002-pinned-trust-roots

Pinned trust roots for anchor verification

Lifecycle approvedImplementation completeVerification unknownQualification unknown

The released anchor verifier checks a chain anchor's Ed25519 signature against the public key the anchor itself carries, so anyone can mint a self-consistent chain. That proves integrity, not authorship. Add a pinned trust-root input: a canonical, digestible set of accepted Ed25519 keys, each with a key id derived from its bytes and an optional chain-id scope, and root-pinned variants of the anchor, anchor-chain and head verifiers that pass only when the anchor's key is pinned, in scope, and produced a signature that verifies under strict Ed25519 rules. Add the matching CLI input and exit code. Existing APIs, hashes, signatures, head commitments and CLI stdout and exit codes are unchanged. Release as an additive 0.2.0.

Read the full pinned specification ↗

Relationships

depends on

Claimed units

establishes

{
  "kind": "file",
  "path": "crates/types/src/trust_roots.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/core/src/trust_roots.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/cli/tests/trust_roots_cli.rs"
}

establishes

{
  "id": "attest_ledger_types::trust_roots::TrustRootsV1",
  "kind": "symbol"
}

establishes

{
  "id": "attest_ledger_core::trust_roots::verify_anchor_with_roots",
  "kind": "symbol"
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "anchor": "workspace.package",
    "file": "Cargo.toml",
    "kind": "section"
  }
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "anchor": "workspace.dependencies",
    "file": "Cargo.toml",
    "kind": "section"
  }
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "Cargo.lock"
  }
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "crates/types/src/lib.rs"
  }
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "crates/core/src/lib.rs"
  }
}

extends

{
  "nature": "corrective",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "crates/core/src/signing.rs"
  }
}

extends

{
  "nature": "corrective",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "crates/core/src/record_chain.rs"
  }
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "crates/cli/Cargo.toml"
  }
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "crates/cli/src/main.rs"
  }
}

extends

{
  "nature": "corrective",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "README.md"
  }
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "CHANGELOG.md"
  }
}

extends

{
  "nature": "additive",
  "spec": "000-attest-ledger-bootstrap",
  "unit": {
    "kind": "file",
    "path": "spec-spine.toml"
  }
}

Source headings

002: Pinned trust roots for anchor verification
1. Purpose
2. Scope, compatibility, and claimed units
3. The trust-root set
3.1 Wire shape
3.2 Key id
3.3 Validity and canonical form
3.4 Canonical bytes and digest
3.5 Errors
4. Root-pinned verification
4.1 Functions
4.2 Order of checks
4.3 Strict Ed25519 only
5. CLI contract
5.1 Root-pinned verification
5.2 Without roots
5.3 Exit codes
6. Deprecation decision
7. Room for later steps
8. Functional requirements and acceptance
9. Release boundary
10. Verifier trust policy (2026-10-10)
11. Decision entries
2026-10-10: "integrity only" output label conflicts with section 5 (resolved)

Frozen anchors

No frozen anchors declared.