Where downloaded and operator-supplied artifacts live between runs.
An import that reruns against the same manifest must not re-download an artifact whose checksum already matched, and a licensed artifact that no URL can serve is placed here by an operator before the run starts. Both are the same lookup, so the cache is checked before the downloader is ever consulted.
A key is a slash-joined path of validated segments. Build one with key/1
rather than by interpolation: the segments come from a manifest, and a
segment carrying a separator or a parent reference would place the file
outside the cache root.
Summary
Functions
Joins validated segments into a cache key.
Callbacks
Functions
Joins validated segments into a cache key.
Each segment must match ~r/\A[A-Za-z0-9:][A-Za-z0-9.:-]*\z/: alphanumerics, underscore,
colon, dot, and hyphen, starting with something other than a dot. That
excludes the path separator and both . and .., so no manifest value can
make a key that resolves outside the cache root.