Crate vgi_core 

Shared primitives for Verifiable Git Infrastructure (VGI).

Pure, dependency-light building blocks that both the signer (did-git-sign) and the CI verifier (verify-trust) rely on, kept in one crate so their wire formats cannot drift:

• the PROTOCOL.sshsig encoder (create_ssh_signature) and the git sshsig namespace (GIT_SSHSIG_NAMESPACE),
• git commit-object handling (split_signed_commit, normalize_sshsig_armor, committer_did),
• DID-document Ed25519 key extraction (ed25519_keys_from_doc).

Nothing here touches the network, a keyring, or a VTA — that is what lets the CI verifier stay a small, fast dependency.

Constants

ED25519_MULTICODEC_PREFIX

Multicodec prefix for an Ed25519 public key in publicKeyMultibase.

GIT_SSHSIG_NAMESPACE

The sshsig namespace git uses for commit and tag signatures.

Functions

committer_did

The signer DID a commit claims: its committer identity when that is a DID, reduced to the bare DID.

committer_identity

The committer identity: the <…> field of the committer header.

create_ssh_signature

Create an armored SSH signature following the PROTOCOL.sshsig format.

ed25519_keys_from_doc

Extract every Ed25519 public key from a DID document’s verification methods (publicKeyMultibase, multicodec 0xED01).

normalize_sshsig_armor

Re-wrap an sshsig armor’s base64 body at 70 columns.

split_signed_commit

Split a raw commit object into (payload-as-signed, armored signature).