Skip to content

Commit 3b931a8

Browse files
Your Nameclaude
Your Name
and
claude
committed
chore: commit local changes for sync
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
1 parent 2dea8d5 commit 3b931a8

15 files changed

Lines changed: 571 additions & 7 deletions

File tree

‎LICENSE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
SPDX-License-Identifier: PMPL-1.0
1+
SPDX-License-Identifier: PMPL-1.0-or-later
22
SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council
33

44
================================================================================

‎infra/cerro/README.adoc‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
= Cerro Torre Manifests (Project Wharf)
2+
3+
These `.ctp` manifests define the supply-chain verified images for the Yacht runtime.
4+
They are intentionally strict and require source hashes and provenance before building.
5+
6+
== Workflow
7+
8+
. Fill in `TO_BE_FILLED_WITH_REAL_HASH` entries with real hashes.
9+
. Run `ct verify` on each manifest.
10+
. Build and publish OCI images from the verified manifests.
11+
. Update `infra/svalinn/yacht.yaml` tags when promoting new releases.
12+
13+
== Manifests
14+
15+
* `yacht-web.ctp` — OpenLiteSpeed + PHP runtime
16+
* `yacht-agent.ctp` — Wharf agent (Rust, distroless)
17+
* `yacht-mariadb.ctp` — MariaDB for WordPress
18+
* `yacht-redis.ctp` — Redis cache
19+
* `yacht-memcached.ctp` — Memcached cache
20+
* `yacht-arango.ctp` — ArangoDB graph/document store

‎infra/cerro/yacht-agent.ctp‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Project Wharf — Cerro Torre manifest for Yacht Agent
2+
3+
ctp_version = "1.0"
4+
5+
[metadata]
6+
name = "yacht-agent"
7+
version = "0.1.0"
8+
revision = 1
9+
kind = "container_image"
10+
summary = "Wharf Yacht Agent (DB proxy, integrity, eBPF)"
11+
license = "NOASSERTION"
12+
homepage = "https://github.com/hyperpolymath/project-wharf"
13+
maintainer = "wharf:ops"
14+
15+
[provenance]
16+
import_date = 2026-01-19T00:00:00Z
17+
18+
[security]
19+
suite_id = "CT-SIG-01"
20+
payload_binding = "manifest.canonical_bytes_sha256"
21+
22+
[[inputs.sources]]
23+
id = "wharf_source"
24+
type = "git"
25+
name = "project-wharf"
26+
version = "main"
27+
28+
[[inputs.sources.artifacts]]
29+
filename = "project-wharf.git"
30+
uri = "https://github.com/hyperpolymath/project-wharf.git"
31+
sha256 = "TO_BE_FILLED_WITH_REAL_HASH"
32+
33+
[build]
34+
system = "cerro_image"
35+
36+
[build.environment]
37+
arch = "amd64"
38+
os = "linux"
39+
reproducible = true
40+
41+
[[build.plan]]
42+
step = "import"
43+
using = "git"
44+
sources = ["wharf_source"]
45+
46+
[[build.plan]]
47+
step = "assemble_rootfs"
48+
strip_docs = true
49+
strip_locales = true
50+
51+
[[build.plan]]
52+
step = "emit_oci_image"
53+
54+
[build.plan.image]
55+
entrypoint = ["/usr/local/bin/yacht-agent"]
56+
57+
[build.plan.image.labels]
58+
"org.opencontainers.image.title" = "yacht-agent"
59+
"org.opencontainers.image.source" = "https://github.com/hyperpolymath/project-wharf"
60+
"org.opencontainers.image.description" = "Wharf Yacht Agent"
61+
62+
[outputs]
63+
primary = "yacht-agent"
64+
65+
[[outputs.artifacts]]
66+
type = "oci_image"
67+
name = "yacht-agent"
68+
tag = "0.1.0"
69+
70+
[[outputs.artifacts]]
71+
type = "sbom_spdx_json"
72+
name = "yacht-agent.sbom.spdx.json"
73+
74+
[[outputs.artifacts]]
75+
type = "in_toto_provenance"
76+
name = "yacht-agent.provenance.jsonl"

‎infra/cerro/yacht-mariadb.ctp‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Project Wharf — Cerro Torre manifest for Yacht MariaDB
2+
3+
ctp_version = "1.0"
4+
5+
[metadata]
6+
name = "yacht-mariadb"
7+
version = "0.1.0"
8+
revision = 1
9+
kind = "container_image"
10+
summary = "MariaDB database for WordPress Yacht"
11+
license = "GPL-2.0-or-later"
12+
homepage = "https://mariadb.org"
13+
maintainer = "wharf:ops"
14+
15+
[provenance]
16+
import_date = 2026-01-19T00:00:00Z
17+
18+
[security]
19+
suite_id = "CT-SIG-01"
20+
payload_binding = "manifest.canonical_bytes_sha256"
21+
22+
[[inputs.sources]]
23+
id = "mariadb_source"
24+
type = "upstream_tar"
25+
name = "mariadb"
26+
version = "10.11.x"
27+
28+
[[inputs.sources.artifacts]]
29+
filename = "mariadb-10.11.x.tar.gz"
30+
uri = "https://downloads.mariadb.org/rest-api/mariadb/10.11.x/mariadb-10.11.x.tar.gz"
31+
sha256 = "TO_BE_FILLED_WITH_REAL_HASH"
32+
33+
[build]
34+
system = "cerro_image"
35+
36+
[build.environment]
37+
arch = "amd64"
38+
os = "linux"
39+
reproducible = true
40+
41+
[[build.plan]]
42+
step = "import"
43+
using = "upstream"
44+
sources = ["mariadb_source"]
45+
46+
[[build.plan]]
47+
step = "assemble_rootfs"
48+
strip_docs = true
49+
strip_locales = true
50+
51+
[[build.plan]]
52+
step = "emit_oci_image"
53+
54+
[build.plan.image]
55+
entrypoint = ["/usr/sbin/mariadbd"]
56+
57+
[build.plan.image.labels]
58+
"org.opencontainers.image.title" = "yacht-mariadb"
59+
"org.opencontainers.image.source" = "https://mariadb.org"
60+
"org.opencontainers.image.description" = "MariaDB for Project Wharf"
61+
62+
[outputs]
63+
primary = "yacht-mariadb"
64+
65+
[[outputs.artifacts]]
66+
type = "oci_image"
67+
name = "yacht-mariadb"
68+
tag = "0.1.0"
69+
70+
[[outputs.artifacts]]
71+
type = "sbom_spdx_json"
72+
name = "yacht-mariadb.sbom.spdx.json"
73+
74+
[[outputs.artifacts]]
75+
type = "in_toto_provenance"
76+
name = "yacht-mariadb.provenance.jsonl"

‎infra/cerro/yacht-memcached.ctp‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Project Wharf — Cerro Torre manifest for Yacht Memcached
2+
3+
ctp_version = "1.0"
4+
5+
[metadata]
6+
name = "yacht-memcached"
7+
version = "0.1.0"
8+
revision = 1
9+
kind = "container_image"
10+
summary = "Memcached cache for Project Wharf"
11+
license = "BSD-3-Clause"
12+
homepage = "https://memcached.org"
13+
maintainer = "wharf:ops"
14+
15+
[provenance]
16+
import_date = 2026-01-19T00:00:00Z
17+
18+
[security]
19+
suite_id = "CT-SIG-01"
20+
payload_binding = "manifest.canonical_bytes_sha256"
21+
22+
[[inputs.sources]]
23+
id = "memcached_source"
24+
type = "upstream_tar"
25+
name = "memcached"
26+
version = "1.6.x"
27+
28+
[[inputs.sources.artifacts]]
29+
filename = "memcached-1.6.x.tar.gz"
30+
uri = "https://memcached.org/files/memcached-1.6.x.tar.gz"
31+
sha256 = "TO_BE_FILLED_WITH_REAL_HASH"
32+
33+
[build]
34+
system = "cerro_image"
35+
36+
[build.environment]
37+
arch = "amd64"
38+
os = "linux"
39+
reproducible = true
40+
41+
[[build.plan]]
42+
step = "import"
43+
using = "upstream"
44+
sources = ["memcached_source"]
45+
46+
[[build.plan]]
47+
step = "assemble_rootfs"
48+
strip_docs = true
49+
strip_locales = true
50+
51+
[[build.plan]]
52+
step = "emit_oci_image"
53+
54+
[build.plan.image]
55+
entrypoint = ["memcached"]
56+
cmd = ["-m", "512", "-p", "11211", "-U", "0", "-l", "0.0.0.0"]
57+
58+
[build.plan.image.labels]
59+
"org.opencontainers.image.title" = "yacht-memcached"
60+
"org.opencontainers.image.source" = "https://memcached.org"
61+
"org.opencontainers.image.description" = "Memcached cache for Project Wharf"
62+
63+
[outputs]
64+
primary = "yacht-memcached"
65+
66+
[[outputs.artifacts]]
67+
type = "oci_image"
68+
name = "yacht-memcached"
69+
tag = "0.1.0"
70+
71+
[[outputs.artifacts]]
72+
type = "sbom_spdx_json"
73+
name = "yacht-memcached.sbom.spdx.json"
74+
75+
[[outputs.artifacts]]
76+
type = "in_toto_provenance"
77+
name = "yacht-memcached.provenance.jsonl"

‎infra/cerro/yacht-redis.ctp‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Project Wharf — Cerro Torre manifest for Yacht Redis
2+
3+
ctp_version = "1.0"
4+
5+
[metadata]
6+
name = "yacht-redis"
7+
version = "0.1.0"
8+
revision = 1
9+
kind = "container_image"
10+
summary = "Redis cache for Project Wharf"
11+
license = "BSD-3-Clause"
12+
homepage = "https://redis.io"
13+
maintainer = "wharf:ops"
14+
15+
[provenance]
16+
import_date = 2026-01-19T00:00:00Z
17+
18+
[security]
19+
suite_id = "CT-SIG-01"
20+
payload_binding = "manifest.canonical_bytes_sha256"
21+
22+
[[inputs.sources]]
23+
id = "redis_source"
24+
type = "upstream_tar"
25+
name = "redis"
26+
version = "7.2.x"
27+
28+
[[inputs.sources.artifacts]]
29+
filename = "redis-7.2.x.tar.gz"
30+
uri = "https://download.redis.io/releases/redis-7.2.x.tar.gz"
31+
sha256 = "TO_BE_FILLED_WITH_REAL_HASH"
32+
33+
[build]
34+
system = "cerro_image"
35+
36+
[build.environment]
37+
arch = "amd64"
38+
os = "linux"
39+
reproducible = true
40+
41+
[[build.plan]]
42+
step = "import"
43+
using = "upstream"
44+
sources = ["redis_source"]
45+
46+
[[build.plan]]
47+
step = "assemble_rootfs"
48+
strip_docs = true
49+
strip_locales = true
50+
51+
[[build.plan]]
52+
step = "emit_oci_image"
53+
54+
[build.plan.image]
55+
entrypoint = ["redis-server"]
56+
57+
[build.plan.image.labels]
58+
"org.opencontainers.image.title" = "yacht-redis"
59+
"org.opencontainers.image.source" = "https://redis.io"
60+
"org.opencontainers.image.description" = "Redis cache for Project Wharf"
61+
62+
[outputs]
63+
primary = "yacht-redis"
64+
65+
[[outputs.artifacts]]
66+
type = "oci_image"
67+
name = "yacht-redis"
68+
tag = "0.1.0"
69+
70+
[[outputs.artifacts]]
71+
type = "sbom_spdx_json"
72+
name = "yacht-redis.sbom.spdx.json"
73+
74+
[[outputs.artifacts]]
75+
type = "in_toto_provenance"
76+
name = "yacht-redis.provenance.jsonl"

0 commit comments

Comments
 (0)