Skip to main content

AttestationKeyLookup

cleanlib_client::attestation_verify

Trait AttestationKeyLookup 

Source 
pub trait AttestationKeyLookup: Send + Sync {
    // Required method
    fn lookup_pem<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<String, CleanLibraryError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait;
}
Expand description

Resolves an attestation’s key_id to a PEM-encoded P-256 public key.

Exists as a trait (rather than hardcoding the HTTP fetch inside verify_attestation) so:

  • tests / air-gapped verification can substitute a static in-memory lookup (see tests module below) without a network dependency, and
  • a future consumer with a different trust distribution mechanism (e.g. a pre-provisioned key bundle) can implement this trait instead of the default HTTP one, without verify_attestation itself changing.

Required Methods§

Source

fn lookup_pem<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<String, CleanLibraryError>> + Send + 'async_trait>>
where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Resolve key_id (the exact string carried on SignedAttestation.key_id — the full KMS key-version resource path, e.g. projects/.../cryptoKeys/cleanlib-cosign-staging/cryptoKeyVersions/1) to a PEM-encoded SubjectPublicKeyInfo. Implementations should treat a “no such key_id” answer as AttestationInvalid (permanent — retrying the same key_id against the same catalog will not help) and a network/5xx failure as Transport (transient — retry may succeed).

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§