pandoc-k9/stapeln.toml at main · hyperpolymath/pandoc-k9 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# SPDX-License-Identifier: PMPL-1.0-or-later
# stapeln.toml — Layer-based container build for pandoc-k9
#
# stapeln builds containers as composable layers (German: "to stack").
# Each layer is independently cacheable, verifiable, and signable.

[metadata]
name = "pandoc-k9"
version = "0.1.0"
description = "pandoc-k9 container service"
author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
license = "PMPL-1.0-or-later"
registry = "ghcr.io/hyperpolymath"

[build]
containerfile = "Containerfile"
context = "."
runtime = "podman"

# ── Layer Definitions ──────────────────────────────────────────

[layers.base]
description = "Chainguard Wolfi minimal base"
from = "cgr.dev/chainguard/wolfi-base:latest"
cache = true
verify = true

[layers.toolchain]
description = "Build tools"
extends = "base"
packages = []
cache = true

[layers.build]
description = "pandoc-k9 build"
extends = "toolchain"
commands = []

[layers.runtime]
description = "Minimal runtime"
from = "cgr.dev/chainguard/wolfi-base:latest"
packages = ["ca-certificates", "curl"]
copy-from = [
    { layer = "build", src = "/app/", dst = "/app/" },
]
entrypoint = ["/app/pandoc-k9"]
user = "nonroot"

# ── Security ───────────────────────────────────────────────────

[security]
non-root = true
read-only-root = false
no-new-privileges = true
cap-drop = ["ALL"]
seccomp-profile = "default"

[security.signing]
algorithm = "ML-DSA-87"
provider = "cerro-torre"

[security.sbom]
format = "spdx-json"
output = "sbom.spdx.json"
include-deps = true

# ── Verification ───────────────────────────────────────────────

[verify]
vordr = true
svalinn = true
scan-on-build = true
fail-on = ["critical", "high"]

# ── Targets ────────────────────────────────────────────────────

[targets.development]
layers = ["base", "chainguard-toolchain", "build"]
env = { LOG_LEVEL = "debug" }

[targets.production]
layers = ["runtime"]
env = { LOG_LEVEL = "info" }

[targets.test]
layers = ["base", "chainguard-toolchain", "build"]
env = { LOG_LEVEL = "debug" }