Help us shape the future of Go! Take the 2026 Go Developer Survey

signer

package
v0.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 1, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Overview

Package signer keeps the CA key away from the gate (decision D3): the signer process alone reads the key and issues leaf certificates over a Unix socket to the uids it allows; the gate asks it for each host it decrypts.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Listen 

func Listen(path string) (net.Listener, error)

Listen opens the socket at path (mode 0660; the directory is the caller's).

Types

type Client 

type Client struct {
	Path string
	// CACert is the CA certificate the leaves must chain to.
	CACert *x509.Certificate
	// Dial replaces the socket dial (tests).
	Dial func(ctx context.Context) (net.Conn, error)
	// contains filtered or unexported fields
}

Client asks a signer for leaves and caches them; it implements the gate's CertSource. It checks each leaf against the CA certificate.

func (*Client) Certificate 

func (c *Client) Certificate(ctx context.Context, host string) (*tls.Certificate, error)

Certificate implements gate.CertSource.

type Server 

type Server struct {
	CA *ca.CA
	// AllowUIDs may ask; empty allows the signer's own uid only.
	AllowUIDs []int
	// PeerUID replaces the kernel's peer check (tests).
	PeerUID func(net.Conn) (int, error)
	Log     io.Writer
}

Server issues leaves to allowed peers.

func (*Server) Serve 

func (s *Server) Serve(ln net.Listener) error

Serve answers on ln until it closes.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.