kit

remote.h (2660B)

---

 #ifndef KIT_BUILD_REMOTE_H
 #define KIT_BUILD_REMOTE_H
 
 #include <kit/build_coord.h> /* KitBuildExec, KitBuildObjectRemote */
 #include <kit/cas.h>
 #include <kit/core.h>
 #include <stddef.h>
 #include <stdint.h>
 
 #include "build.h"
 
 /*
  * Untrusted remote object fetch — the extra rung in the materialization ladder
  * (tree cache -> local CAS -> REMOTE FETCH -> run recipe). The coordinator
  * performs no network I/O itself: when a needed object is absent locally and a
  * remote is configured, it renders the user's fetch-recipe argv template and
  * runs it via the exec host to pull one object into a temp file. The fetched
  * bytes are VERIFIED against the requested content id before being installed
  * into the local CAS, so a corrupt or malicious mirror fails the hash check and
  * is discarded — the remotes and the fetch recipe are untrusted, and the
  * self-verifying CAS makes that safe. Several mirrors may be configured; they
  * are tried in order until one yields verified bytes.
  *
  * Trees vs blobs. A BLOB fetch verifies the bytes hash to `id` and installs
  * them. A TREE fetch installs the id-checked tree MANIFEST only; the blobs that
  * tree references are fetched on demand (as further BUILD_REMOTE_BLOB fetches)
  * when build_store_cache_materialize verifies and restores the tree. So
  * obtaining a tree is a two-step affair — manifest first, then its blobs — and
  * the whole tree is verified before any cache hit is served from it.
  *
  * There is no separate deepset kind: a deepset closure node is a self-verifying
  * CAS blob (deep-set-id == blob-id), so it — like need-overlay and argv blobs —
  * is fetched as an ordinary BLOB ({kind}=blob) on demand when
  * build_coord_deepset_load needs one the local CAS lacks.
  *
  * (Trust, where it exists, is for signed trace bundles — bundle.h. Content
  * fetched here is trustless.)
  */
 
 typedef enum BuildRemoteKind {
   BUILD_REMOTE_BLOB = 0,
   BUILD_REMOTE_TREE = 1,
 } BuildRemoteKind;
 
 /* Fetch one object (`kind`, `id`) by trying each remote in `remotes` in order:
  * render its template (tokens {kind} {pp} {id} {out}), spawn it via the exec
  * host, verify the fetched bytes hash to `id`, and install them into `cas`.
  * Returns BUILD_OK on the first verified install, BUILD_ERR if no remote is
  * configured or all fail/verify-fail (bad bytes are discarded). Stages into
  * `tmp_dir`. */
 int build_remote_fetch(const KitContext*, const KitBuildExec*,
                        const KitBuildObjectRemote* remotes, size_t nremotes,
                        KitCas* cas, KitSlice tmp_dir, BuildRemoteKind kind,
                        const uint8_t id[BUILD_HASH_LEN]);
 
 #endif