Documentation
¶
Index ¶
- Variables
- func CleanupSensitiveTemp(path string) error
- func CreateSensitiveTemp(dir, pattern string) (*os.File, error)
- func PreparePrivateDirectory(path string) error
- func ValidatePrivateFile(path string) error
- type PrivateReplace
- type Target
- func (t *Target) AtomicWrite(raw []byte, mode os.FileMode) error
- func (t *Target) AtomicWritePrivate(raw []byte) error
- func (t *Target) BeginPrivateReplace(reserve int64) (*PrivateReplace, error)
- func (t *Target) Path() string
- func (t *Target) Read() ([]byte, os.FileInfo, error)
- func (t *Target) Verify() error
- func (t *Target) WithLock(ctx context.Context, timeout, retry time.Duration, fn func() error) error
Constants ¶
This section is empty.
Variables ¶
var ErrTargetReplaced = errors.New("configuration target was replaced")
Functions ¶
func CleanupSensitiveTemp ¶
CleanupSensitiveTemp removes a file created by CreateSensitiveTemp and its empty private staging directory. It is safe to call after the file has been atomically moved to its final destination.
func CreateSensitiveTemp ¶
CreateSensitiveTemp creates a temporary file inside a freshly-created, current-user-only staging directory. The directory and file are both normalized and verified before the caller can write credential material.
func PreparePrivateDirectory ¶
func ValidatePrivateFile ¶
Types ¶
type PrivateReplace ¶
type PrivateReplace struct {
// contains filtered or unexported fields
}
func (*PrivateReplace) Abort ¶
func (p *PrivateReplace) Abort() error
func (*PrivateReplace) Commit ¶
func (p *PrivateReplace) Commit(raw []byte) error
type Target ¶
type Target struct {
// contains filtered or unexported fields
}
Target is the stable filesystem target behind a requested configuration path. Resolving symlinks once and verifying them again under the sidecar lock prevents a writer from silently switching files during a transaction.
func (*Target) AtomicWritePrivate ¶
AtomicWritePrivate replaces a credential-bearing file with a canonical current-user-only file. Unlike AtomicWrite, it never preserves arbitrary security metadata from the old target.
func (*Target) BeginPrivateReplace ¶
func (t *Target) BeginPrivateReplace(reserve int64) (*PrivateReplace, error)
BeginPrivateReplace prepares and reserves space for a private atomic replacement before a remote one-time credential rotation is attempted.
Source Files