Documentation
¶
Overview ¶
Package principal implements Epithet's deterministic SSH certificate principal schemes. Issuers and target-host authorization helpers share this package so the byte-level protocol has one public implementation.
Index ¶
Constants ¶
const ( // GeneratedHostSchemeV1 identifies a domain generated for one host by // default. The value is still a principal domain and may be copied only // when intentionally widening that authorization boundary. GeneratedHostSchemeV1 = "epithet-host-id-v1" )
const SchemeV1 = "epithet-principal-v1"
SchemeV1 is both the visible prefix of a v1 principal and the domain separator framed into its digest input.
Variables ¶
This section is empty.
Functions ¶
func DefaultDomainPath ¶ added in v0.24.0
DefaultDomainPath returns the native system-wide principal-domain path for this operating system. Callers may offer an explicit override for other layouts.
func DeriveV1 ¶
DeriveV1 derives the destination-bound certificate principal for account in domain. The canonical domain and account are used byte-for-byte.
func EnsureDomainFile ¶ added in v0.24.0
EnsureDomainFile installs the supplied domain, or reuses an existing file with that same value. It never replaces an existing directory entry or substitutes a different domain. Callers can therefore review a domain before publishing it. The parent directory must already exist with its final ownership and permissions.
Types ¶
type Domain ¶ added in v0.24.0
type Domain string
Domain is the canonical, non-secret authorization boundary from which SSH certificate principals are derived. Its literal value is used byte-for-byte.
func GenerateHostDomain ¶ added in v0.24.0
GenerateHostDomain returns a collision-resistant domain in the namespace reserved for domains created implicitly during ordinary host enrollment.
func ParseDomain ¶ added in v0.24.0
ParseDomain validates a canonical human-readable or generated domain.
func ParseNamedDomain ¶ added in v0.24.0
ParseNamedDomain validates an explicitly declared human-readable domain.
func ReadDomainFile ¶ added in v0.24.0
ReadDomainFile reads one literal principal domain. A file may omit its final line ending or contain exactly one LF or CRLF; all other lines are rejected.
func (Domain) IsGeneratedHost ¶ added in v0.24.0
IsGeneratedHost reports whether the domain was generated for an individual host.
func (Domain) MarshalText ¶ added in v0.24.0
MarshalText implements encoding.TextMarshaler.
func (*Domain) UnmarshalText ¶ added in v0.24.0
UnmarshalText implements encoding.TextUnmarshaler.
Source Files