enterprise_ai.packs.oci

Source: sdks/python/src/enterprise_ai/packs/oci.py. Back to the Python SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Functions

repository_of

repository_of(ref: str) -> str

host:5000/packs/hr:1.0.0 or ...@sha256:... -> host:5000/packs/hr.

Name	Type	Default	Required	Description
ref	str		yes	OCI reference with a tag or a digest.

Returns: str. The repository without tag nor digest; the port of the registry host is kept.

push

push(ref: str, files: list[Path], plain_http: bool = False) -> dict

oras push: returns {reference, digest, repository}.

Name	Type	Default	Required	Description
ref	str		yes	Target reference in the registry, such as <registry>/packs/hr:1.0.0.
files	list[Path]		yes	Archive, SBOM and descriptor to upload as layers; they must sit in the same folder.
plain_http	bool	False	no	Talk to the registry over plain HTTP (--plain-http), default False.

Returns: dict. Dict {reference, digest, repository}, digest being the manifest digest.

pull

pull(ref: str, out_dir: Path, plain_http: bool = False) -> list[Path]

Download an OCI artifact with oras pull into a folder.

Name	Type	Default	Required	Description
ref	str		yes	Reference of the artifact, by tag or by @sha256: digest.
out_dir	Path		yes	Destination folder, created when missing.
plain_http	bool	False	no	Talk to the registry over plain HTTP (--plain-http), default False.

Returns: list[Path]. Sorted paths of the files in out_dir after the pull.

sign_artifact

sign_artifact(repository: str, digest: str, key: str | Path, password: str | None = None, insecure_registry: bool = False) -> None

Sign <repository>@<digest> with cosign sign --key, without transparency log upload; a failure raises RuntimeError.

Name	Type	Default	Required	Description
repository	str		yes	Repository of the artifact, without tag (see repository_of).
digest	str		yes	Manifest digest sha256:<hex> returned by push.
key	str | Path		yes	Path of the cosign private key (cosign.key).
password	str | None	None	no	Password of the key; default the COSIGN_PASSWORD environment variable.
insecure_registry	bool	False	no	Allow a registry without TLS (--allow-insecure-registry), default False.

Returns: None.

verify_artifact

verify_artifact(repository: str, digest: str, public_key: str | Path, insecure_registry: bool = False) -> bool

Check the cosign signature of <repository>@<digest> with a public key, ignoring the transparency log.

Name	Type	Default	Required	Description
repository	str		yes	Repository of the artifact, without tag.
digest	str		yes	Manifest digest sha256:<hex> of the artifact.
public_key	str | Path		yes	Path of the cosign public key (cosign.pub).
insecure_registry	bool	False	no	Allow a registry without TLS (--allow-insecure-registry), default False.

Returns: bool. True when cosign verify succeeds, else False.