mkit-attest 0.4.2

DSSE + in-toto v1 attestations for mkit, with multi-algorithm signers (Ed25519, secp256k1, P-256) and an RFC 8785 JCS encoder
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

//! Sigstore signer — scaffold only.
//!
//! Will eventually wrap Fulcio OIDC + Rekor. Tracked in
//! `docs/specs/SPEC-ATTESTATIONS.md` §6.2. The scaffold exists so a signer
//! router can dispatch on signer kind and get a concrete
//! `Error::SigstoreNotImplemented` back instead of a compile-time
//! branch.

use crate::Error;
use crate::algorithm::Algorithm;
use crate::signer::Signer;

#[derive(Debug, Default)]
pub struct SigstoreSigner;

impl SigstoreSigner {
    #[must_use]
    pub fn new() -> Self {
        Self
    }
}

impl Signer for SigstoreSigner {
    fn algorithm(&self) -> Algorithm {
        // Sigstore Fulcio issues P-256 certificates by default; record
        // that even though `sign` is still a scaffold.
        Algorithm::P256
    }
    fn keyid(&self) -> Result<String, Error> {
        Err(Error::SigstoreNotImplemented)
    }
    fn sign(&mut self, _pae: &[u8]) -> Result<Vec<u8>, Error> {
        Err(Error::SigstoreNotImplemented)
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn both_methods_return_not_implemented() {
        let mut s = SigstoreSigner::new();
        assert!(matches!(s.keyid(), Err(Error::SigstoreNotImplemented)));
        assert!(matches!(s.sign(b"pae"), Err(Error::SigstoreNotImplemented)));
    }
}