Struct TrustPolicy 

pub struct TrustPolicy { /* private fields */ }

The set of public keys the operator trusts to sign filters (ADR 000006 provenance). A filter loads only if a trusted key verifies BOTH its component signature and its SBOM signature (keyed cosign, offline — no Fulcio / Rekor / network). An empty policy trusts no one, so nothing loads: deny-by-default / fail-closed, with no “allow unsigned” escape hatch in the production API. The keys live on the Host, not on each load call, so the operator manages one trust root.

This gates whether a filter may load at all. It deliberately does NOT pick the filter’s Isolation (trusted/untrusted lifecycle) — a valid signature from a third party’s key is still untrusted code. Mapping signer identity to isolation is left to the declarative manifest (ADR 000007); here, isolation stays the caller’s explicit LoadOptions choice.

Implementations

impl TrustPolicy

pub fn from_pem_keys<I, B>(pems: I) -> Result<TrustPolicy, Error>

where I: IntoIterator<Item = B>, B: AsRef<[u8]>,

Trust the given public keys (SPKI PEM). The key type is auto-detected — cosign’s default is ECDSA P-256; P-256 / Ed25519 / RSA cosign keys are all accepted.

pub fn empty() -> TrustPolicy

An explicitly empty policy — trusts no one, so every load fails closed. Useful to assert the fail-closed default.

pub fn verify_artifact( &self, artifact: &SignedArtifact<'_>, ) -> Result<(), LoadError>

The whole ADR 000006 provenance gate over a resolved artifact — SBOM present, both signatures trusted, SBOM subject bound to THIS component — with no wasmtime involved. Host::load runs exactly this before ever compiling the bytes; plecto validate --resolve runs it standalone so CI can prove a manifest + layout pair would pass the load gate without starting a server (field report §3.5).