Package: mars-protocol · Workspace version: 0.1.0 · Module: signature

This reference follows declared modules and public syntax, including public implementation methods. Function bodies and constant values are omitted. Feature conditions are retained. Private-module re-exports and trait resolution require the compiler; not every declaration is a root import.

signature::PUBLISHER_SIGNING_PROFILE

Stable identifier for the MARS v1 publisher-signing erratum profile.

pub const PUBLISHER_SIGNING_PROFILE: &str;

Source line: 30.

signature::REGISTRY_MANAGED_TOP_LEVEL_FIELDS

Top-level fields managed by a registry and excluded from publisher signatures.

This is the sole public exclusion list for [PUBLISHER_SIGNING_PROFILE]. Implementations MUST NOT maintain parallel active/reserved lists, exclude fields by prefix, or use an open-ended rule: every unlisted field is publisher-authored and remains tamper-evident. anchorProjection, anchorTxHash, anchorBlockHeight, and anchorProof remain reserved for future registry projections and do not activate a ledger adapter.

pub const REGISTRY_MANAGED_TOP_LEVEL_FIELDS: &[&str];

Source line: 41.

signature::EntrySignature

Cryptographic signature over a MARS entry's canonical content.

The signature uses MARS-PUBLISHER-SIGNING-V1: JCS (RFC 8785) over publisher-authored fields after removing only signature, sequence, updatedAt, lifecycleStatus, verifiableAttestations, shardAssignment, anchorProjection, anchorState, anchorTxHash, anchorBlockHeight, and anchorProof.

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[cfg_attr(feature = "contracts", derive(schemars::JsonSchema, utoipa::ToSchema))]
#[serde(rename_all = "camelCase")]
pub struct EntrySignature {
/// Signature algorithm. Always "Ed25519".

#[cfg_attr(feature = "contracts", schemars(regex(pattern = r"^Ed25519$")))]
pub algorithm: String,
/// DID URL of the signing key (e.g. `"did:oas:l1fe:ao:org#key-1"`).

#[cfg_attr(feature = "contracts", schemars(regex(pattern = r"^did:oas:.+#.+$")))]
pub key_id: String,
/// Strict URL-safe, unpadded base64url signature bytes.

///

/// Standard-base64 characters (`+`, `/`) and `=` padding are rejected.

pub value: String,
/// ISO 8601 timestamp of when the signature was created.

#[serde(skip_serializing_if = "Option::is_none")]
pub created: Option<String>
}

Source line: 65.

signature::sign_entry

Sign an entry payload and produce an [EntrySignature].

Arguments

• canonical_bytes — Output from [canonical_signing_bytes].
• key_id — DID URL of the signing key (e.g. "did:oas:ns:kind:id#key-1").
• signing_key — Ed25519 signing key.
• created — Optional ISO 8601 timestamp.

Errors

Returns [crate::errors::MarsError::SignatureError] if signing fails.

pub fn sign_entry(
    canonical_bytes: &[u8],
    key_id: &str,
    signing_key: &ed25519_dalek::SigningKey,
    created: Option<&str>,
) -> Result<EntrySignature, crate::errors::MarsError>;

Source line: 95.

signature::verify_entry_signature

Verify an [EntrySignature] against canonical bytes and the signer's public key.

Errors

Returns [crate::errors::MarsError::SignatureError] on any verification failure.

pub fn verify_entry_signature(
    canonical_bytes: &[u8],
    signature: &EntrySignature,
    public_key: &ed25519_dalek::VerifyingKey,
) -> Result<(), crate::errors::MarsError>;

Source line: 118.

signature::canonical_signing_bytes

Produce the canonical MARS v1 publisher-signing payload.

Serializes entry to JSON, removes every field in [REGISTRY_MANAGED_TOP_LEVEL_FIELDS] from the top-level object, and JCS-canonicalizes the result. Every other field, including publisherDid, itemData, and bondReference, remains signed.

Errors

Returns [MarsError::SerializationError] if entry cannot be serialized or canonicalized.

pub fn canonical_signing_bytes<T: Serialize>(entry: &T) -> Result<Vec<u8>, MarsError>;

Source line: 160.

signature::controller_did_from_key_id

Extract the controller DID portion of a key_id of the form "did:oas:...#fragment".

Returns the substring before #, or the whole string if no # is present. Used to enforce that a signing key's controller DID matches the entry's publisher_did.

pub fn controller_did_from_key_id(key_id: &str) -> &str;

Source line: 179.

Source provenance

Source: mars-protocol/src/signature.rs · SHA-256 790b011341b155624a89698aa9059a5a81e083b1dc8128e04ef7ca29450c37e5. Package overview.