Module signature 

Ed25519 plugin signature verification.

Enums

SignatureMode

Signature mode controls how unsigned/unverified plugins are handled.

VerificationResult

Result of verifying a plugin’s signature.

Functions

canonical_manifest_bytes

enforce_signature_policy

Check a manifest’s signature and enforce the configured signature mode. Returns Ok(VerificationResult) on success (or warning in permissive mode), or Err(PluginError) if the plugin should be rejected.

generate_signing_key

Generate a new Ed25519 key pair for plugin signing. Returns (pkcs8_der_bytes, public_key_hex).

public_key_hex

Get the hex-encoded public key from a PKCS#8 Ed25519 private key.

sign_manifest

Sign manifest bytes with an Ed25519 private key (PKCS#8 DER). Returns the base64url-encoded signature.

verify_manifest