Struct PemSigner 

pub struct PemSigner { /* private fields */ }

The neutral signing core: one ECDSA P-256 / cosign-scheme key pair, no persistence, no dev-key marker, no opinion about where the key came from. plecto package uses it with an operator’s production key (field report §3.1); DevSigner wraps it with the dev-key file conventions. Signing here is a plain function of (key, bytes) — a future KMS / pre-computed-signature path replaces this struct at its call sites, nothing else.

Implementations

impl PemSigner

pub fn from_private_key_pem(pem: &[u8]) -> Result<PemSigner, DevKeyError>

Load a PKCS8 PEM private key. The elliptic curve is detected from the key’s own OID (sigstore-rs), so any ECDSA key of the cosign scheme works.

pub fn sign(&self, msg: &[u8]) -> Result<Vec<u8>, DevKeyError>

Raw DER ECDSA signature over msg (the shape SignedArtifact expects).

pub fn public_key_pem(&self) -> &str