pub struct WanKeyRecord {
pub instance_id: String,
pub agent_id: String,
pub channel: String,
pub key_fp: String,
pub instance_pubkey: String,
pub agent_pubkey: String,
pub host_hint: String,
pub issued_at: i64,
pub cert_sig: String,
}Expand description
One entry in the per-account key directory (§2.2): an agent key,
certified by the instance that minted it. Public keys are standard
base64 of the raw 32 bytes; cert_sig is standard base64 Ed25519.
Every field is untrusted until WanKeyRecord::check_chain passes —
the record arrives from the cloud, which may be tampering.
Fields§
§instance_id: String§agent_id: String§channel: String§key_fp: String§instance_pubkey: String§agent_pubkey: String§host_hint: String§issued_at: i64§cert_sig: StringImplementations§
Source§impl WanKeyRecord
impl WanKeyRecord
Sourcepub fn certify(
instance_private_key: &[u8],
agent_id: &str,
channel: &str,
agent_public_key: &[u8; 32],
host_hint: &str,
issued_at: i64,
) -> Option<Self>
pub fn certify( instance_private_key: &[u8], agent_id: &str, channel: &str, agent_public_key: &[u8; 32], host_hint: &str, issued_at: i64, ) -> Option<Self>
Certify agent_public_key with the instance key. Called by the srv
that owns the instance; returns None for a malformed instance
private key, never panics.
Sourcepub fn check_chain(&self) -> Option<[u8; 32]>
pub fn check_chain(&self) -> Option<[u8; 32]>
The chain every holder of a record checks — the cloud on PUT
(hygiene) and the receiver before trusting it (the real anchor):
the instance id is the hash of the instance key, the fingerprint is
the hash of the agent key, and the instance key signed the
certificate. Returns the decoded agent public key on success.
Trait Implementations§
Source§impl Clone for WanKeyRecord
impl Clone for WanKeyRecord
Source§fn clone(&self) -> WanKeyRecord
fn clone(&self) -> WanKeyRecord
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more