Struct SignatureVerifier 

pub struct SignatureVerifier { /* private fields */ }

Ed25519 signature verifier for plugin .wasm files.

Trust root format: a directory of *.pub files, each containing a base64-encoded 32-byte Ed25519 public key (one per trusted publisher). The .sig file format is base64 of the raw 64-byte Ed25519 signature over the .wasm bytes.

Wire shape is intentionally plain text + base64 — no PEM, no X.509, no JSON envelope — so operators can sign with openssl pkeyutl -sign or signify without bringing a CA story along.

Implementations

impl SignatureVerifier

pub fn from_trust_root(dir: &Path) -> Result<Self, PluginLoadError>

Build a verifier from a directory of *.pub files. Each file must contain exactly one base64-encoded 32-byte Ed25519 public key. Whitespace at the start / end is tolerated.

pub fn verify( &self, wasm: &[u8], sig_b64: &str, ) -> Result<&str, PluginLoadError>

Verify a signature blob (base64-encoded Ed25519 signature) against the .wasm bytes. Returns Ok with the matching label on success.

pub fn key_count(&self) -> usize

Number of trusted keys. Useful for diagnostics — a verifier with zero keys rejects every signature.

Trait Implementations

impl Debug for SignatureVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SignatureVerifier

fn default() -> SignatureVerifier

Returns the “default value” for a type.