Documentation
¶
Overview ¶
Package signerx is the apic abstraction over hardware- and KMS-backed crypto.Signer providers (PKCS#11 HSMs, AWS KMS, Azure Key Vault, etc.). It exists so the rest of the runtime (TLS, JWT, OIDC client assertions) never holds raw private key bytes -- everything goes through a Backend.
Index ¶
- Variables
- func CatalogNames() []string
- func Deregister(name string)
- func GetCertificateForServer(b Backend, ref KeyRef) func(*tls.ClientHelloInfo) (*tls.Certificate, error)
- func KnownBackend(name string) bool
- func Names() []string
- func Register(name string, f Factory)
- func SignJWT(_ context.Context, signer crypto.Signer, alg jwa.SignatureAlgorithm, ...) ([]byte, error)
- type Backend
- type BackendConfig
- type Factory
- type KeyRef
- type SignerHandle
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnknownBackend = errors.New("signerx: unknown backend") ErrKeyNotFound = errors.New("signerx: key not found") ErrFIPSForbidsBackend = errors.New("signerx: backend forbidden in FIPS mode") )
Sentinel errors.
Functions ¶
func CatalogNames ¶ added in v0.14.3
func CatalogNames() []string
CatalogNames returns the sorted static backend catalog (see KnownBackend).
func GetCertificateForServer ¶
func GetCertificateForServer(b Backend, ref KeyRef) func(*tls.ClientHelloInfo) (*tls.Certificate, error)
GetCertificateForServer returns a tls.Config.GetCertificate callback that fetches a fresh handle from b on first call and caches it for the lifetime of the listener. Backends that perform expensive Open (PKCS#11 login, KMS GetPublicKey) pay the cost once.
A nil Backend or a Backend.Open error is surfaced lazily — the returned callback returns the error to crypto/tls on the first handshake. Callers that need eager failure should call b.Open themselves before passing the result here.
func KnownBackend ¶ added in v0.14.3
KnownBackend reports whether name is a backend this repository ships a factory for (see catalogNames), regardless of the current process's build tags. Generate-time config validation (cmd/apic) uses this instead of Names() because the generator never imports a backend subpackage.
func Register ¶
Register installs f under name. Each build-tagged backend file registers itself in an init().
func SignJWT ¶
func SignJWT(_ context.Context, signer crypto.Signer, alg jwa.SignatureAlgorithm, claims jwt.Token) ([]byte, error)
SignJWT signs claims using signer under alg. signer can be any crypto.Signer including those returned by Backend.Open (PKCS#11, KMS, softfile). The returned bytes are a compact-serialized JWS.
FIPS deployments select RS256 / ES256 / PS256 to satisfy SC-13 + IA-7 (FIPS-validated cryptographic authentication).
Types ¶
type Backend ¶
type Backend interface {
// Name returns the provider name ("softfile", "pkcs11", etc.)
Name() string
// Open returns a SignerHandle for the key identified by ref.
Open(ctx context.Context, ref KeyRef) (SignerHandle, error)
// Close releases backend resources.
Close() error
}
Backend is implemented by every signer provider.
type BackendConfig ¶
BackendConfig is the raw JSON-like config passed to a Backend factory.
type Factory ¶
type Factory func(BackendConfig) (Backend, error)
Factory constructs a Backend from raw config.
type KeyRef ¶
type KeyRef struct {
ID string
PIN string // activation PIN for PKCS#11 backends; ignored elsewhere
}
KeyRef identifies a key within a Backend. The ID is opaque to signerx and interpreted per backend (PKCS#11: CKA_LABEL or hex CKA_ID; AWS KMS: key ARN; Azure: vault key ID URL; softfile: filesystem path).
type SignerHandle ¶
type SignerHandle struct {
Signer crypto.Signer
Public crypto.PublicKey
// Cert, when non-nil, is the X.509 leaf associated with the key in
// the backend (PKCS#11 CKO_CERTIFICATE or KMS GetPublicKey+lookup).
Cert []byte
}
SignerHandle binds an opened key to its crypto.Signer and PublicKey.
Source Files
Directories