krabka_audit/operator_keys/
mod.rs

1//! The operator key trust set, loaded from `[[operator_keys]]`.
2//!
3//! Two subsystems verify detached Ed25519 signatures against one shared set of
4//! operator keys: the topic write-freeze registry and the break-glass approval
5//! workflow. Both reach the keys through [`OperatorKeys`], so an operator is
6//! provisioned once and a signature is checked one way.
7//!
8//! [`OperatorKeys::load`] reads every configured public key file, so an
9//! unreadable path or a malformed key stops the broker at boot instead of in
10//! the middle of an incident. Verification calls
11//! [`crate::signing::verify_signature`], the same code path that checks
12//! an audit checkpoint, so operator key material has the shape the audit
13//! checkpoint keys already have.
14//!
15//! This module holds no canonical-bytes builder. The freeze subsystem and the
16//! break-glass subsystem each define their own signed payload, under their own
17//! domain separator, and pass the finished bytes to [`OperatorKeys::verify`].
18
19pub use self::{
20    error::OperatorKeyError,
21    fingerprint::approver_set_fingerprint,
22    key_file::OperatorKeyEntry,
23    trust_set::{OperatorKey, OperatorKeys},
24};
25
26mod error;
27mod fingerprint;
28mod key_file;
29mod trust_set;
30
31#[cfg(test)]
32mod tests;
krabka_audit/operator_keys/mod.rs

krabka_audit/operator_keys/
mod.rs
