Module signature

Expand description

Ed25519 plugin signature verification.

Enums§

SignatureMode: Signature mode controls how unsigned/unverified plugins are handled.
VerificationResult: Result of verifying a plugin’s signature.

canonical_manifest_bytes: Compute the canonical bytes of a manifest for signing/verification.
enforce_signature_policy: Check a manifest’s signature and enforce the configured signature mode. Returns Ok(VerificationResult) on success (or warning in permissive mode), or Err(PluginError) if the plugin should be rejected.
generate_signing_key: Generate a new Ed25519 key pair for plugin signing. Returns (pkcs8_der_bytes, public_key_hex).
public_key_hex: Get the hex-encoded public key from a PKCS#8 Ed25519 private key.
sha256_hex: Compute a lowercase hexadecimal SHA-256 digest.
sign_manifest: Sign manifest bytes with an Ed25519 private key (PKCS#8 DER). Returns the base64url-encoded signature.
sign_manifest_document: Sign a manifest and return the signed document, with the root signature and publisher_key entries embedded.
validate_sha256_hex: Validate the manifest representation of a SHA-256 digest.
verify_manifest
verify_payload_digest: Verify bytes against a manifest-provided SHA-256 digest.