poolkey

Overview ¶

Package poolkey is the one place the binary's trusted pool key lives.

THE KEY HAS ONE HOME AND IT IS HERE. A fetched index's detached signature is checked under an ed25519 public key the build carries, and the same key appears in the relay's wrangler.toml and in the mirror workflow — but in Go it is spelled exactly once, in this package, and every reader of it (cmd/codeaf's verbs and the seed generator beside the index) imports this rather than repeating the base64. A second spelling is a key two readers can drift apart on, and a signature one of them cannot check.

The key is the index signer's public half, and it is public: the private seed is the relay's POOL_SIGNING_KEY secret and is never stored in the repository.