Struct SignedAuditEvent 

pub struct SignedAuditEvent {
    pub event: AuditEvent,
    pub signature: Vec<u8>,
}

A signed audit event: an AuditEvent plus PQC signature bytes.

Produced by AuditEvent::sign. Verify with SignedAuditEvent::verify.

Examples

use okami::identity::AgentIdentity;
use okami::audit::{AuditEvent, SignedAuditEvent};

let identity = AgentIdentity::new("example.com", "agent/worker").unwrap();
let vk_bytes = identity.credential().verifying_key_bytes.clone();

let ev = AuditEvent::new(
    identity.spiffe_id().clone(),
    "key.rotated",
    serde_json::json!({}),
    None,
);
let signed: SignedAuditEvent = ev.sign(&identity).unwrap();

// Signature is valid with the correct key.
assert!(signed.verify(&vk_bytes).unwrap());

// Round-trip through bytes.
let bytes = signed.to_bytes().unwrap();
let signed2 = SignedAuditEvent::from_bytes(&bytes).unwrap();
assert!(signed2.verify(&vk_bytes).unwrap());

Fields

event: AuditEvent

The audit event payload.

signature: Vec<u8>

PQC signature over the bincode-serialized event bytes.

Implementations

impl SignedAuditEvent

pub fn verify(&self, verifying_key_bytes: &[u8]) -> Result<bool>

Verify the PQC signature on this event.

Serializes the event to bincode and verifies the signature against the provided verifying key.

Returns Ok(true) if the signature is valid, Ok(false) if not.

Errors

Returns Error::Serialization if the event cannot be re-serialized, or Error::Crypto if the verifying key is structurally invalid.

pub fn hash_hex(&self) -> Result<String>

Compute the SHA-256 hex digest of this signed event’s bincode bytes.

Pass the result as previous_event_hash to the next AuditEvent::new call to link the chain.

Errors

Returns Error::Serialization if serialization fails.

pub fn to_bytes(&self) -> Result<Vec<u8>>

Serialize to bytes (bincode).

Errors

Returns Error::Serialization if bincode encoding fails.

pub fn from_bytes(bytes: &[u8]) -> Result<Self>

Deserialize from bytes (bincode).

Enforces a MAX_SIGNED_AUDIT_EVENT_BYTES allocation cap to prevent DoS via crafted length-prefix fields. See /cso audit Finding #4 (fingerprint 30a553fc).

Errors

Returns Error::Serialization if the input exceeds MAX_SIGNED_AUDIT_EVENT_BYTES or if bincode decoding fails.

Trait Implementations

impl Clone for SignedAuditEvent

fn clone(&self) -> SignedAuditEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignedAuditEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SignedAuditEvent

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SignedAuditEvent

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.