PqSigningChain class

The links that vouch for each key an enrollment's _apsk lists, and the walk from a key up to the atSign's signing root.

A link names one key, {v: 2, enrollmentId, kid, alg, pub}, and the kid of the key that signed it. When that kid is a key of the signing root it is a root link, checked against that key only; otherwise it is a chain link signed by a key of another enrollment, and the walk goes on from that key. Links are stored in the record's appMetadata under linksField, and written only through enroll:link.

Constructors

PqSigningChain(AtClient _atClient): One chain view per client; the wire vocabulary stays static because it belongs to the protocol rather than to any client.

Properties

hashCode → int: The hash code for this object.
no setterinherited
lacksEnrollLink → bool: Whether an enroll:link this client sent, through any PqSigningChain, was refused as a command the atServer's grammar does not know, or was answered without naming what it linked: an atServer without enroll:link. It holds for the client's lifetime.
no setter
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited

Methods

linkKeysOf(ApskRecord target, LinkVoucher voucher, {required String? authenticationKey, required EnvelopeSigning verifier}) → Future<List<String>>: Links each of target's keys that voucher should, through one enroll:link, and returns the kids the atServer reports linked.
linkOwnKeys(EnvelopeSigning signer, {required Future<bool> isFullyPrivileged()?, List<ApkamSigningKeys> alsoVouchWith = const [], AtKeysIo? keysIo}) → Future<List<String>>: Links this enrollment's own keys with what this client vouches with, as linkKeysOf decides, and returns the kids linked.
noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
readRecord(String enrollmentId) → Future<ApskRecord?>: enrollmentId's _apsk record, or null when the atServer holds none at .a.__e.
refreshOwnLinks() → Future<ApskRecord?>: Reads this enrollment's own _apsk and records which of its keys have a link, for content signing to prefer; returns the record, or null when it has none. A client on the primary enrollment is treated as the atSign itself, so it reads none.
toString() → String: A string representation of this object.
inherited
verifyChain(EnvelopeSigning verifier, String enrollmentId) → Future<ChainResult>: Whether enrollmentId is anchored: every key it signs with walks to the root.
voucher(EnvelopeSigning signer, {required Future<bool> isFullyPrivileged()?, List<ApkamSigningKeys> alsoVouchWith = const [], AtKeysIo? keysIo}) → Future<LinkVoucher?>: What this client vouches with: the signing root when it holds the root's private key and isFullyPrivileged says so, else the strongest of its own active client data signing keys that walks to the root, else null. A null isFullyPrivileged asks for a chain voucher alone.
walkFrom(EnvelopeSigning verifier, ApskRecord record, ApskSigningKey key) → Future<ChainResult>: Walks from key, one of record's keys, up to the signing root.
writeLinks(String enrollmentId, Map<String, LinkWrite> links) → Future<List<String>>: Sends one enroll:link for enrollmentId carrying links, and returns the kids the atServer reports linked.

Operators

operator ==(Object other) → bool: The equality operator.
inherited

Static Methods

apskUri(String atSign, String enrollmentId) → String: public:_apsk.<enrollmentId>.a.__e@<atSign>.
linkPayload(String enrollmentId, ApskSigningKey key) → Map<String, Object?>: The payload a link signs to vouch that key belongs to enrollmentId.
matchesEnrollGrammar(String command) → bool: Whether command reads as an enroll command under this client's own grammar, matched as the atServer matches it: case-blind, with . matching no line terminator.
names(Map<String, Object?>? payload, String enrollmentId, ApskSigningKey key) → bool: Whether payload names key as one of enrollmentId's, the id compared as the atServer folds it.
payloadOf(Map<String, Object?> link) → Map<String, Object?>?: The payload link signs, or null when it carries none that reads.
rootLinkSignableBytes(Map<String, Object?> payload) → Uint8List: The exact bytes a root link's signature covers.
sameKey(String a, String b) → bool: Whether a and b are one public key: equal bytes when both decode as base64, in either alphabet, else equal text once trimmed.
signChainLink(Map<String, Object?> payload, {required ApkamSigningKeys key, required String signerEnrollmentId}) → Map<String, Object?>: A chain link over payload, signed with key alone, which signerEnrollmentId's _apsk lists.
signRootLink(Map<String, Object?> payload, {required Uint8List rootPrivate, required String rootKid}) → Future<Map<String, Object?>>: A root link over payload, signed with rootPrivate, the root key rootKid names.

Constants

linksField → const String: The appMetadata.additional field holding an _apsk record's links, keyed by the kid each vouches for.
linkVersion → const int: The version of the link payload.
maxDepth → const int: The longest walk, in keys, before a chain reads ChainVerdict.broken.
rootLinkAlgo → const String: Signature algorithm marker on a root link: the same mldsa65 the root record and the keyfile use.
rootLinkDomain → const String: The domain tag a root link's signature covers, ahead of the payload, so a root link's signature is bytes no other thing this build signs can produce. Frozen, and pinned in test/wire_literal_pins_test.dart.
rootLinkKidField → const String: Top-level field of a root link naming the root key that signed it.