Documentation
¶
Overview ¶
Package backupcustody owns the local Kopia repository passphrase without adding it to the Basement runtime-custody inventory.
Index ¶
- Constants
- Variables
- func Clear(secret []byte)
- func EstablishS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
- func ProtectPrivatePath(path string, directory bool) error
- func RebindS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
- func RequirePrivatePath(path string, directory bool) error
- func S3TargetReferences(workspace string, material S3TargetMaterial) (targetRef, custodyRef string, err error)
- func VerifyS3RebindMaterial(workspace string, material S3TargetMaterial) error
- type Custody
- type S3TargetAuthority
- type S3TargetMaterial
Constants ¶
const (
// APIVersion identifies the on-disk, owner-bound backup custody contract.
APIVersion = "stackkit.local-backup-passphrase-custody/v1"
)
Variables ¶
var ErrMissing = errors.New("backupcustody: no local backup passphrase custody")
ErrMissing reports that no local backup passphrase custody exists.
Functions ¶
func EstablishS3Target ¶
func EstablishS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
EstablishS3Target binds one immutable target to an exact owner-approved Plan. Validation uses the native engine boundary without executing an operation.
func ProtectPrivatePath ¶
func RebindS3Target ¶
func RebindS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
RebindS3Target renews source/Plan authority while preserving identical target and credentials. The caller must hold the owner-authorized lifecycle mutation.
func RequirePrivatePath ¶
func S3TargetReferences ¶
func S3TargetReferences(workspace string, material S3TargetMaterial) (targetRef, custodyRef string, err error)
S3TargetReferences commits actual consumer bytes with the owner's existing private wrapping key. Public references cannot be dictionary-tested for endpoints.
func VerifyS3RebindMaterial ¶
func VerifyS3RebindMaterial(workspace string, material S3TargetMaterial) error
VerifyS3RebindMaterial checks unchanged target material before Inventory mutation.
Types ¶
type Custody ¶
type Custody struct {
APIVersion string `json:"apiVersion"`
Kind string `json:"kind"`
OwnerRef string `json:"ownerRef"`
KeyID string `json:"keyId"`
EstablishedAt time.Time `json:"establishedAt"`
SecretDigest string `json:"secretDigest"`
Signature localevidence.OwnerPolicyStateSignature `json:"signature"`
}
Custody is the secret-free, owner-signed index for one local Kopia passphrase. SecretDigest binds the separate private file without placing the high-entropy passphrase in JSON. It is an integrity commitment, not a password verifier.
type S3TargetAuthority ¶
type S3TargetAuthority struct {
Binding generationartifact.ApplyBackupTargetBindingRequirement `json:"binding"`
SourceDigest string `json:"sourceDigest"`
}
S3TargetAuthority is projected from the verified Plan, never from secret input.
func StoredS3TargetAuthority ¶
func StoredS3TargetAuthority(workspace string) (S3TargetAuthority, error)
StoredS3TargetAuthority verifies owner custody without treating an expired binding as current authority. Only explicit rebind uses this historical value.
type S3TargetMaterial ¶
type S3TargetMaterial struct {
Endpoint string `json:"endpoint"`
Bucket string `json:"bucket"`
Prefix string `json:"prefix"`
Region string `json:"region"`
AccessKeyID string `json:"accessKeyId"`
SecretAccessKey string `json:"secretAccessKey"`
Passphrase []byte `json:"passphrase"`
}
S3TargetMaterial stays encrypted in local owner custody. It never enters a Plan.
func LoadS3Target ¶
func LoadS3Target(workspace string, authority S3TargetAuthority) (S3TargetMaterial, error)
LoadS3Target verifies owner, exact target/source binding and ciphertext before decryption.
Source Files