pub struct KeyBinding {
pub algorithm: String,
pub public_key: String,
pub identity_ref: String,
pub role: KeyRole,
pub added_by_sig: StateSignature,
pub valid_from: DateTime<Utc>,
pub revoked_at: Option<DateTime<Utc>>,
pub delegated_from: Option<ContentHash>,
}Expand description
A signing key’s role within an identity’s provenance chain.
Fields§
§algorithm: StringSignature algorithm used by the bound key.
public_key: StringHex-encoded raw public key bytes.
identity_ref: StringDurable identity subject resolved by this key.
role: KeyRoleRepository capability granted to this key.
added_by_sig: StateSignatureIdentity-key signature authorizing this binding.
valid_from: DateTime<Utc>First instant at which this binding may authenticate authored objects.
revoked_at: Option<DateTime<Utc>>First instant at which this binding no longer authenticates new objects.
delegated_from: Option<ContentHash>Content hash of the identity-owned root binding that authorized this key. Only one delegation hop is permitted by repository verification.
Implementations§
Source§impl KeyBinding
impl KeyBinding
Sourcepub fn canonical_signing_payload(&self) -> Vec<u8> ⓘ
pub fn canonical_signing_payload(&self) -> Vec<u8> ⓘ
Deterministic bytes covered by Self::added_by_sig.
Sourcepub fn content_hash(&self) -> Result<ContentHash, KeyBindingError>
pub fn content_hash(&self) -> Result<ContentHash, KeyBindingError>
Stable address of this signed binding.
Sourcepub fn validate(&self) -> Result<(), KeyBindingError>
pub fn validate(&self) -> Result<(), KeyBindingError>
Validate the durable shape. Cryptographic authorization is checked by the repository resolver, which has access to the signing backends.