From spec.yaml to a signed artifact and into a sandbox
Row one, captured: the hello-mixin directory with spec.yaml and files, validated by sbx kit validate and packed by sbx kit pack into hello-mixin.zip. Row two, from the help text and not run: sbx kit sign with a key writes kit.sig.bundle beside spec.yaml, and sbx kit push with the sign flag pushes the manifest to an HTTPS registry with a signature referrer and a provenance referrer. Row three, not run: sbx kit verify and sbx kit provenance read those referrers back, beside the four settings that admit a kit. Row four, captured: sbx create with the kit flag builds m101-kit with tree installed and HELLO.md copied, sbx kit add appends env-mixin to m101-demo in a swap container, and sbx kit add refuses hello-mixin because it declares files.
AUTHOR AND PACKAGE (12-VALIDATE.TXT, 12-PACK.TXT)
hello-mixin/
spec.yaml, files/
sbx kit validate
VALID (directory)
sbx kit pack -o
Packed artifact to
hello-mixin.zip
spec.yaml and files/
SIGN AND PUBLISH (HELP-SBX, NOT RUN)
sbx kit sign --key
writes kit.sig.bundle
beside spec.yaml
sbx kit push --sign
DIR REF, form chosen by
schemaVersion 1 or 2
HTTPS registry
manifest, config, one layer
signature + provenance referrers
push
READ BACK (NOT RUN)
sbx kit verify
--key cosign.pub
sbx kit provenance
UNSIGNED or VERIFIED
settings that admit a kit
kit.allowedSources, kit.requireSignature,
kit.trustedSigners, kit.allowLocalKits
CONSUME (12-RUN-KIT.TXT, 12-KIT-ADD.TXT, 12-KIT-ADD-FILES.TXT)
sbx create shell --kit
m101-kit: tree installed,
HELLO.md, allow example.com
sbx kit add env-mixin
m101-demo recreated in a
swap container, variable set
sbx kit add hello-mixin
refused: the kit
declares files
Dashed boxes come from the help text and were not run. Every solid box was captured.