Bind delivered binaries to verified build source

This commit is contained in:
2026-10-06 00:51:56 +00:00
parent 1d6611601c
commit a1ee067b53
11 changed files with 154 additions and 15 deletions

View File

@@ -39,15 +39,18 @@ type BuildArtifact struct {
// BuildResult describes the source and artifacts reached by Build.
type BuildResult struct {
RepositoryDir string // absolute source repository path.
CandidateCommit string // Git HEAD observed when the build started.
Version string // requested injected version.
MainPackage string // Go package path built.
BinaryName string // artifact name prefix.
OutputDir string // resolved output directory.
Targets []Target // normalized target pairs.
Artifacts []BuildArtifact // completed output files, including partial success.
Compiler string // output of the selected local Go toolchain's version command.
RepositoryDir string // absolute source repository path.
CandidateCommit string // Git HEAD observed when the build started.
// SourceVerified reports clean source and the same HEAD observed before and
// after a completed build. It is required for binary delivery, not an attestation.
SourceVerified bool
Version string // requested injected version.
MainPackage string // Go package path built.
BinaryName string // artifact name prefix.
OutputDir string // resolved output directory.
Targets []Target // normalized target pairs.
Artifacts []BuildArtifact // completed output files, including partial success.
Compiler string // output of the selected local Go toolchain's version command.
}
// Build compiles the selected targets with Version injected through buildinfo.
@@ -74,6 +77,7 @@ func Build(ctx context.Context, request BuildRequest) (BuildResult, error) {
public := BuildResult{
RepositoryDir: result.RepositoryDir,
CandidateCommit: result.CandidateCommit,
SourceVerified: result.SourceVerified,
Version: result.Version,
MainPackage: result.MainPackage,
BinaryName: result.BinaryName,