feat(varve): module extension — Bazel consumes varve (experimental) - #606
Open
avrabe wants to merge 1 commit into
Open
feat(varve): module extension — Bazel consumes varve (experimental)#606avrabe wants to merge 1 commit into
avrabe wants to merge 1 commit into
Conversation
One varve.toml pin governs the developer terminal AND the Bazel build: the extension bootstraps a sha256-pinned varve binary (the single TOFU root, transcribed from cosign-verified release sums), then varve does what varve does — DSSE signature verification against the pinned trust root, anti-rollback counters, content-addressed layout — inside a hermetic repo-local root invalidated when the pin or trust root changes. Bazel contributes hermeticity, caching, and target wiring; neither system reimplements the other. Live-tested against the real ghcr.io/pulseengine/varve/layers 2026.08.0 layer: `bazel build //:synth` resolves and the binary runs (synth 0.54.0); corrupting one hex character of the trust root makes the build refuse (negative control). varve >= 0.9.0 also ships `export-bazel`, which can compile the existing checksums/tools/*.json registries from a verified layer so their hashes become signature-anchored — kept as the fallback for consumers without varve. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bazel-consumes-varve, per the toolchain-layer work in pulseengine/varve (v0.1.0..v0.9.0 shipped today):
varve/varve.bzl: repo rule + module extension — reads the project'svarve.tomlpin (the same file the terminal shims resolve) and trust root, bootstraps a sha256-pinned varve binary (varve/varve_checksums.json, transcribed from cosign-verified release sums — the extension's only TOFU root), runsvarve install+varve verifyinto a hermetic repo-local root, and exposes the layer's tools as@varve_tools//:<tool>. Pin/trust-root edits invalidate the repo automatically.ghcr.io/pulseengine/varve/layers2026.08.0 layer:bazel build //:synth→synth 0.54.0runs; negative control: one flipped hex character in the trust root and the build refuses with varve's verification error.examples/varve_extension/: standalone example module (added to a new.bazelignoreso root CI doesn't traverse it).//checksums: unchanged and kept —varve export-bazel(v0.9.0) can now compile those registries from a verified layer, converting their TOFU hashes to signature-anchored ones; follow-up.The trust boundary, stated in code: this extension can change tool availability (registry, mirror, air gap) but cannot relax varve's acceptance — signature, digest, and counter verdicts all happen inside varve.
🤖 Generated with Claude Code
https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu