Struct TrustPolicy 

pub struct TrustPolicy { /* private fields */ }

The set of public keys the operator trusts to sign filters (ADR 000006 provenance). A filter loads only if a trusted key verifies BOTH its component signature and its SBOM signature (keyed cosign, offline — no Fulcio / Rekor / network). An empty policy trusts no one, so nothing loads: deny-by-default / fail-closed, with no “allow unsigned” escape hatch in the production API. The keys live on the Host, not on each load call, so the operator manages one trust root.

This gates whether a filter may load at all. It deliberately does NOT pick the filter’s Isolation (trusted/untrusted lifecycle) — a valid signature from a third party’s key is still untrusted code. Mapping signer identity to isolation is left to the declarative manifest (ADR 000007); here, isolation stays the caller’s explicit LoadOptions choice.

Implementations

impl TrustPolicy

pub fn from_pem_keys<I, B>(pems: I) -> Result<TrustPolicy, Error>

where I: IntoIterator<Item = B>, B: AsRef<[u8]>,

Trust the given public keys (SPKI PEM). The key type is auto-detected — cosign’s default is ECDSA P-256; P-256 / Ed25519 / RSA cosign keys are all accepted.

pub fn empty() -> TrustPolicy

An explicitly empty policy — trusts no one, so every load fails closed. Useful to assert the fail-closed default.