Crate crypto 

Cryptographic signing for Heddle states and attestations, plus the versioned AEAD envelope used by confidential-runtime profiles (ADR 0051).

Modules

original_boundary_acceptance

Signature verification for explicit current acceptance of unchanged work. A verified signature is not current permission or historical authorization.

pop

Bearer-token proof-of-possession signing.

thread_authority_admission

Executor-signed testimony with one fixed canonical format, without API or storage dependencies. Neither a signature nor its carried key creates trust.

thread_genesis_admission

Executor-signed testimony with one fixed canonical format, without API or storage dependencies. Neither a signature nor its carried key creates trust.

thread_operation

Portable Thread operation signatures, independent of storage and transport. Verification proves the publisher and exact bytes. The receiving host must still authorize the Thread/facet and validate accepted causal parents.

thread_ownership_claim

Both parties sign the same canonical ownership statement. A courier signature is never substituted for either the current local owner or account acceptor.

thread_ownership_resolution

The immutable local owner chooses a surviving claim and the recipient independently accepts it with current account authority. Admission checks that authority and the complete stored conflict/frontier separately.

Structs

AeadCiphertext

Random-nonce AES-256-GCM ciphertext plus the pad bucket used.

Basis

Exact tree evaluated and how it relates to a merge target.

CheckDescriptor

Check identity, command, and resolved inputs.

CiVerdictBody

The complete conclusion-bearing content of a CI verdict.

Dek

32-byte data-encryption key. Zeroized on drop.

Ed25519Signer

Ed25519 signer.

Execution

Runner, timing, and attestation metadata.

FailureDetail

Failure details suitable for routing a repair attempt.

LogRef

Pointer to a finalized log blob.

Outcome

Terminal outcome of a check.

P256Signer

P-256 (ECDSA) signer.

Repro

Exact local reproduction recipe.

SignedVerdict

A rich CI verdict body plus its provenance-bound signature.

SoftwareRecipientSecret

Exportable X25519 recipient secret. Explicit weaker-custody fallback.

StateRef

Reference to the immutable source state described by the body.

WrappedDek

DEK wrapped to one X25519 recipient.

Enums

AeadError

BasisKind

Branch-versus-speculative-merge discriminator.

CheckClass

Whether a check gates a merge or only contributes advisory context.

Conclusion

Exhaustive terminal check conclusions.

FailureClass

Broad class of a check failure.

PemKind

The wire format inferred from a PEM blob’s BEGIN line, or Raw* when the input is just hex/base64 seed bytes with no PEM wrapper. Each variant maps to exactly one Signer constructor.

SignatureStatus

Signature verification result.

SignedVerdictError

Errors returned while creating or verifying a signed CI verdict.

SignerError

Error type for signer operations.

SignerKind

What kind of principal signed a verdict.

StateSignatureError

Error type for state signature operations.

Constants

AEAD_AES256_GCM_V1

Version tag stored with ciphertext so algorithms can rotate.

CI_VERDICT_BODY_SCHEMA_VERSION

Current canonical CiVerdictBody schema version.

CI_VERDICT_DOMAIN

NUL-terminated domain separator for the v2 CI-verdict signing scheme.

PAD_BUCKETS

Length-prefix + pad buckets. Ciphertext length otherwise tracks plaintext.

SIGNED_VERDICT_FORMAT_VERSION

Current serialized SignedVerdict format version.

WRAP_HKDF_INFO

Domain for HKDF used when wrapping a DEK to an X25519 recipient.

Traits

Signer

Trait for cryptographic signers.

Functions

ci_verdict_signing_payload

Build the canonical bytes signed by a SignedVerdict.

classify_pem

Classify a PEM/raw-key blob by its header (or shape, for unwrapped seed material). Pure function — no I/O, no allocation beyond what the input trim implies.

decrypt_padded

encrypt_padded

Encrypt plaintext under dek with a fresh random nonce. aad binds the ciphertext to a slot/profile so it cannot be replayed onto another record.

load_signer

Load a signer from a key file. When algorithm is None, the PEM header (or raw-seed shape) selects the backend via [pem_loader::load_signer_from_pem].

pad_bucket_for

Choose the pad bucket for a plaintext length (including the 4-byte prefix).

public_key_bytes

reject_group_or_world_readable_key

Reject a private-key file whose permissions expose it to group/world readers. The single source of the 0600-or-stricter rule: the key-file signer loader (load_signer) and the auto-signing identity loader (repo::identity) both call this so the threshold lives in one place. On unix, errors with SignerError::InsecureKeyPermissions when any of the group/world bits (0o077) are set; a no-op on platforms without a unix permission model. Propagates I/O errors (e.g. NotFound) from the stat.

signature_bytes

signed_verdict_from_signer

Sign a rich CI verdict with Heddle’s shared Signer spine.

state_signature_from_signer

unwrap_dek

verify_payload_signature

Verify a detached signature over an arbitrary payload. Used by non-state-signature flows (e.g. ReviewSignature) that already have a canonical byte payload built upstream.

verify_state_signature

Verify a state’s signature.

verify_state_signature_bytes

wrap_dek

Wrap dek to recipient_public with an ephemeral X25519 key. aad binds the wrap to its recipient/profile/slot/version so a wrap cannot be transplanted onto another record.