Documentation
¶
Index ¶
- Constants
- func DecodeStoredPayload(stored []byte, identities *crypto.AgeSshIdentities, ...) ([]byte, error)
- func DecodeZstdFrame(frame []byte, limits PayloadLimits) ([]byte, error)
- func EncodeStoredPayload(plaintext []byte, recipient *crypto.AgeSshRecipient, limits PayloadLimits) ([]byte, error)
- func EncodeUnit(kind UnitType, payload []byte, maximum int) ([]byte, error)
- func EncodeZstdFrame(plaintext []byte, limits PayloadLimits) ([]byte, error)
- func HasCommittedUnitWithin(source io.ReaderAt, start, end, size int64, maximum int) (bool, error)
- func Marshal(value any, maximum int) ([]byte, error)
- func Unmarshal[T any](encoded []byte, maximum int) (T, error)
- type Family
- type PayloadLimits
- type Timestamp
- type Unit
- type UnitType
Constants ¶
const ( AuditMagic = "\x89BAUDIT\n" RecordingMagic = "\x89BCAST\n" CommitMarker = "BFCOMMIT" MaxMetadataPayload = 4 << 10 MaxAuditEventPayload = 64 << 10 MaxAuditRecordPayload = 128 << 10 MaxRecordingDecodedChunk = 2 << 20 MaxRecordingChunkPayload = 4 << 20 )
Variables ¶
This section is empty.
Functions ¶
func DecodeStoredPayload ¶
func DecodeStoredPayload(stored []byte, identities *crypto.AgeSshIdentities, recipientFingerprint string, limits PayloadLimits) ([]byte, error)
DecodeStoredPayload never returns partial plaintext: age must authenticate through EOF before the single Zstd frame can be accepted.
func DecodeZstdFrame ¶
func DecodeZstdFrame(frame []byte, limits PayloadLimits) ([]byte, error)
func EncodeStoredPayload ¶
func EncodeStoredPayload(plaintext []byte, recipient *crypto.AgeSshRecipient, limits PayloadLimits) ([]byte, error)
EncodeStoredPayload produces a separate Zstd frame and optional age message for one audit record or recording chunk. The signed container supplies the recipient fingerprint and binds the resulting stored bytes.
func EncodeZstdFrame ¶
func EncodeZstdFrame(plaintext []byte, limits PayloadLimits) ([]byte, error)
EncodeZstdFrame encodes one independently decodable, checksum-protected frame. Incompressible input may use Zstd raw blocks, not a second wire codec.
func HasCommittedUnitWithin ¶
HasCommittedUnitWithin searches only [start,end) for a candidate prefix. A state-1 prefix with a valid kind/length and a marker at its computed trailer is evidence even when its CRC is damaged. Payload bytes (including encrypted bytes) can mimic a frame, so a match is ambiguous and must fail closed.
Types ¶
type PayloadLimits ¶
type Timestamp ¶
Timestamp uses the same two-element CBOR array in every native wire schema. Encoding time.Time directly would otherwise depend on library time options.
Source Files