Module sign 

Cryptographic signing for finding bundles — the trust infrastructure layer.

Every finding event can be signed with Ed25519 and verified independently. Signatures cover the canonical JSON of the finding (deterministic, sorted keys).

Structs

ActorRecord

Phase M (v0.4): registered actor identity. Maps a stable actor.id to an Ed25519 public key, established at a specific timestamp.

SignedEnvelope

A signed envelope wrapping a finding’s cryptographic signature.

VerifyReport

Result of verifying all signatures in a frontier.

Functions

actor_can_auto_apply

Phase α (v0.6): authorization predicate for one-call auto-apply.

canonical_json

Produce deterministic canonical JSON for a finding bundle. Uses sorted keys (via serde_json::Value -> BTreeMap conversion) and compact format.

event_signing_bytes

Compute the canonical signing bytes for a StateEvent. The signature field is excluded from the preimage (you can’t sign over your own signature). The same canonical-JSON rule that derives vev_… is reused.

generate_keypair

Generate an Ed25519 keypair. Writes the private key to output_dir/private.key and the public key to output_dir/public.key. Both are hex-encoded.

load_signing_key_from_path

v0.49.3: public key-loading and primitive-signing helpers so the hub (and any other downstream binary) can sign small JSON payloads — e.g., the /.well-known/vela manifest — without needing direct access to the ed25519_dalek dep or to the SigningKey type. Load a hex-encoded Ed25519 signing key from disk.

proposal_signing_bytes

Compute the canonical signing bytes for a StateProposal. The signature (held externally on the wire) is excluded from the preimage. Same canonical-JSON discipline as event_signing_bytes.

pubkey_hex

Hex-encoded Ed25519 public key (64 chars) for the given signing key.

refresh_jointly_accepted

Walk every finding and (re)set flags.jointly_accepted to match the current state of signature_threshold and the multi-sig envelope set. Idempotent. Called from sign_frontier and the verify path so the flag never drifts from the underlying truth.

sign_bytes

Sign arbitrary bytes with the given key. Returns the 64-byte signature.

sign_event

Sign a canonical event with an Ed25519 private key, returning a hex-encoded signature suitable for event.signature.

sign_finding

Sign a single finding bundle, producing a SignedEnvelope.

sign_frontier

Sign all findings in a frontier that are not yet signed BY THIS KEY. Returns the number of newly signed findings.

sign_proposal

Sign a proposal with an Ed25519 private key, returning a hex-encoded signature suitable for transport on a write API.

signers_for

Hex-encoded public keys of every actor whose SignedEnvelope targeting finding_id cryptographically verifies against the finding’s canonical bytes. Duplicate signatures from the same key are counted once. Returns an empty Vec if the finding doesn’t exist.

threshold_met

True iff flags.signature_threshold is Some(k) and k distinct valid signatures are present. None threshold means single-sig semantics — never reports threshold-met.

valid_signature_count

Number of unique valid signers on finding_id.

validate_orcid

v0.43: Validate an ORCID identifier’s structural shape. ORCID IDs are 16 digits in 4 groups of 4 separated by hyphens, with the final character optionally being X (the ISO 7064 check digit). Accepts bare form 0000-0001-2345-6789, the URL form https://orcid.org/0000-..., or the prefixed form orcid:0000-... and returns the bare form.

verify_action_signature

Generic signature verifier for action-on-canonical-bytes: verify signature_hex is a valid Ed25519 signature over signing_bytes, produced by the holder of expected_pubkey_hex. Used by write actions that don’t sign over a full proposal/event struct (e.g., accept/reject decisions).

verify_event_signature

Verify that event.signature is a valid Ed25519 signature over the canonical signing bytes of event, produced by the holder of the private key matching expected_pubkey_hex.

verify_finding

Verify a signed envelope against a finding bundle.

verify_finding_with_pubkey

Verify a finding against a specific public key (hex-encoded).

verify_frontier

Verify all signatures in a frontier. Optionally filter by a specific public key.

verify_frontier_data

Verify all signatures in an in-memory frontier.

verify_proposal_signature

Verify a hex-encoded Ed25519 signature against the canonical signing bytes of proposal, using expected_pubkey_hex as the verifying key.