Documentation
¶
Overview ¶
Package identity manages the behalf state directory and the two local Ed25519 keys that live in it:
- the device key — the human principal's root key. Its RFC 7638 JWK thumbprint is the OIDC nonce at `behalf login` (D5), which makes it the verified identity root. Generated fresh at login.
- the emitter key — the capture surface's own key (receipt-schema-v1.md §5, Q19). It signs receipt DSSE envelopes and is distinct from any human device key.
The state directory defaults to ~/.behalf, overridable via the BEHALF_HOME environment variable or an explicit --dir flag. Private key files are written with mode 0600 and the directory with 0700.
Index ¶
- Constants
- func BlobsDir(dir string) string
- func DeviceKeyPath(dir string) string
- func EmitterKeyPath(dir string) string
- func EnsureDir(dir string) error
- func NextEmitterCounter(dir string) (int, error)
- func ResolveDir(explicit string) (string, error)
- func SaveDevice(dir string, k *Key) error
- func SaveKey(k *Key, path string) error
- type Key
Constants ¶
const ( DeviceKeyFile = "device_key.jwk" EmitterKeyFile = "emitter_key.jwk" CounterFile = "emitter.counter" BlobsDirName = "blobs" )
File names inside the state directory.
const DefaultDirName = ".behalf"
DefaultDirName is the state directory created under $HOME by default.
const EnvHome = "BEHALF_HOME"
EnvHome is the environment variable that overrides the default state dir.
Variables ¶
This section is empty.
Functions ¶
func DeviceKeyPath ¶
DeviceKeyPath returns the device key file path under dir.
func EmitterKeyPath ¶
EmitterKeyPath returns the emitter key file path under dir.
func EnsureDir ¶
EnsureDir creates the state directory (and its blobs/ subdirectory) with owner-only permissions if it does not exist.
func NextEmitterCounter ¶
NextEmitterCounter returns the next per-emitter monotonic counter value and persists the advance (receipt-schema-v1.md §5, Q48). The first call returns 0. Single-process use only, which is the CLI's situation; the log service owns cross-process sequencing.
func ResolveDir ¶
ResolveDir returns the state directory: explicit (from a --dir flag) if non-empty, else $BEHALF_HOME if set, else ~/.behalf.
func SaveDevice ¶
SaveDevice persists the device key under dir with mode 0600.
Types ¶
type Key ¶
Key is a local Ed25519 keypair with its JWK form and RFC 7638 thumbprint.
func LoadDevice ¶
LoadDevice loads the device key from dir. os.IsNotExist on the returned error distinguishes "never logged in" from corruption.
func LoadOrGenerateEmitter ¶
LoadOrGenerateEmitter returns the emitter key from dir, generating and persisting one on first use. The emitter key is the capture surface's own key, distinct from any device key (Q19).
Source Files