Crate waf_wasm_signing 

Signed WASM plugins for Light WAF.

The core’s Proxy-Wasm runtime (waf-wasm) loads unsigned plugins. This crate adds a trust gate: verify_signature checks a detached minisign (Ed25519) signature over the exact .wasm bytes against trusted public keys, and load_verified_plugin hands those same bytes to the runtime only if it verifies (no TOCTOU).

Fail-closed on purpose. The core loader skips a broken unsigned plugin (a missing plugin only reduces coverage). A signed plugin whose signature does not verify is indistinguishable from tampering, so it is an error, never a silent skip.

Structs

WasmOptions

Tunables for a plugin instance set.

Functions

load_verified_plugin

Verify the plugin’s signature and, ONLY if it verifies, delegate to the OPEN WasmModule::from_bytes. The same wasm buffer is verified and loaded (no TOCTOU, K4). A signature failure returns before the runtime ever compiles the bytes (fail-closed gate, K5).

verify_signature

Verify a detached minisign signature (the .minisig text) over wasm, accepting it if it verifies against ANY of the base64 trusted_pubkeys (the key line of a minisign .pub). Fail-closed: unknown key, malformed signature, or tampered bytes all return Err.