Module binding 

A pass’s grant binding (DIRECTORY-089 R2): the signed statement, separate from the pass, of the grant log, the revision and the complete ancestry each of the pass’s rights was decided from.

The binding is its own compact JWS, typed BINDING_TYPE, signed by the same issuer key as the pass and published beside it in the token answer only when the product asks for it. The pass’s bytes are never changed: the binding names the pass by the SHA-256 of its exact compact bytes, its issuer, holder, audience and lifetime, so it cannot be moved to another pass. A product maps each right to its dependency, keys its cache by (grant log, grant id), and admits only once its grant stream stands at BindingClaims::revision or later. A revocation names one grant; its descendants are resolved here, from the paths.

A product that requires bindings refuses a pass without one by BINDING_REQUIRED and never assumes a revision of zero; a product that does not ask keeps verifying passes exactly as before.

Structs

BindingClaims

A binding’s signed claims.

Bound

What a binding must name of its pass: the pass’s digest, issuer, holder, audience and lifetime, and exactly the grants its rights rest on.

Dependency

One right’s grant and its complete ancestry.

VerifiedBinding

A binding whose signature, pass, issuer, holder, audience, lifetime, grant log and ancestry were checked against one verified pass.

Constants

BINDING_ANCESTRY

A dependency’s ancestry is missing, repeated or not the pass’s rights.

BINDING_LOG_MISMATCH

The binding names another grant log or reset epoch.

BINDING_MISMATCH

The binding names another pass, issuer, holder, audience or lifetime.

BINDING_REQUEST

The token request form value asking for a binding of this version.

BINDING_REQUIRED

A binding is required and absent.

BINDING_TYPE

The JWS typ a binding is signed under, never a pass’s JWT.

BINDING_UNSUPPORTED

The binding is of a version this crate does not read.

BINDING_VERSION

The binding version this crate reads and the issuer produces.

Functions

pass_digest

The SHA-256, lowercase hex, of a pass’s exact compact bytes.

required

The binding a revocation-enabled product requires, or its absence by name.