Module signing 

The one canonical form an entitlement is signed over, and the verify side.

Signing lives in monetize (it has the key); verifying lives here because a product must check a fact without linking the core (redb, vendors). Core depends on this crate for fact_message so there is exactly one canonical form.

Canonical JSON: the fact’s fields minus signature, objects with keys sorted bytewise, no whitespace. serde_json’s map is sorted by default but that is a cargo feature (preserve_order) any crate in the build could flip, so the sort is done here, explicitly, and does not depend on it.

Structs

GoAhead

The go-ahead a data-set growth is started on, as gunnar’s gunnar_server::grow::go_ahead::GoAhead parses it:

Snapshot

A signed set of facts, the file monetize hands a product so it can start (or restart) with the full picture before any push arrives.

Enums

SignatureError

Constants

GO_AHEAD_SIGNER_MONETIZE

The signer word a monetize-minted go-ahead carries.

Functions

base64_decode

The inverse; None on anything that is not padded standard base64.

base64_encode

Standard base64, padded — the alphabet GoAhead.signature is written in. Twenty lines here rather than a dependency the two crates that need it (this one and monetize) would otherwise add for one field.

canonical_json

Write value as canonical JSON: keys sorted, no whitespace.

fact_message

The V1 form: every field except signature, issued_unix_ms and issued_signature.

fact_message_issued

The V2 form: fact_message plus issued_unix_ms. What EntitlementFact::issued_signature covers, and the reason the issue time cannot be added, moved or bumped by anyone but monetize.

go_ahead_message

The bytes a go-ahead’s signature covers: every field except signature, canonical.

snapshot_message

The bytes a snapshot’s envelope signature covers. The facts inside keep their own signatures (they are part of the message), so a snapshot vouches for the set.

verify_fact

Both halves. The V1 signature always, and the V2 signature whenever the fact carries an issue time.

verify_go_ahead

Parse the bytes handed on the wire and verify the signature under key. Structure first (so a refusal names what is wrong), then the signature.

verify_snapshot

Envelope first, then every fact: one forged fact rejects the whole snapshot.