63 lines
1.8 KiB
Markdown
63 lines
1.8 KiB
Markdown
# BuildLedger
|
|
|
|
BuildLedger is a compact provenance ledger for reproducible OSS builds.
|
|
|
|
It provides:
|
|
|
|
- strict build provenance models
|
|
- a versioned schema registry
|
|
- append-only SQLite ledger storage
|
|
- tamper-evident hash chaining
|
|
- delta-sync packets for partial connectivity
|
|
- anchor records for external attestation
|
|
- CI context adapters for GitHub Actions, GitLab CI, and CircleCI
|
|
|
|
## What It Solves
|
|
|
|
Build outputs are only useful when they can be trusted, replayed, and compared. BuildLedger captures the build contract, environment, dependency graph, artifacts, and reproducibility metadata in one validated object, then persists that object into a verifiable ledger.
|
|
|
|
## Package Layout
|
|
|
|
- `buildledger.models` - core domain objects
|
|
- `buildledger.schemas` - versioned registry and validation
|
|
- `buildledger.ledger` - SQLite-backed append-only log
|
|
- `buildledger.sync` - delta packet generation and application
|
|
- `buildledger.anchors` - anchor records for ledger heads
|
|
- `buildledger.adapters` - CI context normalization
|
|
- `buildledger.cli` - local operational commands
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
bash test.sh
|
|
```
|
|
|
|
## Example
|
|
|
|
```python
|
|
from buildledger import SQLiteLedger
|
|
|
|
ledger = SQLiteLedger("buildledger.sqlite")
|
|
entry = ledger.append("build.contract", {"contract_id": "demo"})
|
|
ok, issues = ledger.verify_chain()
|
|
```
|
|
|
|
## CLI
|
|
|
|
```bash
|
|
python -m buildledger schema-manifest
|
|
python -m buildledger init-ledger buildledger.sqlite
|
|
python -m buildledger append-sample buildledger.sqlite
|
|
python -m buildledger verify buildledger.sqlite
|
|
```
|
|
|
|
## Testing
|
|
|
|
- `bash test.sh`
|
|
- `pytest`
|
|
- `python3 -m build`
|
|
|
|
## Status
|
|
|
|
This repository currently implements the core ledger, schema, sync, anchor, and CI-adapter foundation. Registry publishing adapters and full distributed integrations can be added on top of this base.
|