artifacts¶

Resolve an approved artefact by name and version, verify who published it, and get a path on disk.

verifier, err := trust.Estate(releaseKey)         // embedded key + WKD, must agree
client, err := artifacts.New(verifier, artifacts.WithCache(cache))

path, err := client.Resolve(ctx,
    artifacts.Ref{Name: "onnxruntime", Version: "1.28.0"},
    "onnxruntime-linux-x64-1.28.0.tgz")

It exists so that every tool needing a model or a runtime does not write its own download-verify-cache loop. Three hand-rolled clients are three chances to skip the verification step, and the one that skips it fails silently — a wrong artefact loads and runs.

Start here¶

Resolve your first artefact — end to end, against the live channel, in about ten minutes.
The trust model — what a signature proves, what a digest proves, and why both are checked.
Why status is not a channel — the design decision most likely to be argued with.

The shape of it¶


`Ref`	an artefact and its own upstream version — `onnxruntime@1.28.0`, never a version of the channel
`Verifier`	checks a detached signature over a manifest; `trust.Estate` requires embedded and WKD to agree
`Cache`	stores already-verified bytes; a cache that stores unverified bytes serves them
`Client.Resolve`	signature → digest → path

Guides¶

Reference¶

Channel layout — URL structure, manifest and signature formats
Limits and defaults — timeouts, ceilings, paths and modes
Go API — on pkg.go.dev, generated from source

Requirements¶

Go 1.26.6 or newer. The root package links no cryptographic implementation — OpenPGP arrives through the trust subpackage, so importing that is the point at which a consumer opts into cryptography. Its own dependencies are afero and x/text, and a test names that set.