Documentation
¶
Overview ¶
Package egressattribution frames Runner-established execution identity before guest bytes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func WriteExecutionAttribution ¶
func WriteExecutionAttribution(writer io.Writer, attribution ExecutionAttribution) error
WriteExecutionAttribution must finish before the Runner forwards any guest bytes. The caller owns the connection's write deadline and closes it on failure.
Types ¶
type ExecutionAttribution ¶
type ExecutionAttribution struct {
TenantRef string `json:"tenantRef"`
SubjectRef string `json:"subjectRef"`
SandboxID string `json:"sandboxId"`
InstanceID string `json:"instanceId"`
AssignmentID string `json:"assignmentId"`
Generation int64 `json:"generation"`
AuthorizationRef string `json:"authorizationRef"`
ExpiresAt time.Time `json:"expiresAt"`
}
ExecutionAttribution belongs to one accepted connection for its entire lifetime. It contains correlation evidence, never credentials or the raw assignment fence.
func ReadExecutionAttribution ¶
ReadExecutionAttribution is for an authenticated Runner Unix peer, never a guest TCP peer. The caller supplies a read deadline; bytes following the preface remain unread.
func ReadRunnerExecutionAttribution ¶
func ReadRunnerExecutionAttribution(connection *net.UnixConn, runnerUID uint32, deadline time.Time) (ExecutionAttribution, error)
ReadRunnerExecutionAttribution authenticates the configured host peer before reading its preface. The caller must close on failure and retain ExpiresAt as the connection's maximum lifetime.
Source Files