fleetmember

package
v0.46.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 25, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Overview

Package fleetmember binds a physical host to one existing member node of a StackInstance. The Home owner on the Foundation Node signs a member admission; the member host verifies it against the pinned Home key, recompiles the same ResolvedPlan, and keeps verify-only custody. It grants no enrollment, signing, credential issuance, or ControlAuthority.

Index

Constants

View Source 
const (
	AdmissionAPIVersion = "stackkit.member-admission/v1"
	AdmissionKind       = "MemberAdmission"

	// MaxAdmissionValidity bounds the join window. The resulting member
	// custody does not expire; a changed plan needs a new admission.
	MaxAdmissionValidity = 24 * time.Hour

	// MaxAdmissionBytes bounds the document, which carries spec and inventory.
	MaxAdmissionBytes = 8 << 20
)
View Source 
const (
	CustodyAPIVersion = "stackkit.local-member-custody/v1"
	CustodyKind       = "LocalMemberCustody"
)

Variables

This section is empty.

Functions

func IsNotMember 

func IsNotMember(err error) bool

IsNotMember reports whether err means the workspace holds no member custody.

func Persist 

func Persist(workspaceRoot string, custody Custody) error

Persist installs member custody. The workspace must not hold Home owner custody.

Types

type Admission 

type Admission struct {
	APIVersion               string                                  `json:"apiVersion"`
	Kind                     string                                  `json:"kind"`
	StackID                  string                                  `json:"stackId"`
	FleetRef                 string                                  `json:"fleetRef,omitempty"`
	KitSlug                  string                                  `json:"kitSlug"`
	CompilerVersion          string                                  `json:"compilerVersion"`
	PlanHash                 string                                  `json:"planHash"`
	SpecHash                 string                                  `json:"specHash"`
	InventoryHash            string                                  `json:"inventoryHash"`
	Authority                ExecutionBinding                        `json:"authority"`
	Member                   ExecutionBinding                        `json:"member"`
	MemberRoles              []string                                `json:"memberRoles"`
	Grants                   Grants                                  `json:"grants"`
	Verifier                 HomeVerifier                            `json:"verifier"`
	VerifierDistributionRefs []string                                `json:"verifierDistributionRefs"`
	StackSpec                Payload                                 `json:"stackSpec"`
	Inventory                Payload                                 `json:"inventory"`
	IssuedAt                 time.Time                               `json:"issuedAt"`
	ValidUntil               time.Time                               `json:"validUntil"`
	Signature                localevidence.OwnerPolicyStateSignature `json:"signature"`
}

Admission is the Owner-signed `stackkit.member-admission/v1` document.

func Issue 

func Issue(request IssueRequest) (Admission, error)

Issue derives the unsigned admission from the exact compiled plan. The caller signs SigningBytes with the Home owner key.

func (Admission) SigningBytes 

func (a Admission) SigningBytes() ([]byte, error)

SigningBytes are the canonical bytes covered by the Owner signature.

type Custody 

type Custody struct {
	APIVersion               string                     `json:"apiVersion"`
	Kind                     string                     `json:"kind"`
	Binding                  localevidence.LocalBinding `json:"localBinding"`
	Authority                localevidence.LocalBinding `json:"authorityBinding"`
	StackID                  string                     `json:"stackId"`
	FleetRef                 string                     `json:"fleetRef,omitempty"`
	PlanHash                 string                     `json:"planHash"`
	Grants                   Grants                     `json:"grants"`
	Verifier                 HomeVerifier               `json:"verifier"`
	VerifierDistributionRefs []string                   `json:"verifierDistributionRefs"`
	AdmissionDigest          string                     `json:"admissionDigest"`
	Admission                Admission                  `json:"admission"`
	JoinedAt                 time.Time                  `json:"joinedAt"`
}

Custody is the verify-only record a member host keeps after joining. It holds no private key: its integrity is the embedded Owner-signed admission, re-verified against the pinned Home key on every load.

func LoadCustody 

func LoadCustody(workspaceRoot string) (Custody, error)

LoadCustody reads and re-verifies the member custody of a workspace. It returns os.ErrNotExist when the workspace is not a member.

func NewCustody 

func NewCustody(verified Verified, joinedAt time.Time) Custody

NewCustody projects a verified, plan-bound admission into member custody.

type ExecutionBinding 

type ExecutionBinding struct {
	SiteRef             string `json:"siteRef"`
	SiteKind            string `json:"siteKind"`
	NodeRef             string `json:"nodeRef"`
	ExecutionChannelRef string `json:"executionChannelRef"`
}

ExecutionBinding is one exact Site/node/execution-channel tuple.

func (ExecutionBinding) LocalBinding 

func (b ExecutionBinding) LocalBinding() localevidence.LocalBinding

LocalBinding projects the tuple into the local custody binding shape.

type Grants 

type Grants struct {
	Enrollment         bool `json:"enrollment"`
	Signing            bool `json:"signing"`
	CredentialIssuance bool `json:"credentialIssuance"`
	ControlAuthority   bool `json:"controlAuthority"`
}

Grants are closed: a member is verify-only. Every field must be false.

type HomeVerifier 

type HomeVerifier struct {
	OwnerRef  string `json:"ownerRef"`
	KeyID     string `json:"keyId"`
	PublicKey string `json:"publicKey"`
}

HomeVerifier is the public Home owner key a member uses to verify Home-signed documents. It never carries private or credential material.

type IssueRequest 

type IssueRequest struct {
	Plan            resolvedplan.ResolvedPlan
	StackSpec       []byte
	Inventory       []byte
	InventoryFormat string
	MemberNodeRef   string
	Authority       localevidence.LocalBinding
	OwnerRef        string
	KeyID           string
	PublicKey       ed25519.PublicKey
	Now             time.Time
	ValidFor        time.Duration
}

IssueRequest is the Foundation Node input for one member admission.

type Payload 

type Payload struct {
	Format  string `json:"format"`
	SHA256  string `json:"sha256"`
	Content string `json:"content"`
}

Payload carries the exact bytes both hosts compile.

type Verified 

type Verified struct {
	Admission Admission
	Digest    string
	StackSpec []byte
	Inventory []byte
}

Verified is an admission whose signature, pin, window, and payloads hold.

func Verify 

func Verify(raw []byte, pinnedKeyID string, now time.Time) (Verified, error)

Verify decodes one bounded admission and verifies it against the Home key ID the member operator pinned out of band.

func (Verified) BindPlan 

func (v Verified) BindPlan(plan resolvedplan.ResolvedPlan) error

BindPlan requires the plan the member compiled from the admitted payloads to reproduce every admitted fact, including the exact plan hash.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.