Class CaSubjectProofBindings

java.lang.Object

zeroecho.pki.impl.core.continuation.CaSubjectProofBindings

public final class CaSubjectProofBindings
extends Object

Exact immutable binding between an internal proof and its parent CA/TBS intent.

Method Summary

Modifier and Type	Method	Description
static DomainCommandEncoding.Decoded	requireEnvelope(SignWorkflowStore.AcceptanceEnvelope envelope)	Checks retained metadata without opening either candidate or resolving codecs.
static void	requireLiveCandidates(StagedContentStore store, SignWorkflowStore.AcceptanceEnvelope envelope)	Reads both bounded live candidates and rejects challenge, intent, algorithm, SPKI or final-TBS substitution.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

requireEnvelope

public static DomainCommandEncoding.Decoded requireEnvelope(SignWorkflowStore.AcceptanceEnvelope envelope)

Checks retained metadata without opening either candidate or resolving codecs.

Parameters:

envelope - accepted composite CA envelope

Returns:

exact frozen proof command

requireLiveCandidates

public static void requireLiveCandidates(StagedContentStore store,
 SignWorkflowStore.AcceptanceEnvelope envelope)
                                  throws IOException

Reads both bounded live candidates and rejects challenge, intent, algorithm, SPKI or final-TBS substitution. No signature verification/provider call occurs.

Parameters:

store - owning content store

envelope - accepted/prospective composite envelope

Throws:

IOException - if content integrity or canonical DER validation fails