Struct LocalKey 

pub struct LocalKey { /* private fields */ }

An ed25519 key held in this process.

What M3 runs on, and the reference implementation of Sign. The private bytes are zeroized on drop by ed25519-dalek, and neither Debug nor any accessor exposes them — a key that has been printed into a log is a key that has been published.

Example

use boundgraph_check::{LocalKey, Sign, sign_evidence, verify};
use boundgraph_core::{CheckerId, Digest, EvidenceKind, Verdict};

let key = LocalKey::from_seed("host-key-1", [7u8; 32]);

let evidence = sign_evidence(
    Verdict::Pass,
    CheckerId::new("json-schema", 1),
    [Digest::of(b"the payload that was checked")],
    EvidenceKind::Deterministic,
    &key,
)?;

// Anyone holding the public key can check it, with no runtime at all.
verify(&evidence, &key.public_key())?;

Implementations

impl LocalKey

pub fn from_seed(id: impl Into<String>, seed: [u8; 32]) -> Self

Build a key from a 32-byte seed.

Deterministic: the same seed always gives the same key. That is what makes a cassette test (US-1008) able to assert on exact signature bytes, and it is why this takes a seed rather than sampling one.

The seed is the private key. Treat it as such.

pub fn generate(id: impl Into<String>) -> Self

Build a key from freshly sampled entropy.

For a per-run key, which is one of the strategies docs/evidence-keys.md weighs. Not deterministic, and so not for use in a test that asserts on signature bytes.

pub fn public_key(&self) -> PublicKey

The public half, to be published so verdicts can be checked.

Trait Implementations

impl Debug for LocalKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Sign for LocalKey

fn key_id(&self) -> SigningKeyId

Which key this signs with.

fn sign(&self, payload: &[u8]) -> Result<Signature, SignError>

Sign a pre-image.