Documentation
¶
Overview ¶
Package keymanager provides KeyManager implementations.
The file-based adapter stores ECDSA P-256 keys on the local filesystem for zero-config development use. Each key is two PEM files:
<path>/<keyID>.key — PKCS#8 private key (mode 0600) <path>/<keyID>.pub — PKIX public key
Production deployments should use cloud KMS adapters (AWS KMS, GCP KMS, Vault Transit). Those will be contributed by the community; the port interface is stable.
Index ¶
- Variables
- func KeyFingerprint(pub crypto.PublicKey) string
- func PublicKeyToPEM(pub crypto.PublicKey) ([]byte, error)
- type FileKeyManager
- func (f *FileKeyManager) CreateKey(ctx context.Context, algorithm string) (string, error)
- func (f *FileKeyManager) EnsureKey(ctx context.Context, keyID, algorithm string) (string, error)
- func (f *FileKeyManager) GetPublicKey(ctx context.Context, keyID string) (crypto.PublicKey, error)
- func (f *FileKeyManager) ListKeys(ctx context.Context) ([]string, error)
- func (f *FileKeyManager) Sign(ctx context.Context, keyID string, data []byte) ([]byte, error)
- func (f *FileKeyManager) Verify(ctx context.Context, keyID string, data, signature []byte) (bool, error)
Constants ¶
This section is empty.
Variables ¶
var ( ErrKeyNotFound = errors.New("keymanager: key not found") ErrUnsupportedAlgorithm = errors.New("keymanager: unsupported algorithm") ErrKeyExists = errors.New("keymanager: key already exists") )
Errors returned by the file key manager.
Functions ¶
func KeyFingerprint ¶
KeyFingerprint returns a short identifier (first 8 bytes hex) of the given public key's PKIX SHA-256. Useful for log lines.
Types ¶
type FileKeyManager ¶
type FileKeyManager struct {
// contains filtered or unexported fields
}
FileKeyManager implements port.KeyManager with on-disk ECDSA/RSA keys.
func NewFileKeyManager ¶
func NewFileKeyManager(dir string) (*FileKeyManager, error)
NewFileKeyManager opens (or creates) a filesystem key directory. The directory is created with 0700 permissions if it does not exist.
func (*FileKeyManager) EnsureKey ¶
EnsureKey is a convenience helper: if a key with the given ID already exists, it is returned; otherwise a new key is generated. Used at startup by ans-tl to auto-provision a signing key on first run.
func (*FileKeyManager) GetPublicKey ¶
GetPublicKey returns the public key for the given keyID.
func (*FileKeyManager) ListKeys ¶
func (f *FileKeyManager) ListKeys(ctx context.Context) ([]string, error)
ListKeys returns the IDs of all keys in the directory.
Source Files