apohara_sealchain_core/
lib.rs

1//! apohara-sealchain-core — the `apohara-seal-v1` receipt engine.
2//!
3//! Native Rust reimplementation of the Python `core/seal` reference. This
4//! crate is **sync**; network-backed layers (TSA, Rekor) own a private
5//! runtime internally so the public API stays runtime-agnostic.
6//!
7//! Where the Python reference is internally inconsistent (the C2PA hash
8//! input and the Rekor signed-checkpoint verification), this crate defines
9//! the canonical behavior and documents the divergence.
10
11/// The seal method identifier for the v1 (a.k.a. v4 / apohara) schema.
12pub const METHOD_V1: &str = "apohara-seal-v1";
13
14pub mod artifact;
15/// Transparency dashboard: render a self-contained, offline HTML report from a
16/// set of receipts. Native-only (it reuses the native verify path + policy).
17#[cfg(feature = "native")]
18pub mod dashboard;
19pub mod error;
20pub mod excluded;
21/// Local receipt index (sqlite). Native-only convenience/discovery layer —
22/// rebuildable from receipts, never a source of truth.
23#[cfg(feature = "native")]
24pub mod index;
25pub mod jcs;
26#[cfg(feature = "native")]
27pub mod keystore;
28pub mod layers;
29/// Attestation policy engine: evaluate a receipt against required layers, a
30/// minimum layer count, qualified-TSA, and a maximum age. Native-only — the wasm
31/// verify-only build does not enforce policies.
32#[cfg(feature = "native")]
33pub mod policy;
34/// in-toto/SLSA-style provenance predicate for sealed artifacts. Pure
35/// `serde_json` mapping, available in both the native and wasm verify-only
36/// builds (it never touches the network or filesystem).
37pub mod provenance;
38pub mod schema;
39pub mod seal;
40/// Canonical machine-readable Trust Profile (named profiles + proof matrix +
41/// qualified-TSA allowlist). Pure serde over an embedded constant, so it is
42/// available in both the native and wasm verify-only builds.
43pub mod trust_profile;
44pub mod verify;
45
46// Always available (native + wasm verify-only): the per-layer verify types and
47// the in-memory verify entry point used by the browser verifier.
48pub use artifact::{render_chain, verify_artifact_bytes, LayerResult};
49// Native-only: filesystem seal/verify orchestration and the receipt-path helper.
50#[cfg(feature = "native")]
51pub use artifact::{default_receipt_path, seal_artifact, verify_artifact};
52#[cfg(feature = "native")]
53pub use dashboard::{
54    generated_at_now, render_html as render_dashboard, DashboardEntry, VerifyStatus,
55};
56pub use error::SealError;
57pub use excluded::strip_excluded;
58#[cfg(feature = "native")]
59pub use index::{
60    index_find, index_insert, index_list, present_layers, rebuild as index_rebuild, scan_receipts,
61    IndexRecord,
62};
63pub use jcs::canonicalize;
64#[cfg(feature = "native")]
65pub use keystore::{
66    decrypt_keystore, encrypt_keystore, from_overrides, info as keystore_info, load_or_generate,
67    load_or_generate_with_passphrase, rotate as rotate_keystore, ArchivedKey, Keys, KeystoreInfo,
68};
69#[cfg(feature = "native")]
70pub use layers::rekor::{
71    check_shard_active, classify_shard, load_shards as load_rekor_shards,
72    resolve_shard as resolve_rekor_shard, submit as submit_rekor_anchor,
73    verify_anchor as verify_rekor_anchor, RekorAnchor, ShardActiveness, ShardKey,
74    DEFAULT_REKOR_V2_URL,
75};
76#[cfg(feature = "native")]
77pub use layers::tsa::{
78    request_token as request_tsa_token, verify_token as verify_tsa_token, TsaToken, DEFAULT_TSA_URL,
79};
80#[cfg(feature = "native")]
81pub use policy::{
82    evaluate as evaluate_policy, evaluate_now as evaluate_policy_now, Policy, PolicyReport,
83};
84pub use provenance::{
85    model_signing_statement, provenance_statement, MODEL_SIGNING_PREDICATE_TYPE_V1,
86    PREDICATE_TYPE_V1, STATEMENT_TYPE_V1,
87};
88pub use schema::{detect_schema, SchemaVersion, SealBlock, SealedRecord};
89pub use seal::{build_preimage, seal_deterministic};
90pub use trust_profile::{
91    known_qualified_tsa_hosts, named_profile, profile_names, trust_profile, MatrixRow,
92    NamedProfile, TrustProfile,
93};
94pub use verify::verify;
apohara_sealchain_core/lib.rs

apohara_sealchain_core/
lib.rs
