Versions in this module Expand all Collapse all v0 v0.0.7 Oct 27, 2026 Changes in this version + const ActivationGrace + const BusTopic + const EndpointRotation + const MaxConstraintNames + const MemberReportStale + const ReasonActivation + const ReasonFirst + const ReasonNames + const ReasonRenewal + const ReasonUnreadable + const UseGitProxy + const UseKubeGuard + const UseNode + var ErrLeavesBehind = errors.New("hubca: a monitor's certificate still comes from the previous CA") + var ErrMembersBehind = errors.New("hubca: not every hub member has caught up") + var ErrNoCA = errors.New(...) + var ErrRunsWouldBreak = errors.New("hubca: runs dispatched before the stage are still running") + var ErrWrongPhase = errors.New("hubca: the rotation is not at that step") + func Abort(env Env, detail string) (statedb.HubCARotationRow, error) + func BundleSerials(bundle []byte) []string + func Constrained(c *x509.Certificate) bool + func ConstraintNames(c *x509.Certificate) []string + func FirstPEM(bundle []byte) []byte + func Label(serials []string) string + func ParseLabel(v string) []string + func Permitted(c *x509.Certificate, names []string) (ok, refused []string) + func Serial(c *x509.Certificate) string + func StoredLeafNames(s *Store) ([]string, error) + type ActivateRequest struct + Force bool + type ActivateResult struct + Broken []Run + Rotation statedb.HubCARotationRow + func Activate(env Env, req ActivateRequest) (ActivateResult, error) + type CAInfo struct + Cert *x509.Certificate + Fingerprint string + IssuedAt time.Time + IssuedBy string + Names []string + NotAfter time.Time + NotBefore time.Time + PEM []byte + Serial string + Slot Slot + type EmergencyResult struct + CA *CAInfo + Cut []Run + Leaves []Issued + Replaced []string + Rotation statedb.HubCARotationRow + func Emergency(env Env, req StageRequest) (EmergencyResult, error) + type Env struct + Alive func(statedb.HubMemberRow) bool + Options Options + Runs func() ([]Run, error) + Sealer Sealer + Store *Store type Issued + Issuer string + Reason string + func ReissueLeaves(s *Store, sealer Sealer, o Options) ([]Issued, error) + type LeafStatus struct + Issuer string + Monitor Monitor + Names []string + NotAfter time.Time + Serial string + Slot Slot + type Member struct + Hostname string + ID string + PID int + Report *statedb.HubCAMemberRow + Rotates bool + Version string + func LiveMembers(db *statedb.DB, alive func(statedb.HubMemberRow) bool) ([]Member, error) + func (m Member) Name() string + type MemberStatus struct + Active string + AdoptedAt time.Time + Behind string + CaughtUp bool + Leaves map[string]statedb.HubCALeafAck + SeenAt time.Time + Serves bool + Trusts []string + type MembersError struct + Members []MemberStatus + Old bool + func (e *MembersError) Error() string + func (e *MembersError) Unwrap() error type Options + Rotation func(RotationEvent) + type Phase string + const PhaseActivated + const PhaseNone + const PhaseStaged + const PhaseSteady + type RetireResult struct + Retired string + Rotation statedb.HubCARotationRow + func RetirePrevious(env Env) (RetireResult, error) + type RotationEvent struct + CutRuns []string + Detail string + Emergency bool + Fingerprint string + Forced []string + FromSerial string + Names []string + NotAfter time.Time + RotationID string + Step Step + ToSerial string + func (e RotationEvent) Payload(via string) map[string]any + type Run struct + ExecutorID string + ID string + Project string + Recorded bool + SessionID string + StartedAt time.Time + TaskID int + Trusts []string + Uses []string + func RunningRuns(db *statedb.DB) ([]Run, error) + func RunsFrom(rows []statedb.ExecutorSessionRow) []Run + func (r Run) Breaks(serial string) bool + func (r Run) Depends() bool + func (r Run) Describe() string + func (r Run) Name() string + func (r Run) TrustsCA(serial string) bool + type RunsError struct + Runs []Run + func (e *RunsError) Error() string + func (e *RunsError) Unwrap() error type Server + func (s *Server) Refused() []string + func (s *Server) Trust() *Trust type ServerConfig + Trust *Trust + type Slot string + const SlotActive + const SlotNext + const SlotPrevious + type Snapshot struct + Bundle []byte + Serials []string + func (s Snapshot) ActiveOnly() Snapshot + func (s Snapshot) Trusts(serial string) bool + type StageRequest struct + Emergency bool + Names []string + NoNameConstraints bool + type StageResult struct + CA *CAInfo + Rotation statedb.HubCARotationRow + func Stage(env Env, req StageRequest) (StageResult, error) + type State struct + Active *CAInfo + Next *CAInfo + Previous *CAInfo + Rotation *statedb.HubCARotationRow + func ReadState(s *Store) (State, error) + func (s State) Bundle() []byte + func (s State) ByIssuer(cert *x509.Certificate) *CAInfo + func (s State) Generation() string + func (s State) Phase() Phase + func (s State) Serials() []string + func (s State) Trusted() []*CAInfo + type Status struct + Active *CAInfo + Blocking []Run + Leaves []LeafStatus + Members []MemberStatus + Next *CAInfo + NextStep string + Phase Phase + Previous *CAInfo + Ready bool + Rotation *statedb.HubCARotationRow + Running int + func ReadStatus(env Env) (Status, error) + type Step string + const StepAbandon + const StepActivate + const StepEmergency + const StepRetirePrevious + const StepStage type Store + func (s *Store) Rotations(limit int) ([]statedb.HubCARotationRow, error) + type Trust struct + func OpenTrust(s *Store, sealer Sealer, o Options) (*Trust, error) + func StaticTrust(a *Authority) *Trust + func (t *Trust) AdoptedAt() time.Time + func (t *Trust) Authority() *Authority + func (t *Trust) Bundle() []byte + func (t *Trust) Refresh() (bool, error) + func (t *Trust) Report(instanceID string, servers ...*Server) error + func (t *Trust) Serials() []string + func (t *Trust) Snapshot() Snapshot + func (t *Trust) State() State + func (t *Trust) Withdraw(instanceID string) error v0.0.6 Oct 16, 2026 v0.0.5 Oct 12, 2026 Changes in this version + const CALifetime + const EmergencyWithin + const LeafLifetime + const MaxSANs + const NearExpiry + const RenewWithin + var ErrNoKey = errors.New(...) + var ErrNotMinted = errors.New("hubca: not issued yet") + func Covers(c *x509.Certificate, want []string) bool + func Missing(c *x509.Certificate, want []string) []string + func NormalizeSANs(in []string) ([]string, error) + func ParseCertPEM(b []byte) (*x509.Certificate, error) + func SANsFor(advertiseBase, listenAddr string) ([]string, error) + type Authority struct + func OpenAuthority(s *Store, sealer Sealer, o Options) (*Authority, error) + func (a *Authority) CertPEM() []byte + func (a *Authority) Certificate() *x509.Certificate + func (a *Authority) Serial() string + type Issued struct + CA bool + Fingerprint string + Monitor Monitor + Names []string + NotAfter time.Time + Replaced string + Serial string + type Leaf struct + Cert *x509.Certificate + CertPEM []byte + IssuedBy string + Monitor Monitor + Serial string + func (l *Leaf) SANs() []string + type LeafInfo struct + Cert *x509.Certificate + IssuedAt time.Time + IssuedBy string + Issuer string + Monitor Monitor + SANs []string + type Monitor string + const GitProxy + const KubeGuard + func Monitors() []Monitor + func (m Monitor) ConfigKey() string + func (m Monitor) Label() string + func (m Monitor) Valid() bool + type Options struct + Actor string + Audit func(Issued) + Now func() time.Time + type Sealer interface + OpenEnvelope func(aad string, env secretbroker.Envelope) ([]byte, error) + SealFor func(aad string, plaintext []byte) (secretbroker.Envelope, error) + type Server struct + func NewServer(cfg ServerConfig) (*Server, error) + func (s *Server) CAPEM() []byte + func (s *Server) Current() *Leaf + func (s *Server) GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error) + func (s *Server) Monitor() Monitor + func (s *Server) Refresh() (bool, error) + func (s *Server) Renew() (bool, error) + func (s *Server) TLSConfig(minVersion string) (*tls.Config, error) + func (s *Server) Want() []string + type ServerConfig struct + Authority *Authority + Logf func(format string, args ...any) + Monitor Monitor + Options Options + Sealer Sealer + Store *Store + Want []string + type Store struct + func NewStore(db *statedb.DB) (*Store, error) + func (s *Store) CountSealedByKey() (map[string]int, error) + func (s *Store) ListSealedNotUnder(keyID string, limit int) ([]secretbroker.SealedRow, error) + func (s *Store) ReadCA() (*x509.Certificate, []byte, error) + func (s *Store) ReadLeaf(m Monitor) (LeafInfo, error) + func (s *Store) ReplaceSealed(id string, expect, next secretbroker.Envelope) (bool, error) + func (s *Store) SealedSetName() string
Go to main page