Crate fleetforge_trust

Expand description

Trust metadata primitives shared across the runtime.

Structs§

Attestation: Placeholder attestation envelope attached to trust decisions and replay events.
C2paManifestEnvelope: Canonical C2PA envelope containing the manifest payload and detached signature.
CapabilityBudgetLimits
CapabilityClaims: Canonical capability claims embedded inside minted tokens.
CapabilityEvidence
CapabilityEvidenceEntry
CapabilitySchemaRef
CapabilityToken: Serialized capability token envelope (JWS + claims).
CapabilityTokenScope
CapabilityTokenSubject
CapabilityToolScope
Ed25519Signer
IdentityEvidence
InMemoryAttestationVault: In-memory attestation vault used for tests and local development.
Jwk
ManifestInput
ObjectStoreAttestationVault: Object store backed attestation vault with a Postgres index.
PolicyEvidence
SignatureEnvelope
SigningAlgorithm
TrustDecision: Outcome of evaluating a policy against a subject.
TrustOrigin: Describes how the runtime obtained an untrusted or derived value.
TrustSigner
Trusted: Strongly-typed wrapper for trusted values.
Untrusted: Strongly-typed wrapper for untrusted values.
VerifiedManifest

ManifestProfile
Trust: High-level trust classification.
TrustBoundary: Boundary within the runtime where trust is assessed.
TrustSource: Source system that produced the value.
TrustSubject: Identifies what entity an attestation or trust decision covers.
TrustVerdict: Placeholder for future detailed policy verdict information.

TRUST_MESH_ALPHA_FLAG: Environment flag that gates Trust Mesh alpha capabilities.

build_scitt_entry: Constructs a SCITT transparency entry linking change evidence to attestations.
c2pa_signer: Loads the C2PA signer; falls back to the trust signer when none is configured.
capability_signer: Loads the capability signer; falls back to the trust signer when none is configured.
digest_bytes: Computes a deterministic SHA256 digest for a byte slice.
digest_for_algorithm
digest_json: Computes a deterministic SHA256 digest for the supplied JSON value.
generate_c2pa_manifest: Generates a signed C2PA-style manifest for the supplied artifact bytes.
jwk_from_aws_public_key
jwk_from_gcp_public_key
mint_capability_token: Mint a capability token with the supplied subject and scope.
normalize_ecdsa_signature
scitt_signer: Loads the SCITT signer configuration, requiring explicit key material.
trust_signer: Returns the default Trust Mesh signer, falling back to an ephemeral key when none is configured.
verify_c2pa_manifest: Verifies the provided manifest envelope against the raw artifact bytes and signature.
verify_capability_token: Verify the capability token against configured signer keys.
verify_signature_envelope