Internal

internal/core/trust

github.com/nilstate/scafld/v2/internal/core/trust

import "github.com/nilstate/scafld/v2/internal/core/trust"

Constants

Source: internal/core/trust/trusted_keys.go:18

const (
	// TrustedKeysVersion is the current .scafld/trusted-keys.json schema version.
	TrustedKeysVersion = 1
	// AlgorithmEd25519 is the only signing algorithm supported by receipt keys.
	AlgorithmEd25519 = "ed25519"
)

Functions

func KeyIDFromRawEd25519PublicKey(raw []byte) (string, error)

Source: internal/core/trust/trusted_keys.go:47

KeyIDFromRawEd25519PublicKey returns the stable receipt key id for a raw public key.

func MarshalTrustedKeys(keys TrustedKeys) ([]byte, error)

Source: internal/core/trust/trusted_keys.go:70

MarshalTrustedKeys validates and marshals trusted keys with deterministic key order.

func ParseTrustedKeys(data []byte) (TrustedKeys, error)

Source: internal/core/trust/trusted_keys.go:56

ParseTrustedKeys parses and validates a trusted-key allowlist.

Types

type KeyLifecycleSummary

Source: internal/core/trust/trusted_keys.go:40

KeyLifecycleSummary counts trusted-key states at one point in time.

type KeyLifecycleSummary struct {
	Active  int
	Revoked int
	Expired int
}

Fields

Active int
Revoked int
Expired int

type TrustedKey

Source: internal/core/trust/trusted_keys.go:30

TrustedKey is one raw Ed25519 public key allowlist entry.

type TrustedKey struct {
	KeyID     string `json:"key_id"`
	Alg       string `json:"alg"`
	PublicKey string `json:"public_key"`
	Revoked   bool   `json:"revoked,omitempty"`
	RevokedAt string `json:"revoked_at,omitempty"`
	ExpiresAt string `json:"expires_at,omitempty"`
}

Fields

KeyID string `json:"key_id"`
Alg string `json:"alg"`
PublicKey string `json:"public_key"`
Revoked bool `json:"revoked,omitempty"`
RevokedAt string `json:"revoked_at,omitempty"`
ExpiresAt string `json:"expires_at,omitempty"`

func LifecycleStateAt(at time.Time) (state string, reason string, err error)

Source: internal/core/trust/trusted_keys.go:186

LifecycleStateAt reports whether key is active, revoked, or expired at at.

func PublicKeyBytes() ([]byte, error)

Source: internal/core/trust/trusted_keys.go:204

PublicKeyBytes decodes the raw Ed25519 public key.

type TrustedKeys

Source: internal/core/trust/trusted_keys.go:24

TrustedKeys is the .scafld/trusted-keys.json schema.

type TrustedKeys struct {
	Version int          `json:"version"`
	Keys    []TrustedKey `json:"keys"`
}

Fields

Version int `json:"version"`
Keys []TrustedKey `json:"keys"`

func ActiveKey(id string) (TrustedKey, error)

Source: internal/core/trust/trusted_keys.go:130

ActiveKey returns the non-revoked trusted key matching id. It is the single authority for receipt key lookup: an unknown id or a revoked key is rejected here so callers never re-implement revocation. Revoked entries remain valid in the allowlist file (so revoking one key does not brick the others); they are rejected only at the moment a receipt tries to use them.

func ActiveKeyAt(id string, mintedAt string) (TrustedKey, error)

Source: internal/core/trust/trusted_keys.go:146

ActiveKeyAt returns the trusted key matching id when it was valid at mintedAt. mintedAt must be RFC3339 because receipt verification evaluates key lifecycle against the signed receipt time, not against wall-clock now.

func LifecycleSummary(at time.Time) KeyLifecycleSummary

Source: internal/core/trust/trusted_keys.go:166

LifecycleSummary returns active/revoked/expired key counts at one point in time.

func Validate() error

Source: internal/core/trust/trusted_keys.go:87

Validate checks trusted-key schema and key identity integrity.

Built with

Edit this page