TrustRoll

Sequence-aware cryptographic trust-rotation safety verifier.

TrustRoll checks whether a staged root/anchor rotation remains both available and appropriately scoped while old/new credentials and lagging consumers coexist.

Why this is not another certificate manager

It does not issue, renew, distribute, or automatically rotate production certificates. Existing systems already do that. TrustRoll consumes test PEMs plus a rollout contract and verifies the sequence.

Requirements

• Python 3.10+
• OpenSSL available on PATH
• No Python runtime dependencies

Quick start

python -m pip install https://github.com/virajsabhaya23/trustroll/releases/download/v0.1.0/trustroll-0.1.0-py3-none-any.whl

python -m trustroll verify examples/safe.json --out out/safe-report.json
python -m trustroll verify examples/unsafe.json --out out/unsafe-report.json --minimized out/minimized.json

Unsafe plans exit 2.

Benchmark

python -m trustroll benchmark benchmark/corpus.json --out benchmark/results.json

The 40-case corpus has 25 unsafe cases and 15 safe controls. Direct certificate paths use real OpenSSL verification. Consul-style cross-sign bridge controls are explicitly modeled because this project is a verifier, not a Consul CA implementation.

Contract shape

A contract declares roots, leaves, phases, consumers, current/previous bundles, async refresh behavior, required communication edges, retirement rules, and allowed roots.

Evidence

Reports include every failure, the first counterexample, phase/schedule coverage, and a deterministic SHA-256 certificate. evidence/ preserves research provenance and source hashes.

Limitations

• v0.1 models X.509 root trust and bounded async refresh, not every mesh implementation detail.
• Long-lived TLS session resumption, revocation, OCSP/CRL, and real cluster capture are future adapters.
• Cross-sign bridge semantics are declared rather than generated with a full Consul CA implementation.