Crate confium_log_server

Expand description

confium-log-server — public transparency log server.

Reference implementation of log.confium.org. An append-only Merkle transparency log (RFC 6962 / RFC 9162) with first-class support for certificate entries — every Confium-issued cert (CNML, code-signing, SSH, document-signing, TLS) gets anchored automatically and is queryable by fingerprint.

§Architecture

Single binary, embedded SQLite storage, no external services to operate. The Merkle tree is materialized incrementally on each append; reads serve from in-memory cache.

§Quickstart

$ cargo run -p confium-log-server -- --db /var/lib/confium/log.db --listen 0.0.0.0:8080
# listening on http://0.0.0.0:8080

§API

§Hash entries (generic)

POST /v1/append — append a SHA-256 hash GET /v1/head — current tree head GET /v1/proof/<sequence> — inclusion proof GET /v1/consistency/<old_size> — consistency proof

§Certificate entries (cert-aware)

POST /v1/certificates — append a DER-encoded X.509 cert GET /v1/certificates/<fingerprint> — lookup by SHA-256 fingerprint GET /v1/issuers/<issuer>/certificates — list certs by issuer DN

§Bitcoin OTS anchoring

GET /v1/head/<sequence>/ots — OTS proof for tree head at sequence

§Witness gossip

POST /v1/head/<sequence>/witness — submit a witness countersignature GET /v1/head/<sequence>/witnesses — list known witnesses for tree head

Modules§

api 🔒: Axum router + handlers for the log server API.
cert 🔒: Certificate parsing for the log server.
db 🔒: SQLite-backed append-only log storage.
merkle 🔒: Merkle tree state for the log server.
ots_anchor 🔒: Bitcoin OTS anchor loop.
witness 🔒: Witness gossip protocol.

Structs§

Args: Command-line arguments for the log server.

Functions§

main 🔒