Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ChainHash ¶ added in v0.2.0
ChainHash binds an event to its position and the preceding chain. Any change to the event, its sequence number, or any earlier record changes this value. json.Marshal is deterministic here: AuditEvent has a fixed field order and encoding/json sorts map keys, so Metadata serialises stably.
Types ¶
type Anchor ¶ added in v0.2.0
type Anchor struct {
Version int `json:"version"`
Count int `json:"count"`
Head string `json:"head"`
Pending *AnchorCheckpoint `json:"pending,omitempty"`
UpdatedAt time.Time `json:"updated_at"`
}
Anchor is the durable sidecar head used to detect end-truncation. Pending is written before the WAL append and cleared after the append is fsync'd, so a crash can be reconciled without trusting a shorter WAL.
type AnchorCheckpoint ¶ added in v0.2.0
AnchorCheckpoint is a recorded audit WAL head.
type Entry ¶ added in v0.2.0
type Entry struct {
Seq int `json:"seq"`
PrevHash string `json:"prev_hash"`
Hash string `json:"hash"`
Event model.AuditEvent `json:"event"`
}
Entry is one tamper-evident audit record: the event plus its position and the hash that chains it to the previous record.
type Result ¶ added in v0.2.0
type Result struct {
Count int `json:"count"`
Head string `json:"head"`
Anchor *Anchor `json:"anchor,omitempty"`
}
Result summarises a chain verification.
func Verify ¶ added in v0.2.0
Verify walks an audit WAL and validates the hash chain: sequence numbers must be contiguous from 1, each prev_hash must match the running head, and each hash must equal the recomputed ChainHash. It returns the verified count and head, or an error naming the first inconsistency (edit, reorder, gap, or mid-truncation). Truncation at the very end is detected by comparing the returned Head against an independently-anchored head (e.g. one shipped off-box).
func VerifyAnchoredFile ¶ added in v0.2.0
VerifyAnchoredFile verifies a WAL and then checks that its current head still matches the sidecar anchor. It returns the verified WAL result even when the anchor check fails, so callers can report the observed head to operators.
type Sink ¶
type Sink interface {
AppendAudit(model.AuditEvent) error
}
type WAL ¶ added in v0.2.0
type WAL struct {
// contains filtered or unexported fields
}
WAL is an append-only, hash-chained audit log file. It is the durable, tamper-evident channel: it is only ever appended to and fsync'd, so a rewrite of the main JSON state cannot silently erase audit history, and any edit, reorder, or truncation of the WAL itself is detectable by Verify.
func OpenAnchoredWAL ¶ added in v0.2.0
OpenAnchoredWAL opens a WAL with a separate sidecar anchor file. Existing WALs without an anchor are bootstrapped to their current verified head; after that, the anchor is authoritative for detecting end-truncation.
func OpenWAL ¶ added in v0.2.0
OpenWAL opens (creating if needed) the append-only audit WAL at path and recovers the chain head by verifying existing records. It fails loudly if the existing chain does not verify, so corruption cannot be silently extended.
Source Files