git_attest/lib.rs
1//! `git-attest`: the one implementation of the attestation format (SPEC.md,
2//! decisions ADR-0037). Producers and verifiers call this library; the
3//! `git-attest` binary is a thin command line over it.
4//!
5//! Each module owns one piece of the format and hides it:
6//!
7//! - [`format`]: the payload's fields, a note's blocks, the shared names;
8//! - [`spec`]: the `attest-inputs` declaration and the canonical opt-out;
9//! - [`fingerprint`]: input fingerprints, the canonical tree, their note keys;
10//! - [`sign`]: `ssh-keygen -Y`, for any namespace;
11//! - [`notes`]: the notes refs as origin's mirror, and publishing to them;
12//! - [`produce`]: what a producer signs for the gates that passed on a tree;
13//! - [`verify`]: what a valid attestation covers.
14//!
15//! Every entry point takes the repository it acts on as a path and never
16//! reads the process's working directory, and nothing here prints: callers
17//! render what the library returns.
18//!
19//! No dependencies, and that is load-bearing (see Cargo.toml).
20
21pub mod fingerprint;
22pub mod format;
23pub mod notes;
24pub mod produce;
25pub mod sign;
26pub mod spec;
27pub mod verify;
28
29mod git;
30
31#[cfg(test)]
32mod tests;