module

Quartz::Signal::Trust

Trust primitives for federated tap manifests.

Crypto choice: Crystal's stdlib does not ship ed25519. Rather than pull an external shard, Quartz uses HMAC-SHA256 over the canonical manifest bytes with a symmetric tap key. Each tap generates a 32-byte key on first publish; peers TOFU-pin the key the first time they see it.

Semantics: this is a "federated MAC" not a signature. A tap can sign its own manifests, and peers can verify that subsequent manifests come from the same key holder. It does NOT let a third party verify without holding the key. This is acceptable for content-addressed tap sharing where the key is distributed alongside the first pin.

Migration path: when an ed25519 shard is adopted, sign/verify get a new backend and manifests gain an alg field. Current alg tag is "hmac-sha256".

Constants

ALG = "hmac-sha256"

Class methods

canonical_bytes(manifest : Hash(String, String)) : Bytes

Canonicalize a manifest (Hash with String keys/values) into bytes. Keys are sorted; values are JSON-encoded. Deterministic and stable.

Source
content_id(manifest : Hash(String, String)) : String
Source
generate_key

Generate a new 32-byte tap key, hex-encoded.

Source
sign(manifest : Hash(String, String), hex_key : String) : String

Sign canonical manifest bytes with the given hex key. Returns the HMAC-SHA256 tag, hex-encoded.

Source
verify(manifest : Hash(String, String), hex_key : String, tag : String) : Bool

Constant-time-ish verification of a hex tag.

Source

Nested types