Documentation
¶
Index ¶
- type Authority
- func (authority *Authority) AuditAnchorPath() string
- func (authority *Authority) AuditPrivateKey() ed25519.PrivateKey
- func (authority *Authority) AuditPublicKey() ed25519.PublicKey
- func (authority *Authority) AuditVerificationKeys() map[string]ed25519.PublicKey
- func (authority *Authority) AuthorityCertificates() map[string]*x509.Certificate
- func (authority *Authority) DeriveEnrollmentToken(actorID, operationID string) ([]byte, error)
- func (authority *Authority) HistoricalAuditPublicKeys() []ed25519.PublicKey
- func (authority *Authority) IssueNodeCertificate(nodeID string, publicKey ed25519.PublicKey, now time.Time) (string, error)
- func (authority *Authority) RecoveryCredentialPath() string
- func (authority *Authority) VerifyRecoveryCredential(credential string) bool
- type Deployment
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Authority ¶
type Authority struct {
Deployment Deployment
CACert *x509.Certificate
// contains filtered or unexported fields
}
func (*Authority) AuditAnchorPath ¶
func (*Authority) AuditPrivateKey ¶
func (authority *Authority) AuditPrivateKey() ed25519.PrivateKey
func (*Authority) AuditPublicKey ¶
func (*Authority) AuditVerificationKeys ¶
AuditVerificationKeys returns defensive copies of every current and historical audit public key retained by this deployment. Callers can use it to verify persisted audit entries across future key rotations.
func (*Authority) AuthorityCertificates ¶
func (authority *Authority) AuthorityCertificates() map[string]*x509.Certificate
AuthorityCertificates returns defensive certificate copies indexed by their stable authority key IDs. Historical CA certificates remain available for certificate and signature verification after a future CA rotation.
func (*Authority) DeriveEnrollmentToken ¶
DeriveEnrollmentToken returns a deterministic 64-byte secret for one authenticated operator operation. This keeps one-time token plaintext out of durable storage while making a lost response safely retryable.
func (*Authority) HistoricalAuditPublicKeys ¶
HistoricalAuditPublicKeys is the verification-only slice accepted by audit.NewWithKeyring. The currently active audit public key is omitted.
func (*Authority) IssueNodeCertificate ¶
func (*Authority) RecoveryCredentialPath ¶
func (*Authority) VerifyRecoveryCredential ¶
VerifyRecoveryCredential compares a candidate with the stored digest without retaining or re-reading the one-time plaintext credential.
type Deployment ¶
type Deployment struct {
DeploymentID string `json:"deploymentId"`
OperatorID string `json:"operatorId"`
AuthorityKeyID string `json:"authorityKeyId"`
AuditKeyID string `json:"auditKeyId"`
CAPublicKeyHash string `json:"caPublicKeyHash"`
AuditPublicKeyHash string `json:"auditPublicKeyHash"`
VerificationKeyringHash string `json:"verificationKeyringHash"`
RecoveryCredentialHash string `json:"recoveryCredentialHash"`
CreatedAt time.Time `json:"createdAt"`
StateSignature string `json:"stateSignature"`
}
func (Deployment) VerifyRecoveryCredential ¶
func (deployment Deployment) VerifyRecoveryCredential(credential string) bool
VerifyRecoveryCredential performs the candidate comparison in constant time once the persisted SHA-256 digest has been validated.
Source Files