Module verify 

Manifest signature verification against the PulseEngine trust root (REQ-VERIFY-001, DD-003).

Layer manifests travel as DSSE envelopes (payload = the OCI image index JSON), signed with the PulseEngine root ed25519 key via sigil’s wsc library. The envelope authenticates both the payload bytes and the payload type (DSSE PAE), so a signed something-else cannot be replayed as a layer manifest.

The verifier holds the trust root; sources cannot see it, supply it, or relax it. Keyless/Fulcio verification via sigil’s airgapped module is the intended future — blocked on sigil#219 — and slots in behind the same crate::install::ManifestVerifier trait when it lands.

Structs

PinnedKeyVerifier

Verifies layer-manifest envelopes against a pinned ed25519 root public key (32 raw bytes).

Constants

LAYER_PAYLOAD_TYPE

The authenticated payload type for a layer manifest envelope.

Functions

dsse_sign_typed

Sign a payload of a given type into a DSSE envelope (JSON) — the producing half, shared by deposit, line-status and release-sums signing so the two sides can never drift apart.

dsse_verify_typed

Verify a DSSE envelope of a specific payload type against a pinned root public key, returning the authenticated payload. The one verification path shared by layer manifests, line-status documents (DD-008) and release sums (DD-009) — different payload types, one trust root, so the type check is what keeps signed documents from posing as each other.

generate_root_keypair

Generate an ed25519 root keypair: (secret 64 bytes, public 32 bytes). Test and provisioning helper — real roots are generated in a key ceremony, not on a build machine.

sign_layer_manifest

Sign layer-manifest payload bytes into a DSSE envelope (JSON).