Module descriptor_trust 

Canonical two-layer root-attested ephemeral endpoint-descriptor contract.

The deployment descriptor root signs an attestation binding an ephemeral key. That ephemeral key signs its own SignedEndpointDescriptor (relay and direct addresses). Consumers MUST verify both layers and bind them; unsigned address hints are not part of this contract.

Modules

conformance

Fixed published vector both weft and heddle pin their tests to.

Structs

AttestedEndpointDescriptorEntry

One root-attested ephemeral key plus the descriptor that key signed.

EndpointDescriptorSetDocument

Published set of root-attested ephemeral endpoint descriptors.

VerifiedEndpoint

Endpoint that passed both attestation and descriptor-signature layers.

Enums

DescriptorSetError

Errors from parse_endpoint_descriptor_set.

EntryReject

Why a set entry was not promoted to VerifiedEndpoint.

Constants

ROOT_ATTESTATION_KIND

Canonical kind= label inside ephemeral_attestation_bytes.

ROOT_ATTESTATION_V1_DOMAIN

Domain separator for root-key attestations of ephemeral descriptor keys. Distinct from crate::signing::TRANSPORT_BOOTSTRAP_SIGNING_V1_DOMAIN so an endpoint-descriptor signature cannot verify as an attestation and vice versa.

SET_VERSION

Document version for EndpointDescriptorSetDocument.

Functions

ephemeral_attestation_bytes

Canonical bytes the deployment-descriptor root signs to attest an ephemeral key.

parse_endpoint_descriptor_set

Deserialize an EndpointDescriptorSetDocument and reject unknown versions.

trusted_live_entries

Verify every entry and drop rejects. Never returns a VerifiedEndpoint unless both layers verified and bound.

verify_ephemeral_attestation

Verify both trust layers of one attested entry and bind them.