Add static keychain publication workflow

crates/geth-control/src/lib.rs

@@ -4,8 +4,8 @@ use geth_db::{CrSqliteChangeBatch, DbResource};
 use geth_discovery::{DiscoveredPeer, PeerCard};
 use geth_document::{DocumentResource, DocumentState};
 use geth_keychain::{
-    KeychainAllowedSigner, KeychainOp, KeychainOpSignature, KeychainSigchainReport,
-    NodeEnrollmentRequest, NodeRecord,
+    KeychainAllowedSigner, KeychainCheckpoint, KeychainOp, KeychainOpSignature,
+    KeychainSigchainEntry, KeychainSigchainReport, NodeEnrollmentRequest, NodeRecord,
 };
 use geth_kv::{KvEntry, KvResource, KvSyncEntry};
 use geth_overlay::{
@@ -241,7 +241,58 @@ pub enum ControlRequest {
         signing_key_path: PathBuf,
         admin_key_path: Option<PathBuf>,
     },
-    KeychainAllowedSigners,
+    KeychainAllowedSigners {
+        out: Option<PathBuf>,
+    },
+    KeychainSignFile {
+        input: PathBuf,
+        out: Option<PathBuf>,
+        namespace: Option<String>,
+        signing_key_path: Option<PathBuf>,
+        admin_key_path: Option<PathBuf>,
+    },
+    KeychainVerifyFile {
+        input: PathBuf,
+        signature: PathBuf,
+        namespace: Option<String>,
+        allowed_signers_path: Option<PathBuf>,
+        principal: Option<String>,
+    },
+    KeychainSigchainExport {
+        out: Option<PathBuf>,
+    },
+    KeychainPublishBundle {
+        out: PathBuf,
+        base_url: Option<String>,
+        signing_key_path: PathBuf,
+        admin_key_path: Option<PathBuf>,
+        snapshots: Vec<String>,
+    },
+    KeychainVerifySigchain {
+        input: PathBuf,
+    },
+    KeychainImportSigchain {
+        input: PathBuf,
+    },
+    KeychainVerifyCheckpoint {
+        checkpoint: PathBuf,
+        signature: PathBuf,
+        sigchain: PathBuf,
+        allowed_signers: PathBuf,
+        base_url: Option<String>,
+        principal: Option<String>,
+    },
+    KeychainFetch {
+        url: String,
+        out: Option<PathBuf>,
+        import: bool,
+    },
+    KeychainExplain {
+        op_id: String,
+    },
+    KeychainExplainSigner {
+        key: String,
+    },
     KeychainVerify,
     KeychainSync {
         node: String,
@@ -687,8 +738,70 @@ pub enum ControlResponse {
     KeychainAllowedSigners {
         entries: Vec<KeychainAllowedSigner>,
         allowed_signers: String,
+        out: Option<PathBuf>,
         note: String,
     },
+    KeychainFileSigned {
+        input: PathBuf,
+        out: Option<PathBuf>,
+        namespace: String,
+        signer: String,
+        note: String,
+    },
+    KeychainFileVerified {
+        input: PathBuf,
+        signature: PathBuf,
+        namespace: String,
+        verified: bool,
+        principal: Option<String>,
+        note: String,
+    },
+    KeychainSigchainExported {
+        entries: Vec<KeychainSigchainEntry>,
+        jsonl: String,
+        out: Option<PathBuf>,
+        note: String,
+    },
+    KeychainBundlePublished {
+        out: PathBuf,
+        base_url: String,
+        allowed_signers_path: PathBuf,
+        sigchain_path: PathBuf,
+        checkpoint_path: PathBuf,
+        checkpoint_signature_path: PathBuf,
+        checkpoint: KeychainCheckpoint,
+        snapshots: Vec<KeychainPublishedSnapshot>,
+        note: String,
+    },
+    KeychainSigchainFileVerified {
+        input: PathBuf,
+        report: KeychainSigchainReport,
+        note: String,
+    },
+    KeychainSigchainImported {
+        input: PathBuf,
+        ops_imported: usize,
+        signatures_imported: usize,
+        invalid_ops_rejected: usize,
+        note: String,
+    },
+    KeychainCheckpointVerified {
+        checkpoint: KeychainCheckpoint,
+        verified: bool,
+        principal: Option<String>,
+        note: String,
+    },
+    KeychainFetched {
+        url: String,
+        out: PathBuf,
+        checkpoint: KeychainCheckpoint,
+        imported: Option<KeychainFetchImportReport>,
+        note: String,
+    },
+    KeychainExplained {
+        subject: String,
+        lines: Vec<String>,
+    },
     KeychainVerified {
         report: KeychainSigchainReport,
     },
@@ -1021,6 +1134,22 @@ pub enum ControlResponse {
     },
 }
 
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct KeychainFetchImportReport {
+    pub ops_imported: usize,
+    pub signatures_imported: usize,
+    pub invalid_ops_rejected: usize,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct KeychainPublishedSnapshot {
+    pub name: String,
+    pub source: PathBuf,
+    pub path: PathBuf,
+    pub signature_path: PathBuf,
+    pub namespace: String,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct StatusResponse {
     pub home: PathBuf,