greentic_operator_trust/
lib.rs

1//! Operator signing-key management and trust-root document semantics.
2//!
3//! Extracted from `greentic-deployer` (PR-4.2e of
4//! `plans/next-gen-deployment.md`) so the `greentic-operator-store-server`
5//! can drive the SAME key handling and trust-root validation the local
6//! file-backed store uses — the trust-domain analogue of the
7//! `greentic_deploy_spec::engine` rule that one derivation serves every
8//! backend.
9//!
10//! - [`operator_key`] — hardened load/generate of the operator's Ed25519
11//!   keypair (the key that signs revenue-policy DSSE envelopes and, later,
12//!   revision manifests).
13//! - [`trust_root`] — the `greentic.trust-root.v1` document envelope and
14//!   the pure validate/add/remove transforms; persistence (file or SQL)
15//!   stays with the caller.
16//! - [`revenue_policy`] — the pure builder for signed, versioned
17//!   revenue-policy artifacts (B10): document bytes + DSSE sidecar bytes +
18//!   canonical refs; storage (file or SQL) stays with the caller.
19//!
20//! Verifier types ([`TrustRoot`](greentic_distributor_client::signing::TrustRoot),
21//! [`TrustedKey`](greentic_distributor_client::signing::TrustedKey)) and the
22//! canonical key-id derivation come from
23//! [`greentic_distributor_client::signing`]; this crate deliberately adds no
24//! second derivation path.
25
26pub mod operator_key;
27pub mod revenue_policy;
28#[cfg(any(test, feature = "test-utils"))]
29pub mod test_support;
30pub mod trust_root;
greentic_operator_trust/lib.rs

greentic_operator_trust/
lib.rs
