Module pins 

Trust-on-first-use pinning of a vault’s signer registry.

The signer registry (Meta::signers, pubkey → Ed25519 verifying key) lives in the encrypted meta blob, which anyone can re-encrypt using the public recipient keys. So on its own it’s attacker-mutable: a repo-writer could register their own verifying key under an existing recipient’s pubkey and sign with their own key, forging that recipient’s signature.

This pin closes that. For a native age key the mapping pubkey → verifying key is a fixed derivation (see crate::signing), so a given pubkey must always carry the same verifying key. We record the mapping locally on first sight and flag any later change for an existing pubkey — which is never legitimate and indicates the registry was tampered with. New pubkeys are trust-on-first- use (like GitHub key pinning): recorded, not rejected.

The pin is local state under ~/.config/murk/signer-pins/; it does not travel with the repo. It is best-effort — a missing home dir or unreadable pin never blocks a load, it just skips the check.

Enums

PinVerdict

Result of reconciling a vault’s current signer registry against the local pin.

Functions

reconcile

Reconcile the vault’s current signer registry against the local pin.

signer_pin_available

Whether signer pinning can actually anchor a signature on this machine — false when opted out (MURK_NO_SIGNER_PIN) or when there is no home dir to store the pin. When false, a present signature is trust-only, never anchored, so callers can surface the blind spot rather than letting it pass silently.