Class KeyringSignatureExecutor

java.lang.Object

zeroecho.core.storage.KeyringSignatureExecutor

public final class KeyringSignatureExecutor
extends Object

Executes a streaming signature while confining private-key resolution to the keyring-owning library boundary.

Instances retain only the owning KeyringStore and ZeroEchoSession; they never retain, expose, encode, or log private key material. Each invocation resolves its key entries independently and creates operation-local signature contexts. Instances are safe for concurrent use when callers provide independent content and cancellation objects.

Signing runs in O(n) time for an n-byte payload and uses O(1) transfer memory plus storage bounded by the selected algorithm's signature length. The executor closes streams opened for the invocation but does not close the caller-owned RepeatableContent.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	KeyringSignatureExecutor.Cancellation	Cause-free marker indicating cancellation observed at a documented signing checkpoint.
static final class	KeyringSignatureExecutor.Failure	Checked, redacted failure raised by key resolution or provider execution.
static enum	KeyringSignatureExecutor.FailureCode	Stable, non-sensitive failure categories.

Constructor Summary

Constructors

Constructor	Description
KeyringSignatureExecutor(KeyringStore keyring, ZeroEchoSession session)	Creates an executor bound to an open keyring and a session.

Method Summary

Modifier and Type	Method	Description
byte[]	sign(String privateAlias, AlgorithmIdentity algorithmIdentity, RepeatableContent content, CancellationSignal cancellation)	Signs repeatable content using a private key resolved within this executor.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

KeyringSignatureExecutor

public KeyringSignatureExecutor(KeyringStore keyring,
 ZeroEchoSession session)

Creates an executor bound to an open keyring and a session.

Parameters:

keyring - owning keyring used to resolve provider-local aliases

session - session whose policy and provider configuration govern signing

Throws:

NullPointerException - if either argument is null

Method Details

sign

public byte[] sign(String privateAlias,
 AlgorithmIdentity algorithmIdentity,
 RepeatableContent content,
 CancellationSignal cancellation)
            throws IOException,
KeyringSignatureExecutor.Failure

Signs repeatable content using a private key resolved within this executor.

The algorithm identity must resolve to a registered interop profile through its canonical form. The stored private-key entry must carry that profile's exact key algorithm identifier. Cancellation is checked before key resolution, before opening the content, and between bounded reads.

Parameters:

privateAlias - provider-local private-key alias; must not be blank

algorithmIdentity - exact canonical signature identity

content - caller-owned repeatable content; never closed here

cancellation - cancellation signal consulted during the operation

Returns:

independently owned external signature bytes

Throws:

IllegalArgumentException - if an alias is blank or the identity is not a signature identity

NullPointerException - if any non-alias argument is null

IOException - if keyring resolution, authentication, or filesystem I/O fails; if content opening or streaming fails; or if a stream makes zero progress

KeyringSignatureExecutor.Failure - if a key is unavailable, the algorithm does not match, or provider execution fails; LMS/XMSS keys yield ALGORITHM_MISMATCH