Module signing 

2026-09-26: Ed25519 signatures binding a gate record to the commit it measured.

The key is generated on the box on first use, so a signature does not prove who ran a benchmark. It proves that the record file and the sha passed to verify_record are the ones the key holder signed: editing the file or re-pointing it at another commit breaks the signature. A new signer’s public key is a one-line .pub file under .github/record-signers/, which a reviewer sees in the diff.

Owner: bench gate (signing). Invariants:

• Private key material is written only by write_private. On unix it creates a new file with mode 0600; elsewhere it is a plain write.
• verify_record returns Ok only for a valid signature under a key file present in REGISTRY_DIR, or for an unsigned record recorded before SIGNATURE_REQUIRED_AFTER.

Structs

Identity

2026-09-26: The signing identity for this machine.

Enums

Verified

2026-09-26: The outcome of a successful verify_record.

Constants

REGISTRY_DIR

2026-09-26: Where a signer’s public key is published, relative to the repo root.

SIGNATURE_REQUIRED_AFTER

2026-09-26: Unix seconds (2026-09-01T13:13:20Z). A record whose recorded_at is below this and that has no .sig verifies as Verified::Exempt; at or after it, a .sig is required. signing_tests::no_committed_record_escapes_the_cutover_unsigned checks every committed record against it.

Functions

committed_signers

2026-09-26: Fingerprints of the .pub files git tracks under .github/record-signers/. Asks git ls-files, so a key register wrote but nobody committed is absent. Errors when git cannot answer.

fingerprint_of

2026-09-26: Short name for a public key: the first 16 hex digits (8 bytes) of its SHA-256. It names the key file and appears in messages; the full key is what verifies.

load_or_create

2026-09-26: Load this machine’s identity from <metrale_home>/identity/ed25519.pk8, generating and writing one on first use. Prints nothing; an unreadable, unwritable or unusable key is an error.

register

2026-09-26: Write this identity’s public key to <root>/.github/record-signers/<fingerprint>.pub unless that file exists. Returns whether it wrote, so the caller asks for a commit only once.

sig_path

2026-09-26: <record>.json → <record>.json.sig: appends .sig to the whole file name.

sign_record

2026-09-26: Sign a record file already on disk with its sha; writes and returns the .sig sidecar path.

signer_notice

2026-09-26: The operator notice when fingerprint is not among the committed signers, or None when it is. Pure.

verify_record

2026-09-26: Verify a record’s .sig sidecar against git_sha.