Documentation
¶
Overview ¶
Package registryfetch decides whether a registry fetched from the hub may replace this machine's local copy.
WHY. Member machines had no local copy of the signed registry (dabir, 2026-09-22): nothing there could verify it, and nothing could count down to its lapse. The hub already serves it at /.well-known/vaultmind-directory, so members fetch it. The fetch channel proves nothing — trust comes only from the root signature checked against a PINNED root — and a fetch may never move the local copy backwards, so a hub or anything in between cannot roll a member back to an older validly signed registry.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrNotARegistry: the bytes are not a signed-registry envelope at all. ErrNotARegistry = errors.New("registryfetch: not a signed registry") // ErrNotVerified: the signature does not verify against the pinned root, // or the registry is past its own valid_until. ErrNotVerified = errors.New("registryfetch: registry does not verify against the pinned root") // ErrRollback: the fetched epoch is older than the local copy's. ErrRollback = errors.New("registryfetch: fetched registry is OLDER than the local copy (rollback refused)") )
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
Epoch int // the fetched (verified) epoch
PreviousEpoch int // the local copy's epoch; 0 when there was none
Changed bool // the local copy was replaced
ValidFrom int64 // the fetched registry's valid_from (unix seconds)
ValidUntil int64 // the fetched registry's valid_until (unix seconds)
}
Result reports what Update did.
func Update ¶
func Update(pinnedRoot ed25519.PublicKey, fetched []byte, localPath string, now time.Time) (Result, error)
Update verifies fetched against pinnedRoot and, when it is at least as new as the local copy at localPath, stores it byte-exact (atomically). A same-epoch fetch writes nothing. Every refusal leaves the local copy untouched.
Source Files