diataxis: Reference
style: ASD-STE100
method: verified against source (wanderland-core/lib/wanderland/activities/pki.rb)
wanderland-core/lib/wanderland/activities/pki.rb.:pki:keys:{id}, in the append-only store.Crossing#canonical builds it.Crossing#sign generates a key on first use when the identity has none.sign scope from a key, so the key only verifies.The PKI module signs a payload and verifies a signature, over a storage registry. A key is a record at :pki:keys:{id}, in the same append-only store as every other record. The module carries no key ring and no state. Each function takes the storage and works on the keys there.
The module signs two things across the platform. It signs a boundary crossing, so the trace is tamper-evident. It signs an identity token, so a verifier can trust the scopes the token carries. See wanderland-core-idp for the token, and wanderland-core-context for the trace.
Wanderland::Activities::PKI is the whole API — stateless functions over storage, with no singleton and no backend object. Each method takes (storage, ...) and works on the storage registry the caller supplies. The module signs and verifies with an RSA or an EC key.
| Method | Purpose |
|---|---|
generate(storage, name, algorithm:) |
It creates a keypair, and skips a keypair already at :pki:keys:{name}. It uses RSA by default, and it can create an EC keypair. |
sign(storage, key_name, payload) |
It signs a String payload and returns a base64 signature. It reads the key record from :pki:keys:{key_name}. |
verify(storage, key_name, payload, signature) |
It verifies a signature and returns true or false. It raises only on an OpenSSL error. |
demote(storage, key_name) |
It removes the sign scope from a key, so the key only verifies. It writes a new key record, and the append-only history stays. |
key_exists?(storage, key_name) |
It reports whether a key is present. |
.to_s on a hash, because that order is not stable. The caller builds the canonical form first (sorted keys, JSON.generate). Crossing#canonical is the canonical form for a crossing..public_key, which does not verify. The module reads the key back through OpenSSL::PKey.read(private_key.public_to_pem).:pki:keys:{name}. A demotion appends a new record rather than a change in place. The full lifecycle therefore stays in the append log. Any storage driver serves it — an in-memory sqlite store for a test, a persistent store for production. A resolver tag such as !SSM or !Vault can fill :pki: at boot with real key material.Crossing#sign generates a key on first use when the identity has none. Production provisions real keys at boot. A test gets a temporary key with no setup.Crossing#sign(storage) reads the boundary's declared identity, calls Activities::PKI.generate (idempotent), then Activities::PKI.sign over Crossing#canonical. It sets the signature on the crossing, and the signature enters the record's canonical form for a later check.
Context#soft_verify runs crossing.verified?(storage) on append, and stores the result in a parallel array. The .signed filter reads that array. A forged crossing enters the audit trail, and a trust filter hides it. See wanderland-core-context for the trust model and wanderland-core-merkle-dag for the chain.
wanderland-core/lib/wanderland/activities/pki.rb — the module.A refresh removed the earlier object interface (Wanderland::PKI::Backend and PKI::Local). Activities::PKI is the single path — a functional module over storage.
wanderland.dev