Struct FederationCredential 

pub struct FederationCredential {
    pub subject_agent_id: String,
    pub subject_pubkey: [u8; 32],
    pub issuer_id: String,
    pub trust_domain: String,
    pub not_before: i64,
    pub not_after: i64,
    pub cred_version: u16,
}

The signed claim set. These fields are what the CA attests to.

Fields

subject_agent_id: String

The node identity this credential vouches for (SPIFFE-style ids are legal — validate::validate_agent_id already permits the / : @ . characters).

subject_pubkey: [u8; 32]

The node’s Ed25519 verifying key (raw 32 bytes).

issuer_id: String

Identity of the CA / intermediate that issued this credential.

trust_domain: String

Namespacing for multi-tenant fleets — the trust domain the subject and issuer both belong to.

not_before: i64

Unix seconds; credential invalid before this instant.

not_after: i64

Unix seconds; credential invalid after this instant.

cred_version: u16

Format version. Equal to CRED_VERSION for credentials this binary mints.

Implementations

impl FederationCredential

pub fn canonical_claims_bytes(&self) -> Result<Vec<u8>, CredentialError>

Canonical CBOR of the claim set. Deterministic: a BTreeMap enforces lexicographic key order and ciborium emits definite-length, smallest-int encodings. Same convention as crate::identity::sign::canonical_cbor.

Errors

Returns CredentialError::Malformed only on an internal serialisation fault (not reachable with well-formed fields).

pub fn sign( &self, ca_signing_key: &SigningKey, ) -> Result<SignedCredential, CredentialError>

Sign this credential with the issuer’s CA signing key, producing a SignedCredential that carries the exact signed bytes.

Errors

Propagates CredentialError::Malformed from claim encoding.

pub fn subject_verifying_key(&self) -> Result<VerifyingKey, CredentialError>

The subject’s verifying key, decoded from subject_pubkey.

Errors

CredentialError::BadSubjectKey when the bytes are not a valid Edwards-curve point.

Trait Implementations

impl Clone for FederationCredential

fn clone(&self) -> FederationCredential

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FederationCredential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for FederationCredential

impl PartialEq for FederationCredential

fn eq(&self, other: &FederationCredential) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for FederationCredential