Crate git_attest 

git-attest: the one implementation of the attestation format (SPEC.md, decisions ADR-0037). Producers and verifiers call this library; the git-attest binary is a thin command line over it.

Each module owns one piece of the format and hides it:

• [format]: the payload’s fields, a note’s blocks, the shared names;
• spec: the attest-inputs declaration and the canonical opt-out;
• fingerprint: input fingerprints, the canonical tree, their note keys;
• sign: ssh-keygen -Y, for any namespace;
• notes: the notes refs as origin’s mirror, and publishing to them;
• produce: what a producer signs for the gates that passed on a tree;
• verify: what a valid attestation covers.

Every entry point takes the repository it acts on as a path and never reads the process’s working directory, and nothing here prints: callers render what the library returns.

No dependencies, and that is load-bearing (see Cargo.toml).

Modules

fingerprint

Fingerprints of a tree: a gate’s declared inputs, and the canonical tree (SPEC.md, “Input fingerprints”, “Canonical tree”), with the synthetic note keys they are filed under.

format

The attestation format: the payload’s fields, the note’s blocks, and the names every producer and verifier shares (SPEC.md, “The note”).

notes

The notes refs as origin’s mirror (SPEC.md, “Which refs are read”).

produce

What a producer signs: for some gates that passed on a tree, the payload and every key it is filed under (SPEC.md, “Producing”). amont at pre-push and git-attest sign in CI build their blocks here, so both sign the same bytes for the same tree.

sign

ssh-keygen -Y: the one place a signature is made or checked. The namespace is a parameter, so a provenance signature and an attestation can never be confused (SPEC.md, “amont-provenance-v1”).

spec

The attest-inputs declaration (SPEC.md, “Input fingerprints”) and the canonical-tree opt-out it governs (SPEC.md, “Canonical tree”).

verify

The verifier: given a repository and an allowed_signers, what does a valid attestation cover for the tree checked out there?