Documentation
¶
Overview ¶
Package escrow holds the restore key rules over the operator's escrow set (ADR-0204 Decisions 4, 5): the secrets key and the master secret a generation names, matched by content fingerprint, and the credentials a new master changes. funcd never writes the escrow set.
Index ¶
Constants ¶
const SecretsDir, MasterDir = "secrets", "master"
The escrow set's key directories (Decision 4).
Variables ¶
This section is empty.
Functions ¶
func CheckSecretsKey ¶
CheckSecretsKey requires the restore's secrets key to have the fingerprint m names, or both to be absent; else fault.Invalid naming that fingerprint and the escrow file matching it, if any. nil configured ⇒ no key.
func Find ¶
Find returns the file under dir/sub whose envelope.Fingerprint is fp; none ⇒ fault.NotFound naming fp, the fingerprints found and every symlink that does not resolve. Symlinked files and directories count as regular ones. The bytes are fingerprinted as they are, so an escrow copy must be byte-exact.
Types ¶
type Derived ¶
Derived is one credential a new master secret changes: Credential is "s3-keypair" or "catalog-token".
func ListChanged ¶
ListChanged reads the loaded store for every credential derived from the master (Decision 5): a Function's spec.blob keypair (addS3Env) and spec.catalogs token (resolveCatalogEnv), a CatalogService's spec.blob keypair (engineEnv); keypairs gateway on or off, since a copy may predate the config. nil unless plan.List.
type MasterPlan ¶
MasterPlan is what a restore does with the master secret after the load: write Install, when set, to Path 0600; List: acceptNew took another master, or m names none, so ListChanged prints the credentials that change.
func PlanMaster ¶
func PlanMaster(m backup.Manifest, masterFile, dataDir, dir string, acceptNew bool) (MasterPlan, error)
PlanMaster, before any part is read, writes nothing (Decision 5): a set masterFile must have m's fingerprint; unset, the matching file under dir/MasterDir is to be installed at Decision 7's path; else fault.Invalid naming the fingerprint, unless acceptNew. m naming no master is no check, nothing installed, and a list of what may change.
Source Files