Struct DevSigner 

pub struct DevSigner { /* private fields */ }

A persistent ECDSA P-256 / cosign-scheme signer. Holds one key pair; the same key signs both a filter component and its SBOM, matching a TrustPolicy that trusts exactly that key.

Implementations

impl DevSigner

pub fn generate() -> Result<(DevSigner, Zeroizing<String>), DevKeyError>

Generate a fresh key pair. Returns the ready-to-use signer plus the PKCS8 PEM private key, so the caller decides whether to persist it (load_or_create) or sign once and drop it (an ephemeral self-signed conformance check, no file ever written).

pub fn from_private_key_pem(pem: &[u8]) -> Result<DevSigner, DevKeyError>

Rebuild from a previously persisted PKCS8 PEM private key. The elliptic curve is detected from the key’s own OID (sigstore-rs), so this works for any dev key this module has ever generated.

pub fn load_or_create(private_key_path: &Path) -> Result<DevSigner, DevKeyError>

Load the key at private_key_path, generating and persisting a fresh one on first use. The private key is written 0600 (owner read/write only); the matching public key is written alongside at <private_key_path>.pub, prefixed with DEV_KEY_MARKER. Does NOT touch .gitignore — that is the CLI caller’s job (it knows the project root; this function only knows the one key path it was given).

pub fn sign(&self, msg: &[u8]) -> Result<Vec<u8>, DevKeyError>

Raw DER ECDSA signature over msg (the shape SignedArtifact expects).

pub fn public_key_pem(&self) -> &str

pub fn trust_policy(&self) -> Result<TrustPolicy, DevKeyError>

A TrustPolicy that trusts exactly this signer’s key.