simplify sigchain http distribution

crates/geth-keychain/src/sshsigchain/bundle.rs

@@ -28,8 +28,9 @@ pub struct CanonicalSshSigchainBundle {
     pub receipts: Vec<AnchorReceipt>,
 }
 
-/// Locates an untrusted distribution source. It is routing configuration, not
-/// a trust anchor; integrity and authority come from SSHSIGCHAIN verification.
+/// Locates an untrusted distribution source. It is exact routing
+/// configuration, not a discovery mechanism or trust anchor; acceptance comes
+/// from SSHSIGCHAIN verification against the independently pinned trust tuple.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct DistributionEndpoint {
@@ -111,14 +112,6 @@ pub enum DistributionError {
     Protocol(#[from] SshSigchainError),
 }
 
-#[must_use]
-pub fn static_http_bundle_path(chain_id: ChainId) -> String {
-    format!(
-        "/.well-known/sshsigchain/v1/{}/chain.{CANONICAL_BUNDLE_EXTENSION}",
-        chain_id.to_hex()
-    )
-}
-
 #[must_use]
 pub fn canonical_bundle_hash(bytes: &[u8]) -> Digest {
     let mut input = Vec::with_capacity(BUNDLE_HASH_DOMAIN.len() + bytes.len());
@@ -740,6 +733,15 @@ fn validate_object_size(bytes: &[u8]) -> Result<(), DistributionError> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn distribution_locator_is_arbitrary_exact_routing_configuration() {
+        let locator = "https://cdn.example.test/custom/latest.bin?channel=stable";
+        let endpoint =
+            DistributionEndpoint::new("primary", "http", locator).expect("distribution endpoint");
+
+        assert_eq!(endpoint.locator, locator);
+    }
+
     const ROOT_KEY: &str = "ssh-ed25519 AQID";
 
     fn signed_genesis() -> SshSigchainRecord {
@@ -778,7 +780,7 @@ mod tests {
         .with_signature(vec![4, 5, 6])
         .expect("claim signature");
         let receipt = AnchorReceipt {
-            backend_id: "static-http".to_owned(),
+            backend_id: "http-primary".to_owned(),
             claim_hash: claim.claim_hash().expect("claim hash"),
             evidence: b"receipt".to_vec(),
         };
@@ -897,7 +899,7 @@ mod tests {
                     required_classes: vec!["http".to_owned()],
                     backend_threshold: 1,
                     backends: vec![AnchorBackendPolicy {
-                        backend_id: "static-http".to_owned(),
+                        backend_id: "http-primary".to_owned(),
                         class: "http".to_owned(),
                         locator: "https://example.test".to_owned(),
                         weight: 1,
@@ -932,18 +934,6 @@ mod tests {
         assert_eq!(decode_canonical_bundle(&bytes).expect("decode"), bundle);
     }
 
-    #[test]
-    fn static_http_path_is_stable_and_contains_only_lowercase_chain_id() {
-        assert_eq!(
-            static_http_bundle_path(ChainId([0xab; 32])),
-            concat!(
-                "/.well-known/sshsigchain/v1/",
-                "abababababababababababababababababababababababababababababababab/",
-                "chain.sscb"
-            )
-        );
-    }
-
     #[test]
     fn canonical_bundle_matches_published_base_vector() {
         let record = SshSigchainRecord::unsigned(