nx_spore_sign_gate.nx
buildroot/runtime/nx_spore_sign_gate.nx
about
nx_spore_sign_gate.nx -- spore-cas-signed: Ed25519 PROVENANCE over the germination seed.
Per-piece FNV hashes (the manifest) prove each piece's integrity; THIS proves the WHOLE
seed's PROVENANCE: the manifest is Ed25519-SIGNED, and a forged/altered seed -- or a
signature from the wrong key -- is REJECTED before germination (charter: Ed25519-signed
manifest gated by operator_root_pk).
SIGN -- ed25519_sign_full(priv, manifest_bytes) -> 64B sig; emit .sig sidecar.
VERIFY -- ed25519_verify_full(pub, manifest_bytes, sig) == OK (1).
NEG-1 -- tamper one manifest byte -> verify == BAD (0) [forged seed rejected].
NEG-2 -- verify with a DIFFERENT pubkey -> BAD (0) [only the real key validates].
verdict GREEN iff OK + both NEG rejected.
Composes the KAT-verified Ed25519 (nx_ed25519_signature, RFC 8032) over the real seed
artifact knowledge/registry/germination_manifest.tsv (from nx_spore_manifest_gate).
Build/run (nxc2 cwd): _offc/nx_sov_build_run.elf nx_spore_sign_gate
genealogy_id: nishi_spore_seed_portability_charter (spore-cas-signed)
dependencies 3 imports · 0 importers
imports: nx_syscalls.nxnx_ed25519_signature.nxnx_gate_verdict.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 22 | const SIG_PATH: *u8 = "knowledge/registry/germination_manifest.sig" |
| 23 | const MAN_PATH: *u8 = "knowledge/registry/germination_manifest.tsv" |
functions
| 25 | func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } |
| 26 | func g_puts(s: *u8) -> i64 { sys_write(1, s, g_slen(s)); return 0 } |
| 27 | func g_puts_fd(fd: i64, s: *u8) -> i64 { sys_write(fd, s, g_slen(s)); return 0 } |
| 28 | func g_putn(fd: i64, v: i64) -> i64 |
| 42 | func main() -> i64 |