principal

package

v0.28.0 Latest Latest Go to latest Published: Sep 7, 2026 License: Apache-2.0, Apache-2.0 Imports: 13 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/epithet-ssh/epithet

Links

Open Source Insights

Documentation ¶

Overview ¶

Package principal implements Epithet's deterministic SSH certificate principal schemes. Issuers and target-host authorization helpers share this package so the byte-level protocol has one public implementation.

Index ¶

Constants
func DefaultDomainPath() (string, error)
func DeriveV1(domain Domain, account string) (string, error)
type Domain

Constants ¶

View Source

const (
	// GeneratedHostSchemeV1 identifies a domain generated for one host by
	// default. The value is still a principal domain and may be copied only
	// when intentionally widening that authorization boundary.
	GeneratedHostSchemeV1 = "epithet-host-id-v1"
)

View Source

const SchemeV1 = "epithet-principal-v1"

SchemeV1 is both the visible prefix of a v1 principal and the domain separator framed into its digest input.

Variables ¶

This section is empty.

Functions ¶

func DefaultDomainPath ¶ added in v0.24.0

func DefaultDomainPath() (string, error)

DefaultDomainPath returns the native system-wide principal-domain path for this operating system. Callers may offer an explicit override for other layouts.

func DeriveV1 ¶

func DeriveV1(domain Domain, account string) (string, error)

DeriveV1 derives the destination-bound certificate principal for account in domain. The canonical domain and account are used byte-for-byte.

Types ¶

type Domain ¶ added in v0.24.0

type Domain string

Domain is the canonical, non-secret authorization boundary from which SSH certificate principals are derived. Its literal value is used byte-for-byte.

func EnsureDomainFile ¶ added in v0.24.0

func EnsureDomainFile(path string) (domain Domain, created bool, err error)

EnsureDomainFile returns the existing canonical domain at path or creates a new generated host domain. It never replaces an existing directory entry. The parent directory must already exist with its final ownership and permissions.

func GenerateHostDomain ¶ added in v0.24.0

func GenerateHostDomain() (Domain, error)

GenerateHostDomain returns a collision-resistant domain in the namespace reserved for domains created implicitly during ordinary host enrollment.

func ParseDomain ¶ added in v0.24.0

func ParseDomain(value string) (Domain, error)

ParseDomain validates a canonical human-readable or generated domain.

func ParseNamedDomain ¶ added in v0.24.0

func ParseNamedDomain(value string) (Domain, error)

ParseNamedDomain validates an explicitly declared human-readable domain.

func ReadDomainFile ¶ added in v0.24.0

func ReadDomainFile(path string) (Domain, error)

ReadDomainFile reads one literal principal domain. A file may omit its final line ending or contain exactly one LF or CRLF; all other lines are rejected.

func (Domain) IsGeneratedHost ¶ added in v0.24.0

func (d Domain) IsGeneratedHost() bool

IsGeneratedHost reports whether the domain was generated for an individual host.

func (Domain) MarshalText ¶ added in v0.24.0

func (d Domain) MarshalText() ([]byte, error)

MarshalText implements encoding.TextMarshaler.

func (Domain) String ¶ added in v0.24.0

func (d Domain) String() string

String returns the canonical external representation of d.

func (*Domain) UnmarshalText ¶ added in v0.24.0

func (d *Domain) UnmarshalText(text []byte) error

UnmarshalText implements encoding.TextUnmarshaler.

func (Domain) Validate ¶ added in v0.24.0

func (d Domain) Validate() error

Validate reports whether d is a canonical principal domain.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL