Directories
¶
| Path | Synopsis |
|---|---|
|
Package acme is the ACME server (RFC 8555) for the internal CAs (PHASE2).
|
Package acme is the ACME server (RFC 8555) for the internal CAs (PHASE2). |
|
jose
Package jose reads the JSON Web Signatures of ACME requests (RFC 7515, RFC 8555 §6.2) – own code for the parsing and the rules, cryptography only from the standard library (owner Q3, 2026-10-22).
|
Package jose reads the JSON Web Signatures of ACME requests (RFC 7515, RFC 8555 §6.2) – own code for the parsing and the rules, cryptography only from the standard library (owner Q3, 2026-10-22). |
|
Package audit writes and verifies the hash-chained audit logs (PLAN §5, security.md "Audit log").
|
Package audit writes and verifies the hash-chained audit logs (PLAN §5, security.md "Audit log"). |
|
Package auth signs users in to the admin listener (PHASE1 step 10, security.md "Authentication"): Argon2id passwords, TOTP (RFC 6238), recovery codes, server-side sessions, CSRF protection, throttling and lockout.
|
Package auth signs users in to the admin listener (PHASE1 step 10, security.md "Authentication"): Argon2id passwords, TOTP (RFC 6238), recovery codes, server-side sessions, CSRF protection, throttling and lockout. |
|
passkeytest
Package passkeytest is a virtual WebAuthn authenticator for tests (PHASE1 step 17): it answers the options of navigator.credentials.create() and .get() the way a browser with a platform authenticator does – ECDSA P-256, attestation "none", user verification done.
|
Package passkeytest is a virtual WebAuthn authenticator for tests (PHASE1 step 17): it answers the options of navigator.credentials.create() and .get() the way a browser with a platform authenticator does – ECDSA P-256, attestation "none", user verification done. |
|
Package authz decides who may do what (security.md "Authorization", PHASE1 step 10).
|
Package authz decides who may do what (security.md "Authorization", PHASE1 step 10). |
|
Package backup makes, checks and restores backups of an instance (PHASE1 step 16): every database as one consistent copy (VACUUM INTO, also while the server runs), the audit databases last, a manifest with SHA-256 per file and the head of every audit chain.
|
Package backup makes, checks and restores backups of an instance (PHASE1 step 16): every database as one consistent copy (VACUUM INTO, also while the server runs), the audit databases last, a manifest with SHA-256 per file and the head of every audit chain. |
|
Package ca is the CA engine: it issues end-entity certificates from a preset, after checking everything a request contains (PHASE1 step 7).
|
Package ca is the CA engine: it issues end-entity certificates from a preset, after checking everything a request contains (PHASE1 step 7). |
|
legacy
Package legacy reads a PKI directory of legacy/pki.sh (PHASE1 step 15): pki.conf, the root and intermediate CAs (ca.meta, certs/ca.crt, private/ca.key, index.txt, newcerts/, crlnumber, crl/ca.crl, archive/) and the issued certificates (issued/<name>/cert.meta, cert.pem, key.pem, archive/).
|
Package legacy reads a PKI directory of legacy/pki.sh (PHASE1 step 15): pki.conf, the root and intermediate CAs (ca.meta, certs/ca.crt, private/ca.key, index.txt, newcerts/, crlnumber, crl/ca.crl, archive/) and the issued certificates (issued/<name>/cert.meta, cert.pem, key.pem, archive/). |
|
legacy/legacytest
Package legacytest writes a small directory in the format of legacy/pki.sh with Go only – for tests that must run without bash and OpenSSL (Windows, macOS).
|
Package legacytest writes a small directory in the format of legacy/pki.sh with Go only – for tests that must run without bash and OpenSSL (Windows, macOS). |
|
preset
Package preset loads and validates certificate presets – profiles such as "server" or "smime" that decide which key usages, extended key usages and subject alternative names an end-entity certificate gets.
|
Package preset loads and validates certificate presets – profiles such as "server" or "smime" that decide which key usages, extended key usages and subject alternative names an end-entity certificate gets. |
|
Package clock provides the injectable clock (go-conventions.md "Time").
|
Package clock provides the injectable clock (go-conventions.md "Time"). |
|
Package config loads the server configuration: one YAML file, decoded strictly, plus MYOWNPKI_* environment overrides (go-conventions.md "Configuration", PLAN §14).
|
Package config loads the server configuration: one YAML file, decoded strictly, plus MYOWNPKI_* environment overrides (go-conventions.md "Configuration", PLAN §14). |
|
Package httpapi is the REST API of the admin listener (api/openapi.yaml, PHASE1 step 13): hand-written on net/http and encoding/json.
|
Package httpapi is the REST API of the admin listener (api/openapi.yaml, PHASE1 step 13): hand-written on net/http and encoding/json. |
|
Package ids creates the opaque IDs of database rows (PHASE1 §1: "ULID-like").
|
Package ids creates the opaque IDs of database rows (PHASE1 §1: "ULID-like"). |
|
Package keys holds the key hierarchy of the online CA keys (PLAN §5 "Keys", security.md "Key storage"):
|
Package keys holds the key hierarchy of the online CA keys (PLAN §5 "Keys", security.md "Key storage"): |
|
Package pkcs12 writes PKCS#12 files (RFC 7292) for the key export (PHASE1 step 18): the private key in a PBES2-encrypted bag (PBKDF2 with HMAC-SHA256, AES-256-CBC), the certificates in a plain bag, and an HMAC-SHA256 integrity MAC – what OpenSSL 3 writes by default and what Windows 10 (1709+), macOS, Java and OpenSSL import.
|
Package pkcs12 writes PKCS#12 files (RFC 7292) for the key export (PHASE1 step 18): the private key in a PBES2-encrypted bag (PBKDF2 with HMAC-SHA256, AES-256-CBC), the certificates in a plain bag, and an HMAC-SHA256 integrity MAC – what OpenSSL 3 writes by default and what Windows 10 (1709+), macOS, Java and OpenSSL import. |
|
Package publish serves what certificates point to: CA certificates (AIA caIssuers) and CRLs (CRL distribution point) – plain HTTP on the public listener, no login (PHASE1 step 9; wired into the listener in step 12).
|
Package publish serves what certificates point to: CA certificates (AIA caIssuers) and CRLs (CRL distribution point) – plain HTTP on the public listener, no login (PHASE1 step 9; wired into the listener in step 12). |
|
Package server runs MyOwnPKI (PHASE1 step 12): the admin listener with TLS, the public listener for CRLs and CA certificates, and the background jobs (audit delivery and checkpoints, CRL renewal, clean-ups).
|
Package server runs MyOwnPKI (PHASE1 step 12): the admin listener with TLS, the public listener for CRLs and CA certificates, and the background jobs (audit delivery and checkpoints, CRL renewal, clean-ups). |
|
Package setup is myownpki init (PHASE1 step 11): unseal passphrase, recovery key, auth key, the first user with TOTP and – optionally – an online test CA.
|
Package setup is myownpki init (PHASE1 step 11): unseal passphrase, recovery key, auth key, the first user with TOTP and – optionally – an online test CA. |
|
Package store opens the SQLite databases (ADR-06), keeps their schemas migrated and knows where each file lives in the data directory (PLAN §4).
|
Package store opens the SQLite databases (ADR-06), keeps their schemas migrated and knows where each file lives in the data directory (PLAN §4). |
|
migrate
Package migrate applies SQL schema migrations to one SQLite database (PLAN §4, decided instead of goose).
|
Package migrate applies SQL schema migrations to one SQLite database (PLAN §4, decided instead of goose). |
|
Package tenant holds the settings of a tenant (PHASE1 step 18): whether the server may generate keys, and the subject defaults that fill empty fields of a request – what pki.conf of legacy/pki.sh did.
|
Package tenant holds the settings of a tenant (PHASE1 step 18): whether the server may generate keys, and the subject defaults that fill empty fields of a request – what pki.conf of legacy/pki.sh did. |
|
Package testinstance builds an initialized instance for tests of the HTTP layers (API, web UI): init --demo with the test CA, the services wired like the server does, a fake clock and helpers for users and TOTP codes.
|
Package testinstance builds an initialized instance for tests of the HTTP layers (API, web UI): init --demo with the test CA, the services wired like the server does, a fake clock and helpers for users and TOTP codes. |
|
Package testutil holds helpers that tests of several packages share.
|
Package testutil holds helpers that tests of several packages share. |
|
tools
|
|
|
commonpasswords
command
Command commonpasswords builds internal/auth/common-passwords.txt, the list of common passwords that new passwords are checked against (NIST SP 800-63B, PHASE1 step 10).
|
Command commonpasswords builds internal/auth/common-passwords.txt, the list of common passwords that new passwords are checked against (NIST SP 800-63B, PHASE1 step 10). |
|
screenshots
command
Command screenshots renders the real UI of a throwaway demo instance with a headless Chromium-based browser (Edge, Chrome, Chromium) and writes losslessly optimized PNGs for the README to docs/screenshots.
|
Command screenshots renders the real UI of a throwaway demo instance with a headless Chromium-based browser (Edge, Chrome, Chromium) and writes losslessly optimized PNGs for the README to docs/screenshots. |
|
Package version reports how a MyOwnPKI binary was built.
|
Package version reports how a MyOwnPKI binary was built. |
|
Package web serves the admin UI: templ pages, the embedded static assets and the security headers every response gets.
|
Package web serves the admin UI: templ pages, the embedded static assets and the security headers every response gets. |
|
components
templ: version: v0.3.1070
|
templ: version: v0.3.1070 |
|
fixture
Package fixture provides fixed sample data for the UI prototype in dev mode.
|
Package fixture provides fixed sample data for the UI prototype in dev mode. |
|
layout
templ: version: v0.3.1070
|
templ: version: v0.3.1070 |
|
pages/admin
templ: version: v0.3.1070
|
templ: version: v0.3.1070 |
|
pages/authorities
templ: version: v0.3.1070
|
templ: version: v0.3.1070 |
|
pages/certificates
templ: version: v0.3.1070
|
templ: version: v0.3.1070 |
|
pages/design
Package design renders the component gallery at /design: every CSS class of web/styles is shown with realistic sample data (frontend.md).
|
Package design renders the component gallery at /design: every CSS class of web/styles is shown with realistic sample data (frontend.md). |
|
pages/overview
templ: version: v0.3.1070
|
templ: version: v0.3.1070 |
|
view
Package view holds the types shared by the shell, components and pages: page metadata, the user's appearance preferences, status values and date formatting.
|
Package view holds the types shared by the shell, components and pages: page metadata, the user's appearance preferences, status values and date formatting. |
Click to show internal directories.
Click to hide internal directories.