Documentation
¶
Overview ¶
Package relayclient fetches a Contract-B relay's PUBLIC trust anchor from its /.well-known/vaultmind-root endpoint. It performs NO trust decisions itself — the caller (the member-enroll flow) cross-checks the fetched root against the out-of-band-confirmed invite. This package only does the transport: validate the scheme, GET the well-known path, and decode the response.
Index ¶
Constants ¶
const MaxDirectoryBytes = 1 << 20
MaxDirectoryBytes caps the registry body. A real registry is a few KB; the cap keeps a hostile or broken hub from exhausting memory.
const WellKnownDirectoryPath = "/.well-known/vaultmind-directory"
WellKnownDirectoryPath serves the hub's signed registry, byte-exact.
const WellKnownRootPath = "/.well-known/vaultmind-root"
WellKnownRootPath is the canonical path a relay serves its public root anchor from. SSOT so the fetch path and any docs reference one definition.
Variables ¶
This section is empty.
Functions ¶
func FetchDirectory ¶ added in v0.9.0
FetchDirectory GETs {baseURL}/.well-known/vaultmind-directory and returns the body byte-exact. Remote-permissive, like FetchRoot (the hub is remote), with the same guards: http(s) only, its own deadline, fail closed on non-200.
The bytes are UNTRUSTED. The caller verifies the root signature against a PINNED root before relying on them; the channel proves nothing.
Over the cap is an error, not a truncation: a cut-short registry would fail signature verification for a misleading reason.
Types ¶
type WellKnownRoot ¶
type WellKnownRoot struct {
// RootPubKey is base64-std (padded) of the 32-byte ed25519 ROOT public key the
// relay claims anchors its network.
RootPubKey string `json:"root_pubkey"`
// NetworkID is the relay's claimed "vmnet1:…" id. The caller re-derives
// NetworkID(root_pubkey) and rejects a mismatch.
NetworkID string `json:"network_id"`
// RootKeyEpoch is the relay's advertised root-key rotation epoch (optional;
// 0 when absent). It is informational here — the trust decision is the
// pubkey/network-id cross-check, not the epoch.
RootKeyEpoch int64 `json:"root_key_epoch,omitempty"`
}
WellKnownRoot is the relay's advertised PUBLIC trust anchor. It is UNTRUSTED until the caller cross-checks it against the out-of-band-confirmed invite: the relay could be a MITM, so RootPubKey/NetworkID here prove nothing on their own.
func FetchRoot ¶
func FetchRoot(ctx context.Context, client *http.Client, relayBaseURL string) (WellKnownRoot, error)
FetchRoot GETs {relayBaseURL}/.well-known/vaultmind-root and decodes the WellKnownRoot. It validates the base URL scheme (http/https only) BEFORE dialing, wraps the request in its OWN context.WithTimeout(relayFetchTimeout) so a caller-supplied no-timeout client can never hang it, CAPS the response body at maxRootBodyBytes before decode, and FAILS CLOSED on a non-200 status or a malformed/over-cap body. It deliberately does NOT DisallowUnknownFields so the relay can add forward-compatible fields without breaking older members.
This client is intentionally remote-permissive (enroll fetches REMOTE relays): it does NOT loopback-pin — that is a separate doctor-only client in a later slice. client may be nil; a default client is used in that case. The returned WellKnownRoot is UNTRUSTED — the caller must cross-check it against the invite before relying on it.
Source Files