vgi-core

Shared primitives for Verifiable Git Infrastructure (VGI) — the dependency-light building blocks that both the signer (did-git-sign) and the CI verifier (verify-trust) rely on, kept in one crate so their wire formats cannot drift.

• create_ssh_signature — the PROTOCOL.sshsig encoder for Ed25519 keys (and GIT_SSHSIG_NAMESPACE, the namespace git uses for commit signatures).
• split_signed_commit / normalize_sshsig_armor — reconstruct the exact bytes git signed from a raw commit object, and re-wrap sshsig armor to the 70-column width strict PEM parsers require.
• committer_did / committer_identity — read the signer DID a commit claims on its committer header. A claim, not a fact: safe only as a lookup hint whose answer the caller then checks against the signature.
• ed25519_keys_from_doc — extract Ed25519 verification keys from a DID document (publicKeyMultibase, multicodec 0xED01).

Nothing here touches the network, a keyring, or a VTA — that is what lets the CI verifier stay small.

This is a support crate for the VGI tools; most users want verify-trust (CI) or did-git-sign (signing) rather than depending on vgi-core directly.

License

Apache-2.0.