This recipe publishes an exact provider package and admits it without trusting a package name, registry location, or signature alone.
The .one and command outputs below are illustrative end-product examples.
1. Lock every Build input
source snapshot source:sha256:11a0…
semantic package parcelhub.shipping@1 revision:sha256:20b1…
provider claim acme_carrier.provider@1 revision:sha256:31c2…
Rust toolchain tool:sha256:42d3…
dependency closure closure:sha256:53e4…
build action graph action-graph:sha256:64f5…2. Build the publication artifact
$ one build --root AcmeShipmentProvider
artifact artifact:sha256:aa01…
report build:sha256:bb02…
sbom sbom:sha256:cc03…
provenance provenance:sha256:dd04…
reproducible true3. Request governed publication
semantic acme_carrier.publication
domain one.providers@1
publication AcmeShipmentProvider@1
package acme_carrier.provider@1
artifact artifact:sha256:aa01...
target one.catalog#PublicProviders@1
base snapshot:sha256:7701...
evidence [build:sha256:bb02..., conformance:sha256:9901...]
Publication is a durable provider-catalog effect with base/target constraints, fresh authorization, observation, and reconciliation.
4. Admit the exact claim
$ one plan --root AcmeShipmentPublication
$ one apply plan:revision:sha256:…
$ one inspect publication:operation:sha256:…
state admitted
catalog snapshot:sha256:8802…A valid signature proves key control over bytes. Admission separately proves identity, ownership, contract compatibility, conformance, policy, target, freshness, and revocation posture.
5. Revoke with bounded impact
$ one invoke one.providers#RevokeClaim@1 revoke-claim.json
$ one inspect revocation:sha256:… --affected-roots
FulfillmentWorker release:sha256:f421… action replan
OrdersApi nonePreviously recorded facts remain. New selection and activation reject the revoked claim according to policy.
See supply chain.