auditcheckpoint

type ChainReport struct {
	Path  string
	Chain string

	// Records counts what was checked, by seal and by result.
	Records          int
	Valid            int
	Unsigned         int
	Unchecked        int
	ForeignKey       int
	Refused          int
	Consistent       int
	Pruned           int
	PrunedUnverified int
	// Acknowledged counts records a restore record accounts for.
	Acknowledged int
	// RestoreRecords counts restore records; UntrustedRestores those that
	// account for nothing here, because they are not sealed under the key
	// this verifier holds — or it holds none.
	RestoreRecords    int
	UntrustedRestores int

	// Newest is the newest record used; nil when none was.
	Newest *Checked
	// Failures lists every failing record, oldest first.
	Failures []Checked
	// Restores lists the restores the chain agrees with, oldest first.
	Restores []RestoreFinding
	// Finding names what the earliest failure means for the chain, in one
	// sentence; "" when there is none. Hint adds the reading it cannot rule
	// out, where there is one.
	Finding string
	Hint    string
}

type Checked struct {
	Located
	Seal   SealStatus
	Result Result
	Detail string
}

type Key struct {
	// contains filtered or unexported fields
}

type Located struct {
	Record
	Line int
}

type ParseResult struct {
	Records []Located
	// Malformed counts lines that name a checkpoint but do not decode — a
	// truncated write, or an edit.
	Malformed []int
	// Oversized lists lines longer than a record can be, which were skipped
	// unread: in a log export they are somebody else's lines; in the
	// checkpoint file itself, an edit.
	Oversized []int
}

type Record struct {
	Kind    string `json:"kind"`
	Version int    `json:"v"`

	// Chain is ChainControlPlane or ChainProject; Path the absolute path of
	// the database, which is how a record is matched to a chain.
	Chain string `json:"chain"`
	Path  string `json:"path"`

	// Reason is ReasonInterval or ReasonShutdown. Window is the interval
	// window an interval record belongs to: the Unix time divided by the
	// interval, so every member numbers windows alike.
	Reason string `json:"reason"`
	Window int64  `json:"window,omitempty"`

	// LastID and LastRowHash are the newest row; Rows how many the table
	// held. All zero for an empty chain.
	LastID      int64  `json:"last_id"`
	LastRowHash string `json:"last_row_hash,omitempty"`
	Rows        int64  `json:"rows"`

	// The newest prune anchor, if the chain was ever pruned.
	AnchorID        int64  `json:"anchor_id,omitempty"`
	AnchorThroughID int64  `json:"anchor_through_id,omitempty"`
	AnchorHash      string `json:"anchor_hash,omitempty"`
	// AnchorVerified says the hub read that anchor's archive itself and found
	// it the intact chain the anchor ends in. Seeing an anchor in the database
	// proves only that one is there — whoever can delete rows can write one —
	// so this, under the seal, is what lets a later verifier accept the
	// prune when the archive has since moved out of reach.
	AnchorVerified bool `json:"anchor_verified,omitempty"`

	// Time is when the head was read (RFC 3339, UTC); Member the hub member
	// that read it.
	Time   string `json:"time"`
	Member string `json:"member,omitempty"`

	// Restore says what a restore record records; nil on every other record.
	Restore *Restore `json:"restore,omitempty"`

	// KeyFingerprint names the key Seal was computed under. Both are empty
	// on an unsigned record.
	KeyFingerprint string `json:"key_fingerprint,omitempty"`
	Seal           string `json:"seal,omitempty"`
}

type Restore struct {
	// BackupSHA256 is the restored file's digest; BackupTime when the backup
	// was taken, from its sidecar ("" when it had none). Sidecar says what
	// vouched for the file: "sealed" when its sidecar's seal verified under
	// the hub's key, "unchecked" when it was restored with --allow-unsealed,
	// "skipped" with --skip-checksum.
	BackupSHA256 string `json:"backup_sha256"`
	BackupTime   string `json:"backup_time,omitempty"`
	Sidecar      string `json:"sidecar"`

	// RestoredID, RestoredRowHash and RestoredTime are the newest row the
	// backup holds: where the chain was restored to. All zero for a backup
	// whose chain was empty.
	RestoredID      int64  `json:"restored_id"`
	RestoredRowHash string `json:"restored_row_hash,omitempty"`
	RestoredTime    string `json:"restored_time,omitempty"`

	// SupersededID, SupersededRowHash and SupersededTime are the newest
	// checkpoint the restore found that saw an id past RestoredID: the far end
	// of the history the restore gave up, as far as any checkpoint recorded
	// it. Zero when none did.
	SupersededID      int64  `json:"superseded_id,omitempty"`
	SupersededRowHash string `json:"superseded_row_hash,omitempty"`
	SupersededTime    string `json:"superseded_time,omitempty"`

	// Actor restored it, for Reason, which the command requires.
	Actor  string `json:"actor"`
	Reason string `json:"reason"`

	// SecretLoss names the sealing keys the restore went ahead without,
	// under --accept-secret-loss: whatever the backup holds sealed under them
	// can no longer be opened.
	SecretLoss []string `json:"secret_loss,omitempty"`
}

type RestoreFinding struct {
	// Record is the restore record.
	Record Checked
	// Superseded counts the records sealed before it that it accounts for.
	Superseded int
	// The history lost: ids LostFromID through LostThroughID, LostEvents of
	// them, written between From and To — from the newest row the backup
	// holds to the newest checkpoint that saw what came after. The record
	// names the newest checkpoint the restore found; one the verifier finds
	// later still widens the window.
	LostFromID, LostThroughID int64
	LostEvents                int64
	From, To                  string
}

type Result string

type SealStatus string

type Sink struct {
	// File is appended to and fsynced; "" writes no file.
	File string
	// Stderr receives one JSON line per record; nil writes none.
	Stderr io.Writer
}