From 42698f42eec18d24a7378fcbe1ede73add902b71 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:21 +0100
Subject: access: values sealed for their readers

cs1.<age file>: a value encrypted with age to its readers' SSH keys,
which no node decrypts. _continuum/access/sealed declares paths whose
values must be sealed, for named readers or anyone; nodes check the
recipients by age's key tags, at the API and on receipt.

Auth plan M8, reworked: sealed values instead of containers, readers
as users only (nodes hold no keys).
---
 src/access/sshsig.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/access/sshsig.rs')

diff --git a/src/access/sshsig.rs b/src/access/sshsig.rs
index b40da0d..6091528 100644
--- a/src/access/sshsig.rs
+++ b/src/access/sshsig.rs
@@ -53,7 +53,7 @@ impl PublicKey {
         Ok(PublicKey(key))
     }
 
-    fn blob(&self) -> Vec<u8> {
+    pub(crate) fn blob(&self) -> Vec<u8> {
         let mut blob = Vec::new();
         string(&mut blob, KEY_TYPE.as_bytes());
         string(&mut blob, &self.0);
-- 
cgit v1.3.1