redaction

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 18, 2026 License: Apache-2.0 Imports: 5 Imported by: 0

Documentation

Overview

Package redaction owns process-observed key metadata and registry drift classification. It never accepts or stores key material.

Index

Constants

View Source 
const (
	DriftActiveNotRegistered          = 3
	DriftConfiguredCommitmentMismatch = 4
)

Variables

View Source 
var (
	ErrActiveCommitmentMismatch = errors.New("active redaction key commitment mismatch")
	ErrRetiredKeyIDReuse        = errors.New("retired redaction key version is configured again")
	ErrInvalidRegistryState     = errors.New("redaction key registry contains an invalid state")
)

Functions

This section is empty.

Types

type Detail 

type Detail struct {
	Number  int    `json:"number"`
	Kind    string `json:"kind"`
	Version int    `json:"version,omitempty"`
	Message string `json:"message"`
}

Detail is one bounded drift classification. Message is operational metadata only and must never contain key material.

type Key 

type Key struct {
	ID         int    `json:"id"`
	Commitment string `json:"commitment"`
}

Key is one observed version. Commitment is safe to expose; key material is deliberately absent from this package's type system.

type Observed 

type Observed struct {
	Status        string `json:"status"`
	Mode          string `json:"mode,omitempty"`
	ActiveVersion int    `json:"active_version,omitempty"`
	Keys          []Key  `json:"keys,omitempty"`
	Revision      string `json:"revision,omitempty"`
}

Observed is the immutable, non-secret projection of the process keyring.

func CloneObserved 

func CloneObserved(observed Observed) Observed

type Result 

type Result struct {
	Ready       bool     `json:"ready"`
	Unsatisfied []int    `json:"unsatisfied,omitempty"`
	Observed    Observed `json:"observed"`
	Warnings    []Detail `json:"warnings"`
	Information []Detail `json:"information"`
}

Result is one newly computed reconciliation snapshot.

func CloneResult 

func CloneResult(result Result) Result

func Reconcile 

func Reconcile(observed Observed, registered []model.RedactionKeyVersion) (Result, error)

Reconcile applies the normative startup order #2, #3/#4, then #5/#6/#7. Registry read failures (#1) are handled by the caller because this function is intentionally pure.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.