
||||
optDepStrings.add(depStr)
|
||||
|
|
@ -1907,7 +1928,8 @@ proc calculateManifestHash*(manifest: PackageManifest): string =
|
|||
# 13. System Integration (sorted for determinism)
|
||||
var fileStrings: seq[string] = @[]
|
||||
for file in manifest.files:
|
||||
fileStrings.add("file:" & file.path & ":" & file.hash & ":" & $file.size & ":" & file.permissions)
|
||||
fileStrings.add("file:" & file.path & ":" & file.hash & ":" & $file.size &
|
||||
":" & file.permissions)
|
||||
components.add(fileStrings.sorted().join("|"))
|
||||
|
||||
var userStrings: seq[string] = @[]
|
||||
|
|
@ -1926,7 +1948,8 @@ proc calculateManifestHash*(manifest: PackageManifest): string =
|
|||
|
||||
var serviceStrings: seq[string] = @[]
|
||||
for service in manifest.services:
|
||||
serviceStrings.add("service:" & service.name & ":" & $service.enabled & ":" & service.content)
|
||||
serviceStrings.add("service:" & service.name & ":" & $service.enabled &
|
||||
":" & service.content)
|
||||
components.add(serviceStrings.sorted().join("|"))
|
||||
|
||||
# 14. Security / Sandbox
|
||||
|
|
@ -1951,7 +1974,8 @@ proc calculateManifestHash*(manifest: PackageManifest): string =
|
|||
# 15. Desktop Integration
|
||||
if manifest.desktop.isSome:
|
||||
let dt = manifest.desktop.get()
|
||||
var dtStr = "desktop:" & dt.displayName & ":" & $dt.terminal & ":" & $dt.startupNotify
|
||||
var dtStr = "desktop:" & dt.displayName & ":" & $dt.terminal & ":" &
|
||||
$dt.startupNotify
|
||||
|
||||
if dt.icon.isSome:
|
||||
dtStr.add(":icon=" & dt.icon.get())
|
||||
|
|
@ -1972,7 +1996,8 @@ proc calculateManifestHash*(manifest: PackageManifest): string =
|
|||
|
||||
return $hash
|
||||
|
||||
proc verifyManifestHash*(manifest: PackageManifest, expectedHash: string): bool =
|
||||
proc verifyManifestHash*(manifest: PackageManifest,
|
||||
expectedHash: string): bool =
|
||||
## Verify that a manifest matches the expected hash
|
||||
## Returns true if hash matches, false otherwise
|
||||
let calculatedHash = calculateManifestHash(manifest)
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@
|
|||
|
||||
import std/[os, strutils, times, options, sequtils, osproc, logging]
|
||||
import nip/cas
|
||||
import nip/xxhash
|
||||
import nip/xxh
|
||||
import nip/nexter_manifest
|
||||
|
||||
type
|
||||
|
|
@ -97,7 +97,8 @@ proc parseNEXTER*(path: string): NEXTERContainer =
|
|||
try:
|
||||
# Extract archive using tar with zstd decompression
|
||||
# Using --auto-compress lets tar detect compression automatically
|
||||
let extractCmd = "tar --auto-compress -xf " & quoteShell(path) & " -C " & quoteShell(tempDir)
|
||||
let extractCmd = "tar --auto-compress -xf " & quoteShell(path) & " -C " &
|
||||
quoteShell(tempDir)
|
||||
let exitCode = execCmd(extractCmd)
|
||||
|
||||
if exitCode != 0:
|
||||
|
|
@ -208,7 +209,8 @@ proc createNEXTER*(manifest: NEXTERManifest, environment: string, chunks: seq[Ch
|
|||
writeFile(tempDir / "signature.sig", signature)
|
||||
|
||||
# Create tar.zst archive
|
||||
let createCmd = "tar --auto-compress -cf " & quoteShell(outputPath) & " -C " & quoteShell(tempDir) & " ."
|
||||
let createCmd = "tar --auto-compress -cf " & quoteShell(outputPath) &
|
||||
" -C " & quoteShell(tempDir) & " ."
|
||||
let exitCode = execCmd(createCmd)
|
||||
|
||||
if exitCode != 0:
|
||||
|
|
@ -247,7 +249,7 @@ proc extractChunksToCAS*(container: NEXTERContainer, casRoot: string): seq[strin
|
|||
for chunk in container.chunks:
|
||||
try:
|
||||
# Decompress chunk
|
||||
let decompressed = chunk.data # TODO: Implement zstd decompression
|
||||
let decompressed = chunk.data # TODO: Implement zstd decompression
|
||||
|
||||
# Verify hash
|
||||
let calculatedHash = "xxh3-" & $calculateXXH3(decompressed)
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@
|
|||
|
||||
import std/[os, strutils, times, json, options, sequtils]
|
||||
import nip/cas
|
||||
import nip/xxhash
|
||||
import nip/xxh
|
||||
import nip/npk_manifest
|
||||
import nip/manifest_parser
|
||||
|
||||
|
|
@ -97,7 +97,8 @@ proc parseNPK*(path: string): NPKPackage =
|
|||
try:
|
||||
# Extract archive using tar with zstd decompression
|
||||
# Using --auto-compress lets tar detect compression automatically
|
||||
let extractCmd = "tar --auto-compress -xf " & quoteShell(path) & " -C " & quoteShell(tempDir)
|
||||
let extractCmd = "tar --auto-compress -xf " & quoteShell(path) & " -C " &
|
||||
quoteShell(tempDir)
|
||||
let extractResult = execShellCmd(extractCmd)
|
||||
|
||||
if extractResult != 0:
|
||||
|
|
@ -133,7 +134,7 @@ proc parseNPK*(path: string): NPKPackage =
|
|||
hash: chunkHash,
|
||||
data: chunkData,
|
||||
size: chunkData.len.int64,
|
||||
chunkType: Binary # Will be determined from manifest
|
||||
chunkType: Binary # Will be determined from manifest
|
||||
))
|
||||
|
||||
# Load signature
|
||||
|
|
@ -343,11 +344,13 @@ proc packageSize*(pkg: NPKPackage): int64 =
|
|||
|
||||
proc `$`*(pkg: NPKPackage): string =
|
||||
## Convert NPK package to human-readable string
|
||||
result = "NPK Package: " & pkg.manifest.name & " v" & manifest_parser.`$`(pkg.manifest.version) & "\n"
|
||||
result = "NPK Package: " & pkg.manifest.name & " v" & manifest_parser.`$`(
|
||||
pkg.manifest.version) & "\n"
|
||||
result.add("Archive: " & pkg.archivePath & "\n")
|
||||
result.add("Chunks: " & $pkg.chunks.len & "\n")
|
||||
result.add("Total Size: " & $(packageSize(pkg) div 1024) & " KB\n")
|
||||
result.add("Signature: " & (if pkg.signature.len > 0: "Present" else: "Missing") & "\n")
|
||||
result.add("Signature: " & (if pkg.signature.len >
|
||||
0: "Present" else: "Missing") & "\n")
|
||||
|
||||
# ============================================================================
|
||||
# Error Formatting
|
||||
|
|
|
|||
|
|
@ -15,6 +15,7 @@ import std/[strutils]
|
|||
# We'll use a conditional import to handle the case where xxhash isn't installed yet
|
||||
when defined(useXXHash):
|
||||
import xxhash
|
||||
import nint128 # Required for UInt128 toHex
|
||||
else:
|
||||
# Fallback implementation using a simple hash for development
|
||||
# This will be replaced with actual xxhash once the library is installed
|
||||
|
|
@ -41,7 +42,8 @@ when defined(useXXHash):
|
|||
proc calculateXXH3*(data: seq[byte]): XXH3Hash =
|
||||
## Calculate xxh3-128 hash of a byte sequence
|
||||
## Returns hash in format: "xxh3-<hex-digest>"
|
||||
let hash128 = XXH3_128bits(cast[ptr UncheckedArray[byte]](unsafeAddr data[0]), data.len)
|
||||
let hash128 = XXH3_128bits(cast[ptr UncheckedArray[byte]](unsafeAddr data[
|
||||
0]), csize_t(data.len))
|
||||
let hexDigest = hash128.toHex().toLowerAscii()
|
||||
result = XXH3Hash("xxh3-" & hexDigest)
|
||||
|
||||
|
|
@ -109,7 +111,7 @@ when isMainModule:
|
|||
echo "✗ Hash verification failed"
|
||||
|
||||
# Test byte sequence hashing
|
||||
let testBytes = @[byte(72), byte(101), byte(108), byte(108), byte(111)] # "Hello"
|
||||
let testBytes = @[byte(72), byte(101), byte(108), byte(108), byte(111)] # "Hello"
|
||||
let bytesHash = calculateXXH3(testBytes)
|
||||
echo "Bytes hash: ", $bytesHash
|
||||
|
||||
Loading…
Reference in New Issue