SergioandClaude Opus 4.8
5ec7a81e87
Cierra el item de firma del modelo de confianza (SDD 09 §3, §5).
hammer-core/src/sign.rs:
- KeyPair: genera (getrandom), carga/serializa claves base64, escribe
<name>.ed25519 (0600) + <name>.ed25519.pub, y firma un Swm.
- TrustStore::load(dir): lee *.ed25519.pub; dir ausente ⇒ store vacío.
- Swm::verify_signature(&trust) → SigStatus {Trusted|UnknownKey|BadSig|
Unsigned}. Bytes firmados = JSON canónico de (swm_version, base,
mutations) sin la firma; deterministas (pins en BTreeMap).
- 8 tests: sign/verify, tamper, wrong-key, roundtrip en disco, dir ausente.
CLI:
- hammer keygen <name> [--out DIR]
- hammer swm-sign <file> --key K [--by N] [-o OUT]
- hammer swm-verify <file> --trust DIR (reporta trusted/unknown-key/
bad-sig/unsigned; bad-sig aborta, lo demás informa).
La firma da autoría + integridad pero NO autoriza promover: apply sigue
reproduciendo y comparando. Verificado e2e por el CLI (keygen→sign→verify
en los 4 estados). 22 binarios de test verdes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
1.3 KiB
TOML
53 lines
1.3 KiB
TOML
[workspace]
|
|
resolver = "2"
|
|
members = [
|
|
"crates/hammer-core",
|
|
"crates/hammer-build",
|
|
"crates/hammer-overlay",
|
|
"crates/hammer-journal",
|
|
"crates/hammer-agent",
|
|
"crates/hammer-cli",
|
|
"crates/hammerd",
|
|
]
|
|
|
|
[workspace.package]
|
|
version = "0.0.1"
|
|
edition = "2021"
|
|
license = "MIT"
|
|
authors = ["sergio <gerencia@jlsoltech.com>"]
|
|
repository = "https://gitea.gioser.net/sergio/hammer"
|
|
|
|
[workspace.dependencies]
|
|
hammer-core = { path = "crates/hammer-core" }
|
|
hammer-build = { path = "crates/hammer-build" }
|
|
hammer-overlay = { path = "crates/hammer-overlay" }
|
|
hammer-journal = { path = "crates/hammer-journal" }
|
|
hammer-agent = { path = "crates/hammer-agent" }
|
|
|
|
# shared third-party deps, pinned at the workspace level
|
|
anyhow = "1"
|
|
thiserror = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_yaml = "0.9"
|
|
toml = "0.8"
|
|
blake3 = "1"
|
|
sha2 = "0.10"
|
|
hex = "0.4"
|
|
base64 = "0.22"
|
|
ed25519-dalek = "2"
|
|
getrandom = "0.2"
|
|
nix = { version = "0.30", default-features = false, features = ["fanotify", "fs", "user"] }
|
|
tempfile = "3"
|
|
clap = { version = "4", features = ["derive"] }
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
[profile.release]
|
|
# small, static-friendly binaries for the userland
|
|
opt-level = "z"
|
|
lto = true
|
|
codegen-units = 1
|
|
strip = true
|
|
panic = "abort"
|