Struct LogCosignature 

pub struct LogCosignature {
    pub cosignature_version: String,
    pub witness_id: String,
    pub witnessed_checkpoint: WitnessedCheckpoint,
    pub witnessed_at: DateTime<Utc>,
    pub signature: Signature,
}

A witness-signed cosignature of a transparency-log checkpoint (RFC-ACDP-0015 §4).

CLOSED schema (acdp-log-cosignature.schema.json, additionalProperties: false): every member is signed, so an unknown member changes the preimage and is rejected at parse time; extensions require a cosignature_version bump.

Cosignatures are ephemeral, per-observation evidence (the RFC-ACDP-0011 §4 posture): a witness produces a fresh cosignature (fresh witnessed_at) each time it re-observes the log, including at an unchanged tree_size as a liveness signal.

Fields

cosignature_version: String

MUST be exactly COSIGNATURE_VERSION ("acdp-cosig/1").

witness_id: String

The witness’s DID (did:web or did:key) — the witness’s own identity, distinct from the registry’s registry_did (RFC-ACDP-0015 §3). The N-witnessed count (§8) is over DISTINCT witness_id values.

witnessed_checkpoint: WitnessedCheckpoint

The identity-bearing subset of the checkpoint the witness observed, copied verbatim.

witnessed_at: DateTime<Utc>

The witness-clock time at which the witness observed and cosigned the checkpoint; canonical millisecond-precision RFC 3339 UTC (RFC-ACDP-0001 §5.3). Anchored against a party the registry does not control — it bounds when the checkpoint existed regardless of the registry’s claimed timestamp (§4).

signature: Signature

The witness’s signature over the cosignature hash (§5 — the RFC-ACDP-0010 §5 construction verbatim, keyed by the witness’s own assertionMethod key). signature.key_id MUST be a DID URL under witness_id.

Implementations

impl LogCosignature

pub fn from_value(value: &Value) -> Result<LogCosignature, AcdpError>

RFC-ACDP-0015 §8 step 1 — schema-closed parse plus the §4/§5 semantic invariants: exact cosignature_version, a well-formed witness DID, a well-formed witnessed_checkpoint (log_id/root_hash shape, canonical millisecond timestamp byte form), the canonical millisecond witnessed_at byte form (both checked on the RAW wire strings before any parsing normalization), and the §8 step 3 witness binding — signature.key_id is a DID URL under witness_id.

pub fn witness_key_did(&self) -> Result<&str, AcdpError>

RFC-ACDP-0015 §8 step 3 — the witness DID that signature.key_id is a DID URL under, after checking that its DID portion equals witness_id and it carries a non-empty fragment.

pub fn checkpoint_tuple(&self) -> (&str, u64, &str)

The (log_id, tree_size, root_hash) tuple the N-witnessed count is computed over (RFC-ACDP-0015 §8). Two cosignatures count toward the same checkpoint iff this tuple is byte/numerically equal.

pub fn preimage_hash_of_value(value: &Value) -> Result<ContentHash, AcdpError>

Compute the cosignature hash from the RAW wire JSON (the value minus signature, JCS-canonicalized as received, SHA-256’d). Verifiers MUST hash the cosignature exactly as received — the same raw-JSON rule as crate::receipt::RegistryReceipt::preimage_hash_of_value.

pub fn preimage_hash(&self) -> Result<ContentHash, AcdpError>

Compute the cosignature hash from the struct. Used at MINT time (the struct’s serializer emits the canonical three-digit- millisecond timestamps); verifiers should prefer Self::preimage_hash_of_value over the raw wire JSON.

pub fn verify_signature_with_key( &self, witness_pub_ed25519: Option<&[u8; 32]>, witness_pub_p256_sec1: Option<&[u8]>, ) -> Result<(), AcdpError>

RFC-ACDP-0015 §8 step 2 — verify the witness signature against a known witness public key (pure — no DID resolution; the client feature’s verify_witness_cosignature_value resolves the witness DID and calls this).

pub fn verify_signature_against_hash( &self, hash: &ContentHash, witness_pub_ed25519: Option<&[u8; 32]>, witness_pub_p256_sec1: Option<&[u8]>, ) -> Result<(), AcdpError>

Like Self::verify_signature_with_key but over an already-computed cosignature hash — pair with Self::preimage_hash_of_value for raw-JSON verification.

pub fn cross_check_against_checkpoint( &self, checkpoint: &LogCheckpoint, ) -> Result<(), AcdpError>

RFC-ACDP-0015 §8 step 4 — checkpoint binding: the witnessed_checkpoint’s log_id, tree_size, and root_hash MUST equal, byte-for-byte / numerically, the corresponding fields of the checkpoint the consumer independently holds and verified (RFC-ACDP-0012 §9.3). A cosignature over a different tuple is evidence about a different checkpoint and MUST NOT be counted for this one. timestamp is deliberately not compared here — it is registry-asserted and the witness merely copies it (§4).

pub fn check_witnessed_at_skew( &self, now: DateTime<Utc>, max_clock_skew: TimeDelta, ) -> Result<(), AcdpError>

RFC-ACDP-0015 §8 step 5 — witnessed_at sanity against the consumer’s clock: millisecond-truncated (RFC-ACDP-0001 §5.3) and not in the future beyond max_clock_skew (RECOMMENDED 120 s, the RFC-ACDP-0011 §7 step 6 allowance). A future-dated witnessed_at is a forged observation-time claim.

This is the verification half only. Staleness (an old but honest witnessed_at) is consumer freshness policy (§8.1) — evaluate it separately via Self::age_at. For the anti-backdating use an old cosignature is stronger evidence.

pub fn age_at(&self, now: DateTime<Utc>) -> TimeDelta

The cosignature’s age at now — the input to the consumer’s §8.1 freshness policy (RECOMMENDED maximum: 300 seconds for current-ness-sensitive decisions). Negative when witnessed_at is ahead of now (bounded by the step-5 skew check).

Trait Implementations

impl Clone for LogCosignature

fn clone(&self) -> LogCosignature

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LogCosignature

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for LogCosignature

fn deserialize<__D>( __deserializer: __D, ) -> Result<LogCosignature, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for LogCosignature

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.