Struct CertChain 

pub struct CertChain {
    pub agent_pubkey: [u8; 32],
    pub metadata: AgentMetadata,
    pub issuer: Issuer,
    pub issuer_sig: SerdeSig,
}

The proof that this agent serves a specific user — directly (root) or through a chain of attenuating delegations.

Fields

agent_pubkey: [u8; 32]

metadata: AgentMetadata

issuer: Issuer

Who signed this cert: the root user, or a parent agent + its cert.

issuer_sig: SerdeSig

The issuer’s signature over (agent_pubkey || metadata_bytes).

Implementations

impl CertChain

pub fn verify(&self) -> Result<()>

Verify the cert chain end to end.

• Root (Issuer::User): the user’s key must have signed (agent_pubkey || metadata_bytes).
• Delegated (Issuer::Agent): the named parent pubkey must match the embedded parent cert, that parent cert must itself verify (rooting at a user), the parent agent’s key must have signed this cert, and this cert’s caveats must be ⊑ the parent’s (MeshError::CaveatAmplification otherwise). Attenuation is thus enforced structurally at every link — a forged or tampered chain that amplifies authority is rejected even if each signature is valid.

pub fn verify_at(&self, current_generation: u64) -> Result<()>

Verify the cert chain against a known current generation (causal, not wall-clock — §9.1). In addition to signature + attenuation at every link, each link’s valid_for_generation must include current_generation, else the chain is refused (MeshError::Generation). This is the authoritative revocation axis: bumping the generation invalidates every cert scoped to an earlier one, pull-based and without any wall-clock.

pub fn agent_fingerprint(&self) -> Fingerprint

Fingerprint of the agent’s public key.

pub fn user_fingerprint(&self) -> Fingerprint

Fingerprint of the root user this cert chains up to (walking through any delegations). Unchanged for root certs.

pub fn root_user_pubkey(&self) -> UserPublic

The root user’s public key this cert chains up to.

Trait Implementations

impl Clone for CertChain

fn clone(&self) -> CertChain

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CertChain

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CertChain

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for CertChain

impl PartialEq for CertChain

fn eq(&self, other: &CertChain) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for CertChain

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CertChain