Enum ReleaseTrust 

pub enum ReleaseTrust {
    Keyless {
        identity_regexp: String,
        oidc_issuer: String,
    },
    Key {
        key_ref: String,
    },
}

How a consumer proves a release artifact is ours (R605-F1).

The two arms are the verify-side mirror of yah_qed::SigningIdentity, and they exist for the same reason: a release cut on QED instead of GitHub cannot use Fulcio keyless, because the public-good Fulcio only issues certs for OIDC issuers on its own configured allowlist. W235 §“Off-GHA forfeits GitHub OIDC keyless cosign” makes the call — key-based cosign, key vaulted in kamaji — so every consumer that verifies a yubaba/CLI artifact has to be able to express both.

This is carried through the config plumbing as a plain string (the existing --yubaba-cosign-identity value, the RenderInput field, the manifest’s identity regexp) and parsed at the two points that actually shell cosign. Keeping the wire type a string is deliberate: it means flipping a fleet to key-based trust is a value change, not a schema migration.

Variants

Keyless

Fulcio keyless: pin the certificate identity + the OIDC issuer.

Fields

identity_regexp: String

oidc_issuer: String

Key

Key-based: pin the cosign public key. key_ref is whatever cosign verify-blob --key accepts — a .pub path, an https:// URL, or a KMS URI (awskms://…, hashivault://…).

Fields

key_ref: String

Implementations

impl ReleaseTrust

pub fn parse(spec: &str) -> Self

Parse an operator-supplied cosign-identity spec.

key:<ref> selects key-based verification; anything else is a keyless certificate-identity regexp against COSIGN_OIDC_ISSUER. The prefix is explicit rather than sniffed, because a KMS URI and a regexp are both arbitrary strings and guessing between them would silently pick the wrong trust model.

pub fn verify_flags(&self) -> Vec<String>

The cosign verify-blob flags this trust model contributes, in order. The caller appends --bundle <path>/the blob itself. cosign 3.x’s bundle format carries the signature (and, for keyless, the Fulcio certificate + transparency proof) as ONE file, so there is no separate .cert sidecar to conditionally fetch any more — the old needs_certificate() distinction that gated a .cert download is gone with it.

Trait Implementations

impl Clone for ReleaseTrust

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ReleaseTrust

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ReleaseTrust

impl PartialEq for ReleaseTrust

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ReleaseTrust