Installs keyring-core’s in-memory mock store and registers the key service
against it, once per process. Every crate that tests against the key
service uses this rather than mirroring the mock, so no test reaches the
real OS keychain.
One store’s key material: the encryption master key, cloud-home credentials,
and OAuth tokens, each stored under a store-scoped keyring account
({base}:{store_id}). The store’s signing identity is not here — it goes
through crate::identity_custody::IdentityCustody, the same way the
master key goes through crate::custody::KeyCustody.
A device’s signing identity’s custody FOR ONE STORE: who unlocks it,
where a newly established one is written, and how it is removed. The
signing-key sibling of MasterKeyCustody, same three-method shape and
the same per-store selection, over UserKeypair instead of a store’s
master keyring.
A store’s master keyring’s custody: who unlocks it, where a newly
established or rotated one is written, and how it is removed. Implemented
once per protection policy (the OS keyring, a passphrase-wrapped file, an
in-memory session value, or a host’s own).
Discard the pending identity keyed by pending_public_key_hex — a pairing
abandoned without completing, or one whose identity the completed
join has already established in the store’s own custody. Ok whether or
not one was pending.
The registered keyring service name. Err when the host never ran the
startup set_keyring_service call — surfaced so a mis-ordered host gets a
typed error, not a panic deep inside a key operation.
Mint a fresh identity for a device-pairing attempt that has not joined a
store yet. The joiner signs its pairing request with this keypair and holds it
under a pending slot keyed by its own public key. The join establishes it
in the joined store’s own identity custody (via
DeviceIdentityCustody::establish,
before the store’s completion marker) and discards the pending slot only
once the whole join succeeds; discard_pending_identity also removes it
if the pairing is abandoned instead. Always the OS keyring: unlike an
established store’s identity, there is no store yet to select a custody
policy for, and a pending identity’s lifetime is short (a join round trip,
not a store’s lifetime).
Read (without consuming) the pending identity keyed by
pending_public_key_hex — what a pairing in progress signs its bootstrap
traffic with, and what it establishes in the store’s own custody before
the completion marker. KeyError::NoPendingIdentity if none is held
under that key.
This store’s established signing identity through custody, or
KeyError::NoDeviceIdentity when none is established — the caller must
complete create/join/restore for this store first. Never mints: a
connect/join precondition, not a query.
Register the process-wide keyring: the service name every entry is stored
under, and the platform keyring store that backs it. Both are one-time
startup registration and must run before any key operation. The store is
installed before the name is recorded, so a failed installation leaves no
registration behind. Re-registering the same name is a no-op; a different
name is a startup contradiction and fails. Fails with
KeyError::UnsupportedKeyringPlatform on a target with no bundled store.
Verify a hex-encoded detached Ed25519 signature (sig_hex) over message
against a hex-encoded public key (pk_hex). Malformed hex, a wrong-length key
or signature, or a non-matching signature all fail closed (false). The shared
hex front-end of this crate’s raw signature check, used by signed Store
objects and
membership entries so the decode-and-verify path lives in one place.
Derive an X25519 shared secret after rejecting public inputs that cannot
identify a peer. Low-order public keys produce the all-zero shared secret;
that result is never usable as recipient identity material.