Struct ClusterSigner 

pub struct ClusterSigner { /* private fields */ }

Ed25519 keypair used to sign cluster join tokens.

Cloning is intentionally not implemented: each ClusterSigner owns its signing material and should be passed by reference through the daemon (typically Arc<ClusterSigner>).

Implementations

impl ClusterSigner

pub fn generate() -> Self

Generate a fresh keypair from the OS CSPRNG.

The seed is drawn directly from the OS via rand::rngs::OsRng (workspace rand 0.9) and fed to SigningKey::from_bytes. We avoid SigningKey::generate here because ed25519-dalek 2.x requires rand_core 0.6’s CryptoRngCore trait, while the workspace pins rand 0.9 (whose OsRng implements rand_core 0.9’s TryRngCore). Filling 32 bytes via the workspace rand is equivalent: an Ed25519 signing key is just 32 random bytes.

Panics

Panics if the OS CSPRNG fails. This matches the behavior of SigningKey::generate(&mut OsRng) and is appropriate because key generation cannot proceed without entropy.

pub async fn load_or_generate(path: &Path) -> Result<Self, SecretsError>

Load the keypair from the on-disk keystore at path if present; otherwise generate a fresh one, persist it as a JSON keystore with mode 0600, and return it. Returns the ClusterSigner for the currently-active key.

If the file exists in the legacy raw-32-byte format (Wave 1), it is transparently migrated to the JSON keystore layout in place. The migration is idempotent.

The parent directory of path is created if it does not exist (mkdir -p semantics).

Errors

• SecretsError::Storage if the parent directory cannot be created, if the file cannot be read or written, or if the file exists but is neither valid keystore JSON nor a 32-byte legacy seed.
• SecretsError::Storage if Unix file permissions cannot be set.

pub fn verifying_key(&self) -> VerifyingKey

The public verifying key.

pub fn public_key_b64(&self) -> String

URL-safe no-pad base64 of the 32-byte verifying key.

pub fn key_id(&self) -> String

First 8 hex chars of SHA-256(verifying_key bytes). Short, greppable identifier for log lines and token headers.

pub fn sign(&self, msg: &[u8]) -> [u8; 64]

Sign a message. Returns the raw 64-byte Ed25519 signature.

Trait Implementations

impl Debug for ClusterSigner

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Redacts the private key material. Only the short, public key_id is printed so signing keys never leak via accidental {:?} formatting.