{"id":40847674,"url":"https://github.com/meigma/blob","last_synced_at":"2026-01-25T04:01:22.890Z","repository":{"id":332476226,"uuid":"1133915264","full_name":"meigma/blob","owner":"meigma","description":"Sign and attest file archives in OCI registries. Carry cryptographic provenance wherever they go.","archived":false,"fork":false,"pushed_at":"2026-01-21T21:28:51.000Z","size":932,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-01-22T10:17:06.562Z","etag":null,"topics":["archive","files","oci","provenance","security"],"latest_commit_sha":null,"homepage":"https://blob.meigma.dev","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/meigma.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-14T01:49:21.000Z","updated_at":"2026-01-21T21:28:28.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/meigma/blob","commit_stats":null,"previous_names":["meigma/blob"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/meigma/blob","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meigma%2Fblob","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meigma%2Fblob/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meigma%2Fblob/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meigma%2Fblob/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/meigma","download_url":"https://codeload.github.com/meigma/blob/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meigma%2Fblob/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28742983,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-25T02:46:29.005Z","status":"ssl_error","status_checked_at":"2026-01-25T02:44:29.968Z","response_time":113,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["archive","files","oci","provenance","security"],"created_at":"2026-01-21T23:17:07.618Z","updated_at":"2026-01-25T04:01:22.883Z","avatar_url":"https://github.com/meigma.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Blob\n\n[![CI](https://github.com/meigma/blob/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/meigma/blob/actions/workflows/ci.yml)\n[![Docs](https://img.shields.io/badge/docs-blob.meigma.dev-blue)](https://blob.meigma.dev)\n[![Go Reference](https://pkg.go.dev/badge/github.com/meigma/blob.svg)](https://pkg.go.dev/github.com/meigma/blob)\n[![Release](https://img.shields.io/github/v/release/meigma/blob)](https://github.com/meigma/blob/releases)\n[![License](https://img.shields.io/badge/license-Apache--2.0%2FMIT-blue)](LICENSE-MIT)\n\n\u003e Sign and attest file archives in OCI registries. Carry cryptographic provenance wherever they go.\n\nYou sign your container images. What about everything else? Config files, ML models, deployment artifacts, and certificates move between systems with no provenance, no integrity verification, and full downloads every time. Blob brings the same supply chain security guarantees to file archives.\n\n## How It Works\n\nBlob stores archives as two OCI blobs bound by a signed manifest:\n\n```\nSigned → Manifest → Index → Per-file SHA256\n```\n\nEvery file inherits the signature above it. Tamper with a single byte and verification fails instantly.\n\nThe index blob is small (~1MB for 10K files) and contains file metadata. The data blob stores file contents sorted by path. This separation enables reading individual files via HTTP range requests without downloading entire archives—read a 64KB config from a 1GB archive and transfer only 64KB.\n\n## Installation\n\n### CLI\n\n```bash\ncurl -sSfL https://blob.meigma.dev/install.sh | sh\n```\n\nSee [blob-cli](https://github.com/meigma/blob-cli) for more installation options.\n\n### Go Library\n\n```bash\ngo get github.com/meigma/blob\n```\n\nRequires Go 1.25 or later.\n\n## Quick Start\n\n```go\nimport (\n    \"context\"\n    \"github.com/meigma/blob\"\n)\n\nctx := context.Background()\n\n// Push a directory to registry\nc, _ := blob.NewClient(blob.WithDockerConfig())\nc.Push(ctx, \"ghcr.io/org/configs:v1\", \"./src\",\n    blob.PushWithCompression(blob.CompressionZstd),\n)\n\n// Pull and read files lazily—only downloads what you access\narchive, _ := c.Pull(ctx, \"ghcr.io/org/configs:v1\")\ncontent, _ := archive.ReadFile(\"config/app.json\")\n```\n\n## Supply Chain Security\n\nVerify archive provenance with Sigstore signatures and SLSA attestations:\n\n```go\nimport (\n    \"github.com/meigma/blob\"\n    \"github.com/meigma/blob/policy\"\n    \"github.com/meigma/blob/policy/sigstore\"\n    \"github.com/meigma/blob/policy/slsa\"\n)\n\n// Require signatures from GitHub Actions\nsigPolicy, _ := sigstore.GitHubActionsPolicy(\"myorg/myrepo\",\n    sigstore.AllowBranches(\"main\"),\n    sigstore.AllowTags(\"v*\"),\n)\n\n// Require SLSA provenance from a specific workflow\nslsaPolicy, _ := slsa.GitHubActionsWorkflow(\"myorg/myrepo\")\n\n// Pull fails if verification fails\nc, _ := blob.NewClient(\n    blob.WithDockerConfig(),\n    blob.WithPolicy(policy.RequireAll(sigPolicy, slsaPolicy)),\n)\narchive, err := c.Pull(ctx, \"ghcr.io/org/configs:v1\")\n```\n\n## Performance\n\n| Metric | Value |\n|--------|-------|\n| Bandwidth saved | 99.99% (64KB from 1GB archive) |\n| Index lookup | 26 ns (constant time) |\n| Cache speedup | 43x faster reads |\n\nPath-sorted storage means directories fetch with a single range request. Content-addressed caching deduplicates across archives automatically.\n\n## Features\n\n- **Prove origin** — Sigstore signatures and SLSA attestations\n- **Verify on read** — Per-file SHA256 hashes checked automatically\n- **Fetch only what you use** — HTTP range requests for individual files\n- **Directory fetches** — Single-request reads for entire directories\n- **Compression** — Per-file zstd compression preserves random access\n- **Caching** — Content-addressed deduplication across archives\n- **Standard interfaces** — Implements `fs.FS`, `fs.ReadFileFS`, `fs.ReadDirFS`\n\n## Documentation\n\n- [Getting Started](https://blob.meigma.dev/docs/getting-started) — Go library tutorial\n- [CLI Getting Started](https://blob.meigma.dev/docs/cli-getting-started) — Command-line tutorial\n- [CLI Reference](https://blob.meigma.dev/docs/reference/cli) — Complete CLI command reference\n- [Architecture](https://blob.meigma.dev/docs/explanation/architecture) — Design decisions and trade-offs\n- [API Reference](https://blob.meigma.dev/docs/reference/api) — Complete API documentation\n\n## License\n\nLicensed under either of [Apache License, Version 2.0](LICENSE-APACHE) or [MIT License](LICENSE-MIT) at your option.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmeigma%2Fblob","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmeigma%2Fblob","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmeigma%2Fblob/lists"}