Bundle a capsule into one signed file

Hashes every file of the capsule (or the ones named), records the manifest's digest, and signs both together into capsule_bundle.json. A list of digests that is not itself signed can be rewritten to match whatever the files now say; here the digests are inside the signature. This is rmoriebricklayer::cpsbndl(); check a bundle with rmoriebricklayer::cpsbndlvrf(), which also reports any file on disk the bundle does not list.

Usage

morie_capsule_bundle(
  dir,
  manifest,
  key,
  files = NULL,
  context = NULL,
  prehash = "none",
  note = NULL,
  path = NULL
)

Arguments

dir

The capsule directory, a single string.

manifest

A manifest, from morie_capsule_manifest().

key

A key from rmoriebricklayer::fipskg() or rmoriebricklayer::pqckg().

files

File names relative to dir. NULL (the default) bundles every regular file under dir, dot-files included, except the bundle itself.

context, prehash

As in morie_capsule_sign().

note

An optional sentence stored with the signature.

path

Where the bundle is written. NULL is capsule_bundle.json in dir.

Value

The bundle (a bricklayer_bundle list of files, manifest_digest, bundled_utc and attestation), invisibly, with the file written as attribute "path".

Details

Errors: dir not an existing directory; manifest not a list; files not NULL or file names in dir; path not one string; a key cpsatst() cannot sign with.

See also

Other capsule: morie_capsule_compare(), morie_capsule_drift(), morie_capsule_manifest(), morie_capsule_sign(), morie_capsule_verify(), morie_capsule_write()

Examples

dir <- file.path(tempdir(), "capsule-bundle")
dir.create(dir, showWarnings = FALSE)
write.csv(data.frame(id = 1:3), file.path(dir, "data.csv"), row.names = FALSE)
morie_capsule_write(dir, "data.csv", retrieved = "2026-10-20")
man <- morie_capsule_manifest(list(project = "demo"), env = FALSE)
key <- rmoriebricklayer::fipskg("ML-DSA-44")
b <- morie_capsule_bundle(dir, man, key, note = "as published")
rmoriebricklayer::cpsbndlvrf(attr(b, "path"), dir, man = man)$ok
#> [1] TRUE
unlink(dir, recursive = TRUE)