Documentation
¶
Index ¶
Constants ¶
const SigPrefix = "v2:"
SigPrefix marks signatures made since entries became verifiable. Before that (v0.4.0 and earlier) the digest covered nanoseconds the database does not store, so those entries can never verify. The marker lets the API tell "old, expected to fail" from "new, so a failure means tampering" without luck: roughly one legacy entry in a thousand verifies by chance, which makes the first entry that merely verifies a poor boundary. v0.4.1 to v0.4.3 wrote bare hex digests with the same algorithm; they still verify (see VerifyAuditSig).
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Logger ¶
type Logger struct {
// contains filtered or unexported fields
}
func New ¶
New creates an audit Logger. hmacKey is the raw HMAC-SHA256 signing key (AUDIT_HMAC_KEY env var). Pass an empty string to disable signing.
func (*Logger) Enabled ¶ added in v0.4.1
Enabled reports whether entries are being signed (AUDIT_HMAC_KEY is set).
func (*Logger) SigStatus ¶ added in v0.4.4
SigStatus classifies an entry read back from the database.
verifiedSince is the time of the earliest entry carrying SigPrefix (see VerifiedSince). Entries from before it were written with signing off, or by a version whose signatures could not always be checked, so a missing or non-matching signature there is "unsigned" or "unverifiable", which is expected. From that moment on every entry must verify, so a mismatch, or a missing signature, means the entry was altered or its signature removed and is reported "invalid". Without the second rule, clearing the sig column would turn a tampered entry into an ordinary-looking unsigned one.
This is evidence, not proof: someone who can rewrite rows could also move an entry's timestamp back before verifiedSince. Ship the log to a store they cannot write (see the SIEM export) when that matters.
func (*Logger) VerifiedSince ¶ added in v0.4.4
VerifiedSince returns the time of the earliest entry that carries SigPrefix, or nil when there is none (yet). Once found it is cached: that entry cannot become later.
Source Files