tzap-plugin-signing 0.1.4

Signing profiles for tzap RootAuth
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

# tzap-plugin-signing

`tzap-plugin-signing` adds RootAuth signing profiles for tzap archives. It is
the companion crate for applications that want signed v43 RootAuth archives on
top of the standalone `tzap-core` archive foundation.

The `ed25519_raw` profile implements the v43 optional Ed25519 RootAuth
authenticator (`authenticator_id = 0x0002`). The `x509_chain` profile adds an
OpenSSL-backed certificate verifier (`authenticator_id = 0x0003`) for leaf
certificates, optional intermediate chains, and trusted CA roots. Core provides
archive-root recomputation and verification gates; this crate provides the
signing profile logic.

## Install

```toml
[dependencies]
tzap-core = "0.1.5"
tzap-plugin-signing = "0.1.4"
```

## Architecture

`tzap-core` is the standalone archive foundation. Projects choose the compact
core surface for archive workflows, or add this companion crate for signed
RootAuth workflows and public no-key verification.

```text
tzap-core              archive format, RootAuth material, verifier gates
tzap-plugin-signing    Ed25519 and X.509 RootAuth profiles
tzap CLI               composes core plus signing plugin
```

Certificate profiles live in this crate as additional modules while keeping core
independent.

## Example

```rust
use ed25519_dalek::SigningKey;
use tzap_core::RootAuthSigningRequest;
use tzap_plugin_signing::ed25519_raw;

let signing_key = SigningKey::from_bytes(&[7; 32]);
let request = RootAuthSigningRequest {
    archive_uuid: [1; 16],
    session_id: [2; 16],
    archive_root: [3; 32],
};

let authenticator_value =
    ed25519_raw::authenticator_value_for_request(&signing_key, &request);

assert_eq!(
    authenticator_value.len(),
    ed25519_raw::ED25519_AUTHENTICATOR_VALUE_LEN as usize
);
```

## Ed25519 Raw Profile

The `ed25519_raw` module provides:

- `ED25519_AUTHENTICATOR_ID = 0x0002`
- `ED25519_AUTHENTICATOR_VALUE_LEN = 68`
- `authenticator_value_for_request` for core writer callbacks
- `verify_root_auth_footer` for core verifier callbacks
- distinct outcome types for profile data quality, reserved identity classes,
  self-signed consistency, key-holding RootAuth verification, and public no-key
  commitment verification

## X.509 Chain Profile

The `x509_chain` module provides:

- `X509_AUTHENTICATOR_ID = 0x0003`
- `X509_SIGNER_IDENTITY_TYPE_DER_CERT = 2`
- `X509RootAuthSigner` for core writer callbacks
- `verify_root_auth_footer` for core verifier callbacks
- reports with signer subject, issuer, serial number, certificate SHA-256,
  signer-claimed signing time, verified chain subjects, and trust anchor subject

## More Information

- Repository: <https://github.com/frankmanzhu/tzap>
- Core crate: <https://crates.io/crates/tzap-core>
- CLI crate: <https://crates.io/crates/tzap>
- Format specification: <https://github.com/frankmanzhu/tzap/blob/main/specs/tzap-format-revisedv43.md>