Affected by GO-2026-5255
and 4 other vulnerabilities
GO-2026-5255: nebula-mesh: Decrypted CA private key persists in heap after signing in github.com/forgekeep/nebula-mesh
GO-2026-5950: nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate in github.com/forgekeep/nebula-mesh
GO-2026-5984: nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh
GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh
GO-2026-5991: nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh
Package pop is the agent-side proof-of-possession helper for ADR 0004
(#75): it owns the Ed25519 signing private key, knows how to load it from
disk, and signs poll-request canonical strings.
DecodeSignature is the inverse of EncodeSignature. Reuses the same
standard encoding; mismatched padding or non-base64 bytes return an
error so the verifier can answer 400/401 instead of panicking.
Sign returns the Ed25519 signature over the canonical string. The caller
is responsible for constructing the canonical string via the shared
internal/pop.CanonicalString helper.
Affected by 
Documentation
¶
Source Files