Module provenance 

Ed25519 release provenance with artifact and SBOM digest verification.

Structs

SignAttestationRequest

Inputs required to create one signed release provenance statement.

Constants

PROVENANCE_SCHEMA

Stable release provenance schema.

Functions

app_contract_set_sha256

Hashes canonical app manifests and declarative contract sources in stable path order.

file_sha256 🔒

Returns a SHA-256 digest for one bounded regular file.

generate_private_key

Generates a new PKCS#8 Ed25519 private key for operator-controlled storage.

hex_decode 🔒

Decodes strict even-length hexadecimal.

hex_encode 🔒

Encodes bytes as lowercase hexadecimal without invoking an external tool.

public_key_from_private

Derives the raw Ed25519 public key that operators distribute as the verification trust anchor.

sign_attestation

Signs artifact, source, dependency, toolchain, configuration, contract, and SBOM identity.

verify_attestation

Verifies an Ed25519 attestation and the current artifact and SBOM digests.