Rendro.Sign (Rendro v0.3.0)

Artifact-first signing boundary.

This surface supports two distinct signing seams over rendered artifacts:

prepare/2 patches deterministic signature placeholders for lower-level external workflows.
sign/2 signs the original unsigned rendered artifact through a narrow optional adapter boundary.

Summary

augment_option()

prepare_option()

sign_option()

sign_options()

@type augment_option() :: {:adapter, module()} | {:adapter_opts, keyword() | map()}

@type augment_options() :: [augment_option()]

@type prepare_option() ::
  {:field, String.t()} | {:reserved_bytes, pos_integer()} | {:adapter, module()}

@type prepare_options() :: [prepare_option()]

@type sign_option() ::
  {:field, String.t()}
  | {:adapter, module()}
  | {:adapter_opts, keyword() | map()}

@type sign_options() :: [sign_option()]

@type validate_option() :: {:adapter, module()}

@type validate_options() :: [validate_option()]

@spec augment(Rendro.Artifact.t(), augment_options()) ::
  {:ok, Rendro.Artifact.t()} | {:error, Rendro.Error.t()}

@spec prepare(Rendro.Artifact.t(), prepare_options()) ::
  {:ok, Rendro.Artifact.t()} | {:error, Rendro.Error.t()}

@spec redact_augment_opts(augment_options() | map()) :: map()

@spec redact_opts(prepare_options() | map()) :: map()

@spec redact_prepare_opts(prepare_options() | map()) :: map()

@spec redact_sign_opts(sign_options() | map()) :: map()

@spec render_signed(Rendro.Document.t(), Rendro.render_options(), sign_options()) ::
  {:ok, Rendro.Artifact.t()} | {:error, Rendro.Error.t()}

@spec sign(Rendro.Artifact.t(), sign_options()) ::
  {:ok, Rendro.Artifact.t()} | {:error, Rendro.Error.t()}

@spec validate(Rendro.Artifact.t(), validate_options()) ::
  {:ok, map()} | {:error, Rendro.Error.t()}

@spec validate_trust(Rendro.Artifact.t(), validate_options()) ::
  {:ok, map()} | {:error, Rendro.Error.t()}