Documentation
¶
Overview ¶
Package sqlstore is the SQL-backed registry.Store, built on Ent. It supports SQLite, for a single host, and PostgreSQL, for a service shared by several replicas. Both pass the conformance suite in package storetest.
The store holds wrapped keys and never a plaintext one. Every operation that changes state runs in one transaction, and a transaction that loses a race is retried, so callers see the same atomic behaviour as the in-memory store: among concurrent callers there is a single winner and the others converge on it.
Serialization comes from the engine. On PostgreSQL every transaction runs at the serializable isolation level, and a serialization failure, a deadlock or a unique violation from a lost race is retried. On SQLite, transactions begin immediately, so writers queue behind one another, and the connection pool is held to a single connection.
Index ¶
- type Dialect
- type Store
- func (s *Store) ActiveKEK(ctx context.Context, purpose keyforge.Purpose) (keyforge.KEKVersion, error)
- func (s *Store) AddVersion(ctx context.Context, v registry.VersionRecord) error
- func (s *Store) AdvanceDEK(ctx context.Context, purpose keyforge.Purpose, subject string, from uint32, ...) (keyforge.DEKRecord, error)
- func (s *Store) Backup(ctx context.Context, path string) error
- func (s *Store) Close() error
- func (s *Store) CompleteShred(ctx context.Context, purpose keyforge.Purpose, subject string, at time.Time) (registry.ShredRecord, error)
- func (s *Store) CountDEKStates(ctx context.Context, purpose keyforge.Purpose) (map[keyforge.DEKState]int, error)
- func (s *Store) CountDEKs(ctx context.Context, kekID envelope.ID, version uint32) (int, error)
- func (s *Store) CreateKEK(ctx context.Context, k registry.KEK) error
- func (s *Store) CurrentDEK(ctx context.Context, purpose keyforge.Purpose, subject string) (keyforge.DEKRecord, error)
- func (s *Store) GetDEK(ctx context.Context, id envelope.ID) (keyforge.DEKRecord, error)
- func (s *Store) GetKEK(ctx context.Context, id envelope.ID) (registry.KEK, error)
- func (s *Store) GetSentinel(ctx context.Context, kekID envelope.ID, version uint32) (registry.Sentinel, error)
- func (s *Store) GetShred(ctx context.Context, purpose keyforge.Purpose, subject string) (registry.ShredRecord, error)
- func (s *Store) GetVersion(ctx context.Context, kekID envelope.ID, version uint32) (registry.VersionRecord, error)
- func (s *Store) KEK(ctx context.Context, id envelope.ID) (provider.KeyRef, error)
- func (s *Store) KEKForPurpose(ctx context.Context, purpose keyforge.Purpose) (registry.KEK, error)
- func (s *Store) KEKVersionUsable(ctx context.Context, id envelope.ID, version uint32) (bool, error)
- func (s *Store) ListDEKs(ctx context.Context, f registry.DEKFilter) ([]keyforge.DEKRecord, error)
- func (s *Store) ListKEKs(ctx context.Context) ([]registry.KEK, error)
- func (s *Store) ListSentinels(ctx context.Context, kekID envelope.ID) ([]registry.Sentinel, error)
- func (s *Store) ListShreds(ctx context.Context) ([]registry.ShredRecord, error)
- func (s *Store) ListVersions(ctx context.Context, kekID envelope.ID) ([]registry.VersionRecord, error)
- func (s *Store) MarkDEK(ctx context.Context, id envelope.ID, to keyforge.DEKState) error
- func (s *Store) Migrate(ctx context.Context) error
- func (s *Store) Ping(ctx context.Context) error
- func (s *Store) PutSentinel(ctx context.Context, sn registry.Sentinel) error
- func (s *Store) ReserveEncryptions(ctx context.Context, id envelope.ID, n, limit uint64) (uint64, error)
- func (s *Store) RewrapDEK(ctx context.Context, r registry.Rewrap) error
- func (s *Store) ShredSubject(ctx context.Context, purpose keyforge.Purpose, subject string, at time.Time) (registry.ShredRecord, error)
- func (s *Store) TransitionVersion(ctx context.Context, kekID envelope.ID, version uint32, ...) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Dialect ¶
type Dialect string
Dialect names a supported database engine.
const ( // SQLite is a single-file embedded database. SQLite Dialect = Dialect(entdialect.SQLite) // Postgres is PostgreSQL. Postgres Dialect = Dialect(entdialect.Postgres) )
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is a registry in a SQL database. It is safe for concurrent use.
func New ¶
New returns a store over an open database. The caller owns db and closes it. It does not create the schema: call Store.Migrate first.
func OpenPostgres ¶
OpenPostgres opens a PostgreSQL database by connection string and creates its schema. It uses pgx.
func OpenSQLite ¶
OpenSQLite opens, or creates, a SQLite database file and its schema. It is the store for a single host. The database uses write-ahead logging, waits for a busy lock rather than failing, enforces foreign keys, and begins write transactions immediately so that writers queue.
Use ":memory:" for a database that lives as long as the store.
func (*Store) ActiveKEK ¶
func (s *Store) ActiveKEK(ctx context.Context, purpose keyforge.Purpose) (keyforge.KEKVersion, error)
ActiveKEK implements keyforge.Store.
func (*Store) AddVersion ¶
AddVersion implements registry.Store.
func (*Store) AdvanceDEK ¶
func (s *Store) AdvanceDEK(ctx context.Context, purpose keyforge.Purpose, subject string, from uint32, next keyforge.DEKRecord) (keyforge.DEKRecord, error)
AdvanceDEK implements keyforge.Store.
func (*Store) Backup ¶
Backup writes a consistent copy of a SQLite registry to path, which must not exist. It is safe while the store is in use: the copy is a snapshot taken in one transaction, including what is still in the write-ahead log, so copying the database file by itself is not a backup.
A restored registry is only usable with a keyring that holds the key versions it names, so a backup of the registry and a backup of the keyring belong together.
func (*Store) CompleteShred ¶
func (s *Store) CompleteShred(ctx context.Context, purpose keyforge.Purpose, subject string, at time.Time) (registry.ShredRecord, error)
CompleteShred implements registry.Store.
func (*Store) CountDEKStates ¶
func (s *Store) CountDEKStates(ctx context.Context, purpose keyforge.Purpose) (map[keyforge.DEKState]int, error)
CountDEKStates implements registry.Store.
func (*Store) CountDEKs ¶
CountDEKs implements registry.Store.
func (*Store) CreateKEK ¶
CreateKEK implements registry.Store.
func (*Store) CurrentDEK ¶
func (s *Store) CurrentDEK(ctx context.Context, purpose keyforge.Purpose, subject string) (keyforge.DEKRecord, error)
CurrentDEK implements keyforge.Store.
func (*Store) GetDEK ¶
GetDEK implements keyforge.Store.
func (*Store) GetKEK ¶
GetKEK implements registry.Store.
func (*Store) GetSentinel ¶
func (s *Store) GetSentinel(ctx context.Context, kekID envelope.ID, version uint32) (registry.Sentinel, error)
GetSentinel implements registry.Store.
func (*Store) GetShred ¶
func (s *Store) GetShred(ctx context.Context, purpose keyforge.Purpose, subject string) (registry.ShredRecord, error)
GetShred implements registry.Store.
func (*Store) GetVersion ¶
func (s *Store) GetVersion(ctx context.Context, kekID envelope.ID, version uint32) (registry.VersionRecord, error)
GetVersion implements registry.Store.
func (*Store) KEK ¶
KEK implements keyforge.Store.
func (*Store) KEKForPurpose ¶
KEKForPurpose implements registry.Store.
func (*Store) KEKVersionUsable ¶
KEKVersionUsable implements keyforge.Store.
func (*Store) ListDEKs ¶
ListDEKs implements registry.Store.
func (*Store) ListKEKs ¶
ListKEKs implements registry.Store.
func (*Store) ListSentinels ¶
ListSentinels implements registry.Store.
func (*Store) ListShreds ¶
ListShreds implements registry.Store.
func (*Store) ListVersions ¶
func (s *Store) ListVersions(ctx context.Context, kekID envelope.ID) ([]registry.VersionRecord, error)
ListVersions implements registry.Store.
func (*Store) MarkDEK ¶
MarkDEK implements registry.Store.
func (*Store) Migrate ¶
Migrate creates or updates the schema so that it matches this version of the store. It is idempotent.
func (*Store) PutSentinel ¶
PutSentinel implements registry.Store.
func (*Store) ReserveEncryptions ¶
func (s *Store) ReserveEncryptions(ctx context.Context, id envelope.ID, n, limit uint64) (uint64, error)
ReserveEncryptions implements keyforge.Store.
func (*Store) RewrapDEK ¶
RewrapDEK implements registry.Store.
func (*Store) ShredSubject ¶
func (s *Store) ShredSubject(ctx context.Context, purpose keyforge.Purpose, subject string, at time.Time) (registry.ShredRecord, error)
ShredSubject implements registry.Store.
func (*Store) TransitionVersion ¶
func (s *Store) TransitionVersion(ctx context.Context, kekID envelope.ID, version uint32, to registry.VersionState, opts registry.TransitionOptions) error
TransitionVersion implements registry.Store.
Source Files
Directories