Skip to content
DocumentationGovern the supply chain
On this page

Page resources

Open Markdownllms.txtView source

Last updated

Sign, admit, publish, and revoke

This recipe publishes an exact provider package and admits it without trusting a package name, registry location, or signature alone.

The .one and command outputs below are illustrative end-product examples.

1. Lock every Build input

Plain text
source snapshot source:sha256:11a0…
semantic package parcelhub.shipping@1 sha256:20b1…
provider claim acme_carrier.provider@1 sha256:31c2…
Rust toolchain tool:sha256:42d3…
dependency closure closure:sha256:53e4…
build action graph action-graph:sha256:64f5…

2. Build the publication artifact

Console
$ one build --root AcmeShipmentProvider
artifact artifact:sha256:aa01…
report build:sha256:bb02…
sbom sbom:sha256:cc03…
provenance provenance:sha256:dd04…
reproducible true

3. Request governed publication

One
semantic acme_carrier.publication
    domain one.providers@1
    publication AcmeShipmentProvider@1
        package acme_carrier.provider@1
        artifact artifact:sha256:aa01...
        target one.catalog#PublicProviders@1
        base snapshot:sha256:7701...
        evidence [build:sha256:bb02..., conformance:sha256:9901...]

Publication is a durable provider-catalog effect with base/target constraints, fresh authorization, observation, and reconciliation.

4. Admit the exact claim

Console
$ one plan --root AcmeShipmentPublication
$ one apply plan:sha256:…
$ one inspect operation:sha256:…
state admitted
catalog snapshot:sha256:8802…

A valid signature proves key control over bytes. Admission separately proves identity, ownership, contract compatibility, conformance, policy, target, freshness, and revocation posture.

5. Revoke with bounded impact

Console
$ one invoke one.providers#RevokeClaim@1 revoke-claim.json
$ one inspect revocation:sha256:… --affected-roots
FulfillmentWorker release:sha256:f421… action replan
OrdersApi none

Previously recorded facts remain. New selection and activation reject the revoked claim according to policy.

Executable evidence

The checked-in ACME compliance semantic package runs the public authorized publication lifecycle through one.one, exact registry publications, one.lock, CAS-backed component evidence, one check, and the language server. Its acceptance is gated on an explicitly supplied immutable standard distribution:

Console
ONE_SEMANTIC_PACKAGE_ACCEPTANCE_DISTRIBUTION=/path/to/distribution \
  cargo test -p one-cli --test semantic_package_lifecycle \
  canonical_peer_semantic_package_runs_the_public_authorized_lifecycle \
  -- --exact --ignored --nocapture

The signature, admission, and revocation outputs above remain illustrative end-product syntax. Read supply chain and profiles and assurance for the governing contracts.

See supply chain.