Crate lys_core 

lys-core — domain-agnostic cryptographic trust primitives.

A focused library of trust primitives: certificate authority operations, Merkle transparency-log operations, signed attestations, sealed payload transport, and Ed25519 key management. Consumers compose domain meaning on top — this crate knows nothing about any higher-level concepts.

The foundation laid here is TrustError, TrustResult, and Ed25519Identity. The ca, merkle, attestation, [receipt], [bundle], seal, checkpoint, and tlog modules are implemented on top of these primitives.

use lys_core::TrustResult;

fn fallible_op() -> TrustResult<()> {
    Ok(())
}

assert!(fallible_op().is_ok());

Re-exports

pub use error::TrustError;

pub use error::TrustResult;

pub use keys::Ed25519Identity;

Modules

attestation

Signed attestations: the lys/attestation/v2 tagged COSE_Sign1 artifact (RFC 9052) binding a payload’s SHA-256 hash and a unix-millisecond timestamp to an Ed25519 signer key.

ca

Certificate authority operations: Ed25519-rooted X.509 issuance, proof of possession for holder-controlled subject keys, custom extension transport, and chain verification.

checkpoint

C2SP tlog-checkpoint bodies and the signed-note envelope (the lys D1 wire contract), byte-for-byte compatible with the Go sumdb/note reference implementation.

error

TrustError and the crate-wide TrustResult alias.

keys

Ed25519 key management and the Ed25519-to-X25519 derivation used by sealed payload transport.

merkle

Append-only Merkle transparency-log operations.

seal

Sealed payload transport: X25519 key agreement plus AES-256-GCM encryption.

tlog

Self-contained transparency-log proof artifacts (the lys D2 wire contract): JSON objects carrying an RFC 6962 proof plus the relevant signed checkpoint(s) embedded verbatim.