Documentation
¶
Overview ¶
Package principal implements Epithet's deterministic SSH certificate principal schemes. Issuers and target-host authorization helpers share this package so the byte-level protocol has one public implementation.
Index ¶
Constants ¶
const ( // GeneratedHostSchemeV1 identifies a realm generated for one host by // default. The value is still a principal realm and may be copied only // when intentionally widening that authorization boundary. GeneratedHostSchemeV1 = "epithet-host-id-v1" )
const SchemeV1 = "epithet-principal-v1"
SchemeV1 is both the visible prefix of a v1 principal and the hash domain separator framed into its digest input.
Variables ¶
This section is empty.
Functions ¶
func DefaultRealmPath ¶ added in v0.41.0
DefaultRealmPath returns the native system-wide principal-realm path for this operating system. Callers may offer an explicit override for other layouts.
func DeriveV1 ¶
DeriveV1 derives the destination-bound certificate principal for account in realm. The canonical realm and account are used byte-for-byte.
func EnsureRealmFile ¶ added in v0.41.0
EnsureRealmFile installs the supplied realm, or reuses an existing file with that same value. It never replaces an existing directory entry or substitutes a different realm. Callers can therefore review a realm before publishing it. The parent directory must already exist with its final ownership and permissions.
Types ¶
type Realm ¶ added in v0.41.0
type Realm string
Realm is the canonical, non-secret authorization boundary from which SSH certificate principals are derived. Its literal value is used byte-for-byte.
func GenerateHostRealm ¶ added in v0.41.0
GenerateHostRealm returns a collision-resistant realm in the namespace reserved for realms created implicitly during ordinary host enrollment.
func ParseNamedRealm ¶ added in v0.41.0
ParseNamedRealm validates a human-readable realm without changing its case.
func ParseRealm ¶ added in v0.41.0
ParseRealm validates a canonical human-readable or generated realm.
func ReadRealmFile ¶ added in v0.41.0
ReadRealmFile reads one literal principal realm. A file may omit its final line ending or contain exactly one LF or CRLF; all other lines are rejected.
func (Realm) IsGeneratedHost ¶ added in v0.41.0
IsGeneratedHost reports whether the realm was generated for an individual host.
func (Realm) MarshalText ¶ added in v0.41.0
MarshalText implements encoding.TextMarshaler.
func (*Realm) UnmarshalText ¶ added in v0.41.0
UnmarshalText implements encoding.TextUnmarshaler.
Source Files