# `Aker.SigningKey`
[🔗](https://github.com/udin-io/aker/blob/v0.1.0/lib/aker/signing_key.ex#L1)

A private Ed25519 key: a licence issuer's root key, or a working key
the root key certifies. Only a signing task reads one, from a file kept off the
repository and off every server. `inspect/1` shows no key bytes, so a
crash or a log line that holds the key prints none.

`from_pem/1` takes what `openssl genpkey -algorithm ed25519` writes: one
unencrypted PKCS #8 block. It matches the block's fixed bytes instead of
calling a decoder, so a file that is not such a key gets one fixed error
and no exception that could print the file.

# `t`

```elixir
@opaque t()
```

# `from_pem`

```elixir
@spec from_pem(binary()) :: {:ok, t()} | :error
```

The key in a PEM file's text, or `:error` when the text is not one.

# `load`

```elixir
@spec load(Path.t(), Path.t()) :: {:ok, t()} | {:error, String.t()}
```

The key in the file at `path`, refused when the file sits inside `repo`,
the checkout a signing task runs in, so a key cannot be committed by
accident. Each failure is one fixed message that prints nothing of the
file.

# `public_key`

```elixir
@spec public_key(t()) :: String.t()
```

The raw 32-byte public key, base64, as a host's root key list holds it.

# `real_path`

```elixir
@spec real_path(Path.t()) :: {:ok, Path.t()} | {:error, :too_many_links}
```

`path` absolute, with every symlink along it followed, as far as the
links resolve. A part that does not exist is kept as written. Each `..`
applies after the link before it is followed, as the system applies it.
More than 40 links answers `{:error, :too_many_links}`.

# `sign`

```elixir
@spec sign(t(), binary()) :: binary()
```

The 64-byte Ed25519 signature of `message`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*