Struct ServiceKeySigner 

pub struct ServiceKeySigner { /* private fields */ }

A service’s cratestack_auth::ServiceSigningKey signing COSE_Sign1 messages with Ed25519 (-19).

Two different key ids. [ServiceSigningKey::kid] is the human JWKS label the service chose ("vendor-service-v1"), which is what its JWTs carry. The COSE kid this signer puts on the wire is something else: the first 8 bytes of the RFC 9679 thumbprint of the key’s public half (§3), computed here from the key, never from the label. A verifier resolves this signer by that thumbprint prefix (for example with a StaticVerifierResolver holding verify_key), so a label that is renamed, reused or shared between two keys cannot make one key verify as another.

It holds the ServiceSigningKey itself (whose secret sits behind an Arc) rather than copying the seed into an Ed25519Signer, so the secret stays in one place. Its signatures are byte-identical to that signer’s for the same seed, streaming included (tests/auth_service_signer.rs checks it).

Implementations

impl ServiceKeySigner

pub fn new(key: ServiceSigningKey) -> ServiceKeySigner

pub fn verify_key(&self) -> CoseVerifyKey

The matching verification key, for a peer’s resolver.

pub fn service_key(&self) -> &ServiceSigningKey

The wrapped service identity (its issuer, JWKS label and JWKS).

Trait Implementations

impl Clone for ServiceKeySigner

fn clone(&self) -> ServiceKeySigner

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CoseSigner for ServiceKeySigner

fn sign_chunks( &self, to_be_signed: &[&[u8]], ) -> Option<Result<Vec<u8>, CratestackError>>

Both PureEdDSA passes over the pieces, exactly as Ed25519Signer does.

fn alg(&self) -> CoseAlg

The algorithm every signature from this signer uses.

fn kid(&self) -> &[u8]

The key’s kid: the first 8 bytes of its RFC 9679 thumbprint (§3).

fn sign<'life0, 'life1, 'async_trait>( &'life0 self, to_be_signed: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, CratestackError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, ServiceKeySigner: 'async_trait,

Sign (or MAC) to_be_signed. For HMAC 256/64 this returns the truncated 8-byte tag. An error is a backend failure (a 500).

impl Debug for ServiceKeySigner

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl From<ServiceSigningKey> for ServiceKeySigner

fn from(key: ServiceSigningKey) -> ServiceKeySigner

Converts to this type from the input type.