Crate vgi_core 

Shared primitives for Verifiable Git Infrastructure (VGI).

Pure, dependency-light building blocks that both the signer (did-git-sign) and the CI verifier (verify-trust) rely on, kept in one crate so their wire formats cannot drift:

• the PROTOCOL.sshsig encoder (create_ssh_signature) and the git sshsig namespace (GIT_SSHSIG_NAMESPACE),
• git commit-object handling (split_signed_commit, normalize_sshsig_armor, committer_did),
• DID-document Ed25519 key extraction (ed25519_keys_from_doc),
• the forge-qualified resource grammar (normalize_resource, resource_contains) that the verifier, the VTC projection and the forge adapters must all agree on byte for byte.

Nothing here touches the network, a keyring, or a VTA — that is what lets the CI verifier stay a small, fast dependency.

Re-exports

pub use resource::ResourceError;

pub use resource::ResourceErrorKind;

pub use resource::normalize_resource;

pub use resource::normalize_resource_with_depth;

pub use resource::resource_contains;

Modules

resource

Forge-qualified trust-tuple resources.

Constants

ED25519_MULTICODEC_PREFIX

Multicodec prefix for an Ed25519 public key in publicKeyMultibase.

GIT_SSHSIG_NAMESPACE

The sshsig namespace git uses for commit and tag signatures.

Functions

committer_did

The signer DID a commit claims: its committer identity when that is a DID, reduced to the bare DID.

committer_identity

The committer identity: the <…> field of the committer header.

conflicting_signer_dids

Return both explicit identity claims when the final Signed-by-DID: trailer and legacy DID committer identity disagree.

create_ssh_signature

Create an armored SSH signature following the PROTOCOL.sshsig format.

ed25519_keys_from_doc

Extract every Ed25519 public key from a DID document’s verification methods (publicKeyMultibase, multicodec 0xED01).

normalize_sshsig_armor

Re-wrap an sshsig armor’s base64 body at 70 columns.

signer_did

The signer DID a commit claims, checking the Signed-by-DID: trailer first, then falling back to the committer email for legacy commits.

split_signed_commit

Split a raw commit object into (payload-as-signed, armored signature).