enterprise_ai.packs.publish

Source: sdks/python/src/enterprise_ai/packs/publish.py. Back to the Python SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Functions

skill_digests

skill_digests(root: Path) -> dict[str, str]

Name of each skill (front matter) -> sha256 of its SKILL.md, the digest the Skill Registry verifies.

Name	Type	Default	Required	Description
root	Path		yes	Folder of the pack; every skills/*/SKILL.md is read.

Returns: dict[str, str]. Dict skill name to sha256:<hex> of its SKILL.md.

sign_build

sign_build(build: BuildResult, key: str | Path, signer: str, password: str | None = None) -> dict[str, Any]

Sign the archive digest and every SKILL.md digest; write <name>-<version>.pack.json next to the archive.

Name	Type	Default	Required	Description
build	BuildResult		yes	Result of build_pack.
key	str | Path		yes	Path of the cosign private key.
signer	str		yes	Identity of the signer recorded with the signature.
password	str | None	None	no	Password of the key; default the COSIGN_PASSWORD environment variable.

Returns: dict[str, Any]. The descriptor: name, version, digest, archive, signature {value, signer}, skill_signatures, sbom, sbom_digest.

descriptor_path

descriptor_path(archive: Path) -> Path

Path of the signed descriptor of an archive: <name>-<version>.pack.json next to it.

Name	Type	Default	Required	Description
archive	Path		yes	Path of the .tar.gz archive.

Returns: Path. Path ending in .pack.json.

canonical_digest

canonical_digest(document: dict) -> str

sha256 of the canonical JSON (sorted keys, no spaces): the digest the Control Plane re-computes.

Name	Type	Default	Required	Description
document	dict		yes	JSON document to hash.

Returns: str. Text sha256:<hex>.

provenance_statement

provenance_statement(archive: Path, descriptor: dict, sbom: dict, reports: dict[str, dict]) -> dict[str, Any]

in-toto Statement v1 with a SLSA v1 provenance predicate: subject = the pack archive digest, byproducts = the SBOM and every report bound to the same digest.

Name	Type	Default	Required	Description
archive	Path		yes	Path of the pack archive, the subject of the statement.
descriptor	dict		yes	Signed descriptor of sign_build (name, version, digest).
sbom	dict		yes	SPDX SBOM of the build, added as the sbom byproduct.
reports	dict[str, dict]		yes	Reports by name (tests, evaluations, scan), each added as a byproduct with its canonical digest.

Returns: dict[str, Any]. The in-toto statement as a dict.

sign_provenance

sign_provenance(statement: dict, key: str | Path, signer: str, password: str | None = None) -> dict[str, Any]

Sign the canonical digest of a provenance statement with cosign.

Name	Type	Default	Required	Description
statement	dict		yes	Statement of provenance_statement.
key	str | Path		yes	Path of the cosign private key.
signer	str		yes	Identity of the signer recorded with the signature.
password	str | None	None	no	Password of the key; default the COSIGN_PASSWORD environment variable.

Returns: dict[str, Any]. Dict {statement, signature: {value, signer}}.

publication_body

publication_body(archive: Path, descriptor: dict, sbom: dict, scan: dict, tests: dict, evaluations: dict, oci: dict | None = None, provenance: dict | None = None) -> dict[str, Any]

Build the body of POST /v1/marketplace/packages: the archive in base64, its signatures, the SBOM and the reports.

Name	Type	Default	Required	Description
archive	Path		yes	Path of the pack archive, embedded in base64.
descriptor	dict		yes	Signed descriptor of sign_build, source of signature and skill_signatures.
sbom	dict		yes	SPDX SBOM of the build.
scan	dict		yes	Report of scan, sent as vulnerability_scan.
tests	dict		yes	Report of run_tests, sent as test_report.
evaluations	dict		yes	Report of run_evaluations, sent as evaluation_report.
oci	dict | None	None	no	OCI copy {ref, digest} of push, optional.
provenance	dict | None	None	no	Signed provenance of sign_provenance, optional.

Returns: dict[str, Any]. JSON body, with provenance and oci only when given.