Documentation
¶
Overview ¶
Package backupcustody owns the local Kopia repository passphrase without adding it to the Basement runtime-custody inventory.
Index ¶
- Constants
- Variables
- func Clear(secret []byte)
- func CommitS3TargetMove(workspace string) error
- func EstablishRecipient(workspace string) error
- func EstablishS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
- func HostStore(workspace string) hostcustody.Store
- func MoveStoredS3TargetJournaled(workspace string, successor S3TargetAuthority) (restore func() error, err error)
- func OpenSealedDelivery(workspace string, raw []byte, expect SealedExpectation, now time.Time) ([]byte, error)
- func ProtectPrivatePath(path string, directory bool) error
- func RebindS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
- func RebindStoredS3Target(workspace string, authority S3TargetAuthority) error
- func RecipientStatement(workspace, challenge string, now time.Time) (hostdelivery.Statement, error)
- func RequirePrivatePath(path string, directory bool) error
- func S3TargetMovePending(workspace string) (bool, error)
- func S3TargetReferences(workspace string, material S3TargetMaterial) (targetRef, custodyRef string, err error)
- func SettleS3TargetMove(workspace string) error
- func VerifyS3RebindMaterial(workspace string, material S3TargetMaterial) error
- type Custody
- type S3TargetAuthority
- type S3TargetMaterial
- type SealedExpectation
Constants ¶
const (
// APIVersion identifies the on-disk, owner-bound backup custody contract.
APIVersion = "stackkit.local-backup-passphrase-custody/v1"
)
Variables ¶
var ErrMissing = errors.New("backupcustody: no local backup passphrase custody")
ErrMissing reports that no local backup passphrase custody exists.
Functions ¶
func CommitS3TargetMove ¶ added in v0.53.10
CommitS3TargetMove drops the journal once the move is the committed baseline. It changes nothing when no move is pending.
func EstablishRecipient ¶ added in v0.51.1
EstablishRecipient creates the node's separate encryption recipient key once.
func EstablishS3Target ¶
func EstablishS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
EstablishS3Target binds one immutable target to an exact owner-approved Plan. Validation uses the native engine boundary without executing an operation.
func HostStore ¶ added in v0.53.1
func HostStore(workspace string) hostcustody.Store
HostStore is the node's private custody for sealed host delivery (hostcustody). Its records live beside the backup custody, under the same owner signature and local custody key, so a node keeps the recipient key and delivery ledger it already holds.
func MoveStoredS3TargetJournaled ¶ added in v0.53.10
func MoveStoredS3TargetJournaled(workspace string, successor S3TargetAuthority) (restore func() error, err error)
MoveStoredS3TargetJournaled moves the stored target to a successor authority like RebindStoredS3Target, but first records the authority it moves away from in a private journal beside the custody. A process that dies after the move and before restore() leaves that journal behind, and SettleS3TargetMove moves custody back to it, so the custody never stays on a candidate authority whose change set did not commit. restore() moves custody back and drops the journal; call CommitS3TargetMove when the move becomes the new baseline.
The journal holds only the authority (references and hashes), never target credentials. The caller must hold the owner-authorized lifecycle mutation.
func OpenSealedDelivery ¶ added in v0.51.1
func OpenSealedDelivery(workspace string, raw []byte, expect SealedExpectation, now time.Time) ([]byte, error)
OpenSealedDelivery opens one sealed backup-target delivery for this node and consumes it. The caller holds the lifecycle mutation. The delivery is recorded as consumed before the plaintext is returned, so a replay, including one after a crash, is denied and the delivering authority must seal a fresh one.
func ProtectPrivatePath ¶
func RebindS3Target ¶
func RebindS3Target(workspace string, authority S3TargetAuthority, material S3TargetMaterial) error
RebindS3Target renews source/Plan authority while preserving identical target and credentials. The caller must hold the owner-authorized lifecycle mutation.
func RebindStoredS3Target ¶ added in v0.51.3
func RebindStoredS3Target(workspace string, authority S3TargetAuthority) error
RebindStoredS3Target moves the stored target to a successor source/Plan authority from the credentials already in owner custody. No caller supplies material, so the target and credentials cannot change; the authority must still commit exactly the stored target and custody attestation. The caller must hold the owner-authorized lifecycle mutation.
func RecipientStatement ¶ added in v0.51.1
RecipientStatement proves the recipient key belongs to this node's owner and answers the delivering authority's challenge.
func RequirePrivatePath ¶
func S3TargetMovePending ¶
S3TargetMovePending reports whether a journaled target move still awaits its commit or settlement.
func S3TargetReferences ¶
func S3TargetReferences(workspace string, material S3TargetMaterial) (targetRef, custodyRef string, err error)
S3TargetReferences commits actual consumer bytes with the owner's existing private wrapping key. Public references cannot be dictionary-tested for endpoints.
func SettleS3TargetMove ¶ added in v0.53.10
SettleS3TargetMove completes a journaled move that did not commit: custody returns to the authority recorded before the move and the journal is removed. It changes nothing when no move is pending, and repeats harmlessly.
func VerifyS3RebindMaterial ¶
func VerifyS3RebindMaterial(workspace string, material S3TargetMaterial) error
VerifyS3RebindMaterial checks unchanged target material before Inventory mutation.
Types ¶
type Custody ¶
type Custody struct {
APIVersion string `json:"apiVersion"`
Kind string `json:"kind"`
OwnerRef string `json:"ownerRef"`
KeyID string `json:"keyId"`
EstablishedAt time.Time `json:"establishedAt"`
SecretDigest string `json:"secretDigest"`
Signature localevidence.OwnerPolicyStateSignature `json:"signature"`
}
Custody is the secret-free, owner-signed index for one local Kopia passphrase. SecretDigest binds the separate private file without placing the high-entropy passphrase in JSON. It is an integrity commitment, not a password verifier.
type S3TargetAuthority ¶
type S3TargetAuthority struct {
Binding generationartifact.ApplyBackupTargetBindingRequirement `json:"binding"`
SourceDigest string `json:"sourceDigest"`
}
S3TargetAuthority is projected from the verified Plan, never from secret input.
func StoredS3TargetAuthority ¶
func StoredS3TargetAuthority(workspace string) (S3TargetAuthority, error)
StoredS3TargetAuthority verifies owner custody without treating an expired binding as current authority. Only explicit rebind uses this historical value.
type S3TargetMaterial ¶
type S3TargetMaterial struct {
Endpoint string `json:"endpoint"`
Bucket string `json:"bucket"`
Prefix string `json:"prefix"`
Region string `json:"region"`
AccessKeyID string `json:"accessKeyId"`
SecretAccessKey string `json:"secretAccessKey"`
Passphrase []byte `json:"passphrase"`
}
S3TargetMaterial stays encrypted in local owner custody. It never enters a Plan.
func LoadS3Target ¶
func LoadS3Target(workspace string, authority S3TargetAuthority) (S3TargetMaterial, error)
LoadS3Target verifies owner, exact target/source binding and ciphertext before decryption.
type SealedExpectation ¶ added in v0.51.1
type SealedExpectation struct {
TenantRef string
// Operation is OperationBackupTargetImport or OperationBackupTargetRebind.
Operation string
}
SealedExpectation is what the importing node requires of a backup target delivery beyond its own identity: the tenant the owner is operating for.
Source Files