RequestSeal.Discovery.KeySet (RequestSeal v0.2.0)

Bounded source-bound public keys, freshness and directory proof status. revision is SHA-256 over the fetched JSON bytes, not an origin-assigned sequence. lookup/3 accepts IDs under the source's explicit key_id mode and an algorithm allowlist. Default IDs are computed RFC thumbprints; directory-assigned IDs never replace cryptographic identity or thumbprint revocation. It rejects stale, revoked, incompatible or malformed entries. Key restrictions remain enforced by PublicKey. Snapshot lookup uses system time; the cache's :clock supports caller-controlled time for resolution/fetching.

Summary

Types

t()

Functions

lookup(set, keyid, algorithms)

Find a fresh, nonrevoked source-selected ID under the algorithm allowlist.

Types

t()

@type t() :: %RequestSeal.Discovery.KeySet{
  expires_at: integer(),
  fetched_at: integer(),
  keys: %{required(binary()) => RequestSeal.Discovery.Resolution.t()},
  origin: binary(),
  proof: :signed | :unsigned | :not_applicable,
  revision: binary(),
  source: RequestSeal.Discovery.Source.t()
}

Functions

lookup(set, keyid, algorithms)

@spec lookup(t(), binary(), [RequestSeal.Crypto.algorithm()]) ::
  {:ok, RequestSeal.Discovery.Resolution.t()} | :error

Find a fresh, nonrevoked source-selected ID under the algorithm allowlist.