Documentation
¶
Overview ¶
Package backupcustody owns the local Kopia repository passphrase without adding it to the Basement runtime-custody inventory.
Index ¶
- Constants
- Variables
- func Clear(secret []byte)
- func EstablishRecipient(workspace string) error
- func EstablishS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
- func OpenSealedDelivery(workspace string, raw []byte, expect SealedExpectation, now time.Time) ([]byte, error)
- func ProtectPrivatePath(path string, directory bool) error
- func RebindS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
- func RebindStoredS3Target(workspace string, authority S3TargetAuthority) error
- func RecipientStatement(workspace, challenge string, now time.Time) (hostdelivery.Statement, error)
- func RequirePrivatePath(path string, directory bool) error
- func S3TargetReferences(workspace string, material S3TargetMaterial) (targetRef, custodyRef string, err error)
- func VerifyS3RebindMaterial(workspace string, material S3TargetMaterial) error
- type Custody
- type S3TargetAuthority
- type S3TargetMaterial
- type SealedExpectation
Constants ¶
const (
// APIVersion identifies the on-disk, owner-bound backup custody contract.
APIVersion = "stackkit.local-backup-passphrase-custody/v1"
)
Variables ¶
var ErrMissing = errors.New("backupcustody: no local backup passphrase custody")
ErrMissing reports that no local backup passphrase custody exists.
Functions ¶
func EstablishRecipient ¶ added in v0.51.1
EstablishRecipient creates the node's separate encryption recipient key once. The private half is encrypted under the owner custody wrapping key and never leaves this node; Guard's or any other signing key is never used to decrypt.
func EstablishS3Target ¶
func EstablishS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
EstablishS3Target binds one immutable target to an exact owner-approved Plan. Validation uses the native engine boundary without executing an operation.
func OpenSealedDelivery ¶ added in v0.51.1
func OpenSealedDelivery(workspace string, raw []byte, expect SealedExpectation, now time.Time) ([]byte, error)
OpenSealedDelivery opens one sealed delivery for this node and consumes it. The caller holds the lifecycle mutation. The delivery is recorded as consumed before the plaintext is returned, so a replay, including one after a crash, is denied and the delivering authority must seal a fresh one.
func ProtectPrivatePath ¶
func RebindS3Target ¶
func RebindS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
RebindS3Target renews source/Plan authority while preserving identical target and credentials. The caller must hold the owner-authorized lifecycle mutation.
func RebindStoredS3Target ¶ added in v0.51.3
func RebindStoredS3Target(workspace string, authority S3TargetAuthority) error
RebindStoredS3Target moves the stored target to a successor source/Plan authority from the credentials already in owner custody. No caller supplies material, so the target and credentials cannot change; the authority must still commit exactly the stored target and custody attestation. The caller must hold the owner-authorized lifecycle mutation.
func RecipientStatement ¶ added in v0.51.1
RecipientStatement proves the recipient key belongs to this node's owner and answers the delivering authority's challenge.
func RequirePrivatePath ¶
func S3TargetReferences ¶
func S3TargetReferences(workspace string, material S3TargetMaterial) (targetRef, custodyRef string, err error)
S3TargetReferences commits actual consumer bytes with the owner's existing private wrapping key. Public references cannot be dictionary-tested for endpoints.
func VerifyS3RebindMaterial ¶
func VerifyS3RebindMaterial(workspace string, material S3TargetMaterial) error
VerifyS3RebindMaterial checks unchanged target material before Inventory mutation.
Types ¶
type Custody ¶
type Custody struct {
APIVersion string `json:"apiVersion"`
Kind string `json:"kind"`
OwnerRef string `json:"ownerRef"`
KeyID string `json:"keyId"`
EstablishedAt time.Time `json:"establishedAt"`
SecretDigest string `json:"secretDigest"`
Signature localevidence.OwnerPolicyStateSignature `json:"signature"`
}
Custody is the secret-free, owner-signed index for one local Kopia passphrase. SecretDigest binds the separate private file without placing the high-entropy passphrase in JSON. It is an integrity commitment, not a password verifier.
type S3TargetAuthority ¶
type S3TargetAuthority struct {
Binding generationartifact.ApplyBackupTargetBindingRequirement `json:"binding"`
SourceDigest string `json:"sourceDigest"`
}
S3TargetAuthority is projected from the verified Plan, never from secret input.
func StoredS3TargetAuthority ¶
func StoredS3TargetAuthority(workspace string) (S3TargetAuthority, error)
StoredS3TargetAuthority verifies owner custody without treating an expired binding as current authority. Only explicit rebind uses this historical value.
type S3TargetMaterial ¶
type S3TargetMaterial struct {
Endpoint string `json:"endpoint"`
Bucket string `json:"bucket"`
Prefix string `json:"prefix"`
Region string `json:"region"`
AccessKeyID string `json:"accessKeyId"`
SecretAccessKey string `json:"secretAccessKey"`
Passphrase []byte `json:"passphrase"`
}
S3TargetMaterial stays encrypted in local owner custody. It never enters a Plan.
func LoadS3Target ¶
func LoadS3Target(workspace string, authority S3TargetAuthority) (S3TargetMaterial, error)
LoadS3Target verifies owner, exact target/source binding and ciphertext before decryption.
type SealedExpectation ¶ added in v0.51.1
type SealedExpectation struct {
TenantRef string
// Operation is OperationBackupTargetImport or OperationBackupTargetRebind.
Operation string
}
SealedExpectation is what the importing node requires of a delivery beyond its own identity: the tenant the owner is operating for.
Source Files