Versions in this module Expand all Collapse all v0 v0.1.0 Oct 12, 2026 Changes in this version + const DefaultBatchSize + const SentinelContext + const SentinelPlaintext + var ErrBackupStale = errors.New("rotate: the keyring backup is not acknowledged as current") + var ErrBackupUnknown = errors.New("rotate: cannot tell whether the keyring is backed up") + var ErrEmergencyIncomplete = errors.New("rotate: the emergency rotation is not complete") + var ErrNoEpochAdvancer = errors.New("rotate: no epoch advancer is configured") + var ErrNotEligible = errors.New("rotate: the version is not eligible for retirement") + var ErrNothingToRewrap = errors.New("rotate: the version to re-wrap from is the active version") + var ErrWrongState = errors.New("rotate: the version is not in the state this operation needs") + type Backup interface + UpToDate func(ctx context.Context) (bool, error) + type Due struct + ActivatedAt time.Time + DueAt time.Time + KEK registry.KEK + Overdue bool + Purpose keyforge.Purpose + Version uint32 + type Eligibility struct + Eligible bool + InFloor bool + Reasons []string + References int + State registry.VersionState + type EmergencyKEKOptions struct + KeepMaterial bool + Rewrap RewrapOptions + type EmergencyKEKResult struct + Destroyed bool + Guard guard.Decision + Remaining int + Replacement Rotation + Retired bool + Rewrap RewrapResult + type EpochAdvancer interface + AdvanceEpoch func(ctx context.Context, purpose keyforge.Purpose, subject string) (keyforge.DEKRecord, error) + type ExposedDEK struct + EncryptionsUpperBound uint64 + Exposed keyforge.DEKRecord + Replacement keyforge.DEKRecord + type Options struct + Audit audit.Sink + Backups map[string]Backup + Clock keyforge.Clock + Entropy io.Reader + Epochs EpochAdvancer + Guard guard.Guard + Metrics metrics.Metrics + Policy policy.Set + Providers []provider.Provider + Store registry.Store + type PendingVersion struct + ExpectedBy time.Time + State registry.VersionState + Version keyforge.KEKVersionRef + type RetireResult struct + Outcome guard.Outcome + Reason string + State registry.VersionState + type RewrapAllResult struct + Done bool + Versions map[uint32]RewrapResult + type RewrapFailure struct + DEKID envelope.ID + Err error + type RewrapOptions struct + After envelope.ID + BatchSize int + Progress func(RewrapResult) + type RewrapResult struct + Cursor envelope.ID + Done bool + Failed []RewrapFailure + FailedCount int + Rewrapped int + Skipped int + type Rotation struct + At time.Time + From uint32 + KEK registry.KEK + To uint32 + type Rotator struct + func New(opts Options) (*Rotator, error) + func (r *Rotator) CancelRetirement(ctx context.Context, kekID envelope.ID, version uint32) (RetireResult, error) + func (r *Rotator) CompleteRetirement(ctx context.Context, kekID envelope.ID, version uint32) (RetireResult, error) + func (r *Rotator) CompleteShreds(ctx context.Context) ([]registry.ShredRecord, error) + func (r *Rotator) CompromiseDEK(ctx context.Context, id envelope.ID) (ExposedDEK, error) + func (r *Rotator) CompromiseKEK(ctx context.Context, kekID envelope.ID, version uint32, ...) (EmergencyKEKResult, error) + func (r *Rotator) Destroy(ctx context.Context, kekID envelope.ID, version uint32) (RetireResult, error) + func (r *Rotator) DestroyDEK(ctx context.Context, id envelope.ID) (RetireResult, error) + func (r *Rotator) Due(ctx context.Context, purpose keyforge.Purpose) (Due, error) + func (r *Rotator) Eligibility(ctx context.Context, kekID envelope.ID, version uint32) (Eligibility, error) + func (r *Rotator) EnsureKEK(ctx context.Context, purpose keyforge.Purpose, providerName string) (registry.KEK, error) + func (r *Rotator) RequestRetirement(ctx context.Context, kekID envelope.ID, version uint32) (RetireResult, error) + func (r *Rotator) RequestShred(ctx context.Context, purpose keyforge.Purpose, subject string) (registry.ShredRecord, error) + func (r *Rotator) Rewrap(ctx context.Context, kekID envelope.ID, from uint32, opts RewrapOptions) (RewrapResult, error) + func (r *Rotator) RewrapAll(ctx context.Context, kekID envelope.ID, opts RewrapOptions) (RewrapAllResult, error) + func (r *Rotator) Rollback(ctx context.Context, purpose keyforge.Purpose) (Rotation, error) + func (r *Rotator) RotateKEK(ctx context.Context, purpose keyforge.Purpose) (Rotation, error) + func (r *Rotator) ShredStatus(ctx context.Context, purpose keyforge.Purpose, subject string) (ShredStatus, error) + type ShredStatus struct + Complete bool + ExpectedBy time.Time + Pending []PendingVersion + Record registry.ShredRecord
Go to main page