Crate lys_core 

lys-core — domain-agnostic cryptographic trust primitives.

A focused library of trust primitives: certificate authority operations, Merkle transparency-log operations, signed attestations, sealed payload transport, and Ed25519 key management. Consumers compose domain meaning on top — this crate knows nothing about any higher-level concepts.

The foundation laid here is TrustError, TrustResult, and Ed25519Identity. The ca, merkle, attestation, receipt, bundle, delegation, seal, checkpoint, and tlog modules are implemented on top of these primitives. (receipt, bundle and delegation are named without intra-doc links because they exist only under unstable-anchor; a link from ungated docs to a gated item resolves under --all-features and breaks in the default doc build, which is the shape consumers get.)

use lys_core::TrustResult;

fn fallible_op() -> TrustResult<()> {
    Ok(())
}

assert!(fallible_op().is_ok());

Re-exports

pub use error::TrustError;

pub use error::TrustResult;

pub use keys::Ed25519Identity;

Modules

attestation

Signed attestations: the lys/attestation/v2 tagged COSE_Sign1 artifact (RFC 9052) binding a payload’s SHA-256 hash and a unix-millisecond timestamp to an Ed25519 signer key.

ca

Certificate authority operations: Ed25519-rooted X.509 issuance, proof of possession for holder-controlled subject keys, custom extension transport, and chain verification.

checkpoint

C2SP tlog-checkpoint bodies and the signed-note envelope (the lys D1 wire contract), byte-for-byte compatible with the Go sumdb/note reference implementation.

clock

Instance-owned UTC time for creation and expiry decisions.

error

TrustError and the crate-wide TrustResult alias.

keys

Ed25519 key management and the Ed25519-to-X25519 derivation used by sealed payload transport.

merkle

Append-only Merkle transparency-log operations.

pairing_words

The words a pairing code is made of (AGENTS-020 R1): two hundred and fifty-six common, short English words, no two of which sound alike, so a person can read four of them aloud over a phone and the one listening writes down the same four. Each byte of a code picks one word, so four bytes from the operating system make one code.

seal

Sealed payload transport: X25519 key agreement plus AES-256-GCM encryption.

seat_file

The seat file: one JSON file, mode 0600, that holds an agent’s private key where the agent runs, with what certifies it (AGENTS-017 R5).

tlog

Self-contained transparency-log proof artifacts (the lys D2 wire contract): JSON objects carrying an RFC 6962 proof plus the relevant signed checkpoint(s) embedded verbatim.