Class ChannelAttestation

java.lang.Object

ai.badmonkey.agentspaces.identity.tls.ChannelAttestation

public final class ChannelAttestation
extends Object

The one attestation call every attesting binding makes after its handshake (spec §5.6): the identity-endorsed mode pins the leaf's PeerID through ChannelCertificate.attest(X509Certificate); the enterprise-CA mode validates the full chain under the current ChannelTrust, read afresh on every call so a refreshed CRL takes effect on the next handshake.

Method Summary

Modifier and Type	Method	Description
static Optional<PeerId>	attest(X509Certificate[] chain, Supplier<ChannelTrust> trust)	Attests a presented chain.
static X509Certificate[]	x509(Certificate[] chain)	Narrows a presented chain to X.509, leaf first.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

attest

public static Optional<PeerId> attest(X509Certificate[] chain,
 Supplier<ChannelTrust> trust)

Attests a presented chain.

Parameters:

chain - the chain the handshake presented, leaf first; may be empty

trust - the CA trust source, or null for the identity-endorsed mode

Returns:

the attested PeerID, or empty when the chain proves nothing; a failure inside the trust is read as unattested, never thrown

x509

public static X509Certificate[] x509(Certificate[] chain)

Narrows a presented chain to X.509, leaf first.

Parameters:

chain - the presented certificates, possibly null

Returns:

the X.509 chain, or empty when absent or any element is not X.509