Skip to main content
Source: publisher/vexa_channel.py · audience: publisher

​
Overview

Emitted from python3 publisher/vexa_channel.py --help.

​
fetch

First step of a release crank: pull the release archive, its provenance bundle and the trusted root out of GitHub via gh into a working directory. Everything after this is offline, so this is the only step that needs the network to reach the OSS release.

​
build

Assemble the channel entry and run cross-checks C1..C9 against the release tag, the candidate image map at that tag, and the internal delivery receipt. A failed check refuses the entry — there is no silent path, only an explicit --break-glass record that becomes visible data inside the signed entry.

​
verify

Re-run every offline check against an entry directory without touching a registry. Use it after build to see what the entry claims before you push it, and to re-check an entry someone else built.

​
push

Publish the built entry: push it to the registry with oras, sign it and every image digest with cosign, and move the channel tag. The signing toolchain checks T1/T2 run inside this path so they cannot be skipped — T2 proves the signature is discoverable in the exact shape the customer’s Kyverno will ask for.

​
chart

Package the OSS chart with the release’s image digests baked in, so the customer’s Argo resolves a tag to nothing and a digest to exactly one image. Push it to the channel’s chart repository; the chart’s semver IS the channel position a station follows.

​
refresh

Re-stamp an entry’s expiry — same release, next seq, new horizon — when the channel is still current but its entry is about to go stale. Every entry expires, so a channel nobody refreshes stops verifying on its own; that is deliberate, and this is the verb that says “still good” without republishing the release.

​
revoke

Withdraw a release or a digest from the channel by appending to its signed revocation list — or publish an EMPTY list, which is how the list goes live before it is needed. We can publish and cannot un-publish: this is the only path that stops a subscriber’s sync, and the --reason is what their operator reads when it stops.

​
platform-chart

The same packaging act as chart, for the chart nobody outside can see: the proprietary vexa-platform chart, pinned from digests captured off a running cluster rather than off a release tag. Reach for it when what ships is an estate we operate, not an OSS release — there is no upstream tag to read pins from, so the live namespace is the source of truth and anything that cannot be pinned through values has to be declared as unpinnable, with its reason.

​
platform-entry

Build a channel entry for a whole platform estate — several charts, no single OSS release tag behind them. It refuses without a validation contract, because an estate with no stated scope is an estate nobody can prove anything about. What the estate is known NOT to cover goes in known_holes and rides inside the signed entry, where a subscriber reads it before they find out.

​
sign-images

Sign every digest in the candidate map into the channel’s signature repository. Separated from push because the signature layout — not the signature — is what the customer’s admission controller reads, and a re-signing pass must be runnable without republishing the entry.

​
attest

Record a signed, structured claim about a release: a station’s verdict, a soak result, anything a downstream contract can require: by name. This is how the internal channel accumulates evidence that the published channel entry is later built from.