Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Agent ¶
type Agent struct {
// contains filtered or unexported fields
}
Agent represents a read-only SSH agent that hands out a single, broker-issued credential. Epithet is not a general-purpose ssh-agent: the agent socket exists only so `ssh` can sign with the certificate the broker minted for this connection, so the keyring never accepts client-added keys - see UseCredential and readOnlyKeyring.
Concurrency: Agent is safe for concurrent use. readOnlyKeyring holds its live credential behind an atomic.Pointer, so UseCredential can swap in a fresh credential while other goroutines are mid-List/Sign without a lock. The done channel and closeOnce provide safe shutdown coordination.
Immutable after creation: agentSocketPath, log Self-synchronized: keyring (atomic swap) Protected by closeOnce: agentListener, done channel agentListener/startErr: written once by Serve() (which may run in its own goroutine), then guarded for readers by the ready channel - see WaitReady.
func New ¶ added in v0.1.1
New creates a new SSH agent. This does not start listening - call Serve() to begin accepting connections. If agentSocketPath is empty, a temporary socket will be created when Serve() is called.
func (*Agent) AgentSocketPath ¶
AgentSocketPath returns the path to the agent's Unix socket
func (*Agent) Close ¶
func (a *Agent) Close()
Close stops the agent and cleans up resources. Safe to call multiple times.
func (*Agent) Done ¶ added in v0.1.1
func (a *Agent) Done() <-chan struct{}
Done returns a channel that is closed when the agent has been closed and cleanup is complete. This can be used with select statements or waitgroups to know when the agent is fully stopped.
func (*Agent) Running ¶
Running returns true if the agent is currently running and accepting connections
func (*Agent) Serve ¶ added in v0.1.1
Serve starts the agent listening on the configured socket and blocks until the context is cancelled. Returns an error if the listener cannot be started, otherwise returns ctx.Err() when shutdown completes.
func (*Agent) UseCredential ¶
func (a *Agent) UseCredential(c Credential) error
UseCredential replaces the agent's live credential with the provided one. The swap is atomic (see readOnlyKeyring): a client mid-List/Sign against the old credential is unaffected, and no lock/Close dance is needed since the old keyring is simply dropped, not mutated.
func (*Agent) WaitReady ¶ added in v0.18.0
WaitReady blocks until Serve has started the agent's listener (or failed to) and returns any startup error. Callers that run Serve in a goroutine - and especially any that may later call Close from a different goroutine - must call this before doing either, so that the read of agentListener in Close happens-after the write in startAgentListener (see the Agent struct comment).
type Credential ¶
type Credential struct {
PrivateKey sshcert.RawPrivateKey
Certificate sshcert.RawCertificate
}
Credential contains the private key and certificate in PEM format
Source Files