Module operator_key 

Operator-key load/generate (C2 of plans/next-gen-deployment.md).

Provides the Ed25519 keypair the operator uses to sign artifacts it owns (today: B10 revenue-policy DSSE; future: revision manifests, audit-log tips). Key material lives on the operator’s filesystem and is created on first use; rotation is out of scope for C2 v1 — that’s the Trust plan.

Key location

The path is resolved in this order:

1. $GTC_OPERATOR_KEY_PATH if set (caller wants a non-default location, e.g. a vault-mounted tmpfs path or a CI fixture).
2. ~/.greentic/operator/key.pem on POSIX/Windows.
3. Error — no home directory and no env override.

Companion file: <key.pem>.pub (SPKI PEM). It is derived from the private key, written next to it on generation, and cross-checked on subsequent loads — if a .pub exists but does not match the canonical id derived from the private key, the load fails. A stale .pub from a prior .pem always indicates operator-side tampering or a partial rotation; deriving silently from the private key would mask it.

File modes

On POSIX, the private key is written with mode 0600 and the public key with mode 0644. On platforms without std::os::unix::fs, the permissions fall through to the OS default.

Structs

OperatorKey

The operator’s signing key + its derived id, ready for DSSE signing.

Enums

OperatorKeyError

Constants

OPERATOR_KEY_PATH_ENV

Override for the operator key path. When set, takes precedence over the ~/.greentic/operator/key.pem default.

Functions

load_existing_only

Load an existing operator key, failing with NotFound if no key file is present. Does not generate. Use this from CLI verbs that should refuse to act on an unbootstrapped operator (e.g. bundles add/update — generating a throwaway key as a side-effect of a bundles add that then fails the trust-root precondition is confusing and leaves unexpected state on disk).

load_or_generate

Load the operator key from the resolved path, generating a fresh keypair if the file does not yet exist.

load_or_generate_at

Like load_or_generate but with an explicit path (tests + callers that already resolved the path themselves).

read_signing_key_at

Read an existing signing key at an explicit path (e.g. --signing-key) with the same hardening as load_existing_only: symlink-ancestor gate, O_NOFOLLOW open, regular-file + mode (0600) checks, and a pre-sized Zeroizing read. Returns (private_pem, key_id). Unlike load_existing, it writes NO .pub sibling — the path is caller-supplied, so regenerating a public file next to it would litter unexpected state. The mode/symlink enforcement is Unix-only (a no-op on other platforms, matching read_existing_securely).

resolve_path

Resolve the path the operator key should live at without touching disk.