Module webizen_trust 

Webizen trust store — user-controlled trust anchors (P1).

The software provides the means to import, enable, disable, and evaluate roots; it does not silently redefine the OS PKI. Default suggested set is empty until the principal coins a bundle (AU community roots, etc.).

Honest scope of this module:

• Persist anchors (PEM certs, DID / front-door identifiers, labels).
• Produce a trust verdict for a URL (scheme + store membership + notes).
• Supply PEM material for our TLS clients (agent fetch via rustls/reqwest).
• OS WebView cert-override (WebView2 ServerCertificateErrorDetected) is a platform hook layered in webizen-desktop; this store is the policy source.

Structs

SignedSuggestedCatalog

Envelope for a suggested catalog signed by the principal.

SuggestedAnchor

One suggested anchor. Never auto-enabled unless enabled_by_default is true (must stay false until the principal explicitly curates a default).

SuggestedTrustCatalog

TrustAnchor

TrustStore

TrustVerdict

Enums

AnchorKind

CertOverrideDecision

Host / session / chain policy decision for cert-override (swarm-2).

Constants

CATALOG_VERSION

SUGGESTED_CATALOG_FILE

Suggested catalog (empty until principal curates). Relative to storage or bundled.

TRUST_STORE_FILE

Functions

bundled_catalog_path

Path to repo/package empty catalog when present.

catalog_signing_payload

Canonical bytes for signing: JSON of catalog with sorted keys (serde_json value dump).

cert_override_decision

Policy for ServerCertificateErrorDetected handlers (store only — no session). Prefer cert_override_decision_full for production hooks.

cert_override_decision_full

Full policy: store + optional session allow-once + optional chain verify result.

decision_allows

Whether the decision should allow the WebView TLS connection.

decision_reason

Audit-friendly reason string.

evaluate_url

Evaluate how our store thinks about this URL (does not replace OS TLS for WebView).

host_deny_material

Soft-deny material: host-deny:<host>

import_suggested_into_store

Import a suggested entry into the live store. force_enabled overrides enabled_by_default (UI “Enable now”).

load_signed_catalog_path

Load signed catalog from path; unsigned plain catalog still loads via SuggestedTrustCatalog.

spki_pin_material

SPKI pin material: spki-pin:<host>:<sha256hex>

verify_signed_catalog

Verify Ed25519 signature over the catalog payload.