Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Agent ¶
type Agent struct {
// contains filtered or unexported fields
}
Agent represents a read-only SSH agent that hands out a single, broker-issued credential. Epithet is not a general-purpose ssh-agent: the agent socket exists only so `ssh` can sign with the certificate the broker minted for this connection, so the keyring never accepts client-added keys - see UseCredential and readOnlyKeyring.
Start returns a fully initialized agent; its owner must call Close to stop it. All methods are safe for concurrent use. The lifecycle mutex serializes credential replacement and connection admission with shutdown; signing reads the keyring's atomic snapshot without taking that mutex.
func Start ¶
Start installs the initial credential and starts serving a read-only SSH agent. On success the socket is listening with mode 0600 and the credential is ready for use. On failure no listener or serving goroutine remains. An empty socket path selects a temporary socket. The caller owns the returned agent and must Close it; its lifetime is independent of any match request.
func (*Agent) AgentSocketPath ¶
AgentSocketPath returns the path to the agent's Unix socket
func (*Agent) Certificate ¶ added in v0.25.0
func (a *Agent) Certificate() sshcert.RawCertificate
Certificate returns the raw certificate currently served by this agent. An empty value means the agent has no live credential.
func (*Agent) Close ¶
func (a *Agent) Close()
Close discards the credential, closes the listener and existing agent connections, and waits for all serving goroutines to exit. Concurrent and repeated calls wait for the same completed shutdown. Established SSH sessions are unaffected; operations still requiring this agent can no longer sign.
func (*Agent) Done ¶ added in v0.1.1
func (a *Agent) Done() <-chan struct{}
Done returns a channel that is closed when the agent has been closed and cleanup is complete. This can be used with select statements or waitgroups to know when the agent is fully stopped.
func (*Agent) Running ¶
Running reports whether the agent is still accepting work. It becomes false when shutdown begins; Done signals when cleanup is complete.
func (*Agent) UseCredential ¶
func (a *Agent) UseCredential(c Credential) error
UseCredential replaces the agent's live credential with the provided one. The swap is atomic (see readOnlyKeyring): a client mid-List/Sign against the old credential is unaffected, and no lock/Close dance is needed since the old keyring is simply dropped, not mutated. Invalid credentials leave the current credential intact. Replacement after shutdown begins fails.
type Credential ¶
type Credential struct {
PrivateKey sshcert.RawPrivateKey
Certificate sshcert.RawCertificate
}
Credential contains the private key and certificate in PEM format
Source Files