Crate ans_verify 

ANS Trust Verification Library

This library implements the ANS (Agent Name Service) Trust Verification Flow, providing tools for verifying agent identity and trust status.

Overview

The ANS architecture uses a dual-certificate model:

• Public Server Certificate: Issued by a public CA (e.g., Let’s Encrypt)
• Private Identity Certificate: Issued by the ANS Private CA

Verification relies on:

• DNS _ans-badge TXT records pointing to the transparency log (with _ra-badge fallback)
• Transparency Log API returning badges with status and certificate fingerprints
• Certificate fingerprint comparison
• Optional DANE/TLSA verification for additional DNS-based certificate binding

Quick Start

use ans_verify::{AnsVerifier, VerificationOutcome, CertIdentity};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let verifier = AnsVerifier::new().await?;

    // After TLS handshake, extract server certificate and verify
    let cert_der: &[u8] = &[]; // Your certificate bytes
    let cert_identity = CertIdentity::from_der(cert_der)?;

    let outcome = verifier
        .verify_server("agent.example.com", &cert_identity)
        .await;

    match outcome {
        VerificationOutcome::Verified { badge, .. } => {
            println!("Verified ANS agent: {}", badge.agent_name());
        }
        VerificationOutcome::NotAnsAgent { fqdn } => {
            println!("Not a registered ANS agent: {}", fqdn);
        }
        _ => println!("Verification failed"),
    }

    Ok(())
}

Features

• DNS-based badge discovery via _ans-badge TXT records (with _ra-badge fallback)
• Transparency Log API integration for badge retrieval
• Certificate fingerprint verification (SHA-256)
• Optional DANE/TLSA verification with configurable policies
• DNSSEC validation support
• Configurable DNS resolvers (System, Cloudflare, Google, Quad9)
• Response caching with configurable TTL
• Async-first design with tokio
• Optional rustls integration for TLS handshake verification

Structs

AgentEvent

Agent event containing all registration/verification details.

AgentInfo

Basic agent information.

AnsName

An ANS Name URI (e.g., ans://v1.0.0.agent.example.com).

AnsVerifier

High-level ANS verifier combining server and client verification.

AnsVerifierBuilder

Builder for AnsVerifier.

Attestations

Certificate attestations.

AuditResponse

Audit response from the transparency log.

Badge

Full badge response from the Transparency Log API.

BadgeCache

Badge cache with TTL support.

BadgePayload

Badge payload containing the producer and signed event.

BadgeRecord

Parsed badge TXT record from _ans-badge or _ra-badge DNS records.

CacheConfig

Cache configuration.

CachedBadge

Cached badge entry with metadata.

CertAttestation

Certificate attestation with fingerprint and type.

CertFingerprint

SHA-256 certificate fingerprint in SHA256:<hex> format.

CertIdentity

Extracted identity information from a certificate.

ClientVerifier

Client verifier for servers verifying mTLS agent clients.

Fqdn

A Fully Qualified Domain Name (FQDN).

HickoryDnsResolver

DNS resolver implementation using hickory-resolver.

HttpError

HTTP transport error wrapper.

HttpTransparencyLogClient

HTTP-based Transparency Log client.

MerkleProof

Merkle proof for transparency log inclusion verification.

Producer

Producer information with the agent event and signature.

ServerVerifier

Server verifier for clients verifying agent servers.

TlsaRecord

A parsed TLSA record.

Version

A semantic version (e.g., v1.0.0).

Enums

AnsError

Top-level error type for ANS operations.

BadgeStatus

Badge status values.

CacheKey

Cache key for badge lookups.

CryptoError

Certificate and cryptographic errors.

DaneError

DANE/TLSA verification errors.

DanePolicy

DANE verification policy.

DaneVerificationResult

Result of DANE verification.

DnsError

DNS-specific errors.

DnsResolverConfig

Well-known DNS resolver configurations.

EventType

Event types for badge events.

FailurePolicy

Failure handling policy.

ParseError

Parse errors for various types.

TlogError

Transparency log API errors.

TlsaMatchingType

TLSA matching type field values (RFC 6698).

TlsaSelector

TLSA selector field values (RFC 6698).

TlsaUsage

TLSA certificate usage field values (RFC 6698).

VerificationError

Verification logic errors.

VerificationOutcome

Result of a verification operation.

Traits

DnsResolver

DNS resolver trait for looking up badge records and TLSA records.

TransparencyLogClient

Transparency Log API client trait.

Type Aliases

AnsResult

Result type alias using AnsError.