globalsigner

Documentation

Overview

Package globalsigner provides the TEE master key management service.

Package globalsigner provides the TEE master key management service.

Index

• Constants
• type AttestationArtifact
• type Config
• type DeriveRequest
• type DeriveResponse
• type KeyStatus
• type KeyVersion
• type KeysResponse
• type MasterKeyAttestation
• type RotateRequest
• type RotateResponse
• type RotationConfig
  • func DefaultRotationConfig() *RotationConfig
• type SGXReport
• type Service
  • func New(cfg Config) (*Service, error)
  • func (s *Service) ActiveVersion() string
  • func (s *Service) Derive(ctx context.Context, req *DeriveRequest) (*DeriveResponse, error)
  • func (s *Service) GetAttestation(ctx context.Context) (*MasterKeyAttestation, error)
  • func (s *Service) GetKeyVersion(version string) (*KeyVersion, error)
  • func (s *Service) ListKeyVersions() []*KeyVersion
  • func (s *Service) Logger() *logging.Logger
  • func (s *Service) RegisterRoutes(mux *http.ServeMux)
  • func (s *Service) Rotate(ctx context.Context, force bool) (*RotateResponse, error)
  • func (s *Service) Sign(ctx context.Context, req *SignRequest) (*SignResponse, error)
  • func (s *Service) SignRaw(ctx context.Context, req *SignRawRequest) (*SignResponse, error)
• type SignRawRequest
• type SignRequest
• type SignResponse
• type StatusResponse

Constants

const (
	ServiceID   = types.ServiceID
	ServiceName = types.ServiceName
	Version     = types.Version

	DefaultRotationPeriod = types.DefaultRotationPeriod
	DefaultOverlapPeriod  = types.DefaultOverlapPeriod
)

Service constants

const (
	KeyStatusPending     = types.KeyStatusPending
	KeyStatusActive      = types.KeyStatusActive
	KeyStatusOverlapping = types.KeyStatusOverlapping
	KeyStatusRevoked     = types.KeyStatusRevoked
)

Types

type AttestationArtifact

type AttestationArtifact = types.AttestationArtifact

Type aliases for backward compatibility

type Config

type Config struct {
	Marble         *marble.Marble
	DB             database.RepositoryInterface
	Repository     supabase.Repository
	RotationConfig *RotationConfig
	MaxBodyBytes   int64
	// DomainAllowlist optionally limits signing/derivation domains per service ID.
	DomainAllowlist map[string][]string
	// SignRawAllowlist optionally limits which services may call SignRaw.
	SignRawAllowlist []string
}

Config holds GlobalSigner service configuration.

type DeriveRequest

type DeriveRequest = types.DeriveRequest

Type aliases for backward compatibility

type DeriveResponse

type DeriveResponse = types.DeriveResponse

Type aliases for backward compatibility

type KeyStatus

type KeyStatus = types.KeyStatus

KeyStatus type and constants

type KeyVersion

type KeyVersion = types.KeyVersion

Type aliases for backward compatibility

type KeysResponse

type KeysResponse struct {
	ActiveVersion string        `json:"active_version"`
	KeyVersions   []*KeyVersion `json:"key_versions"`
}

KeysResponse is returned by GET /keys.

type MasterKeyAttestation

type MasterKeyAttestation = types.MasterKeyAttestation

Type aliases for backward compatibility

type RotateRequest

type RotateRequest = types.RotateRequest

Type aliases for backward compatibility

type RotateResponse

type RotateResponse = types.RotateResponse

Type aliases for backward compatibility

type RotationConfig

type RotationConfig = types.RotationConfig

Type aliases for backward compatibility

func DefaultRotationConfig

func DefaultRotationConfig() *RotationConfig

DefaultRotationConfig returns sensible defaults.

type SGXReport

type SGXReport struct {
	MRENCLAVE string
	MRSIGNER  string
	ProdID    uint16
	ISVSVN    uint16
}

SGXReport holds parsed SGX report fields.

type Service

type Service struct {
	*commonservice.BaseService
	// contains filtered or unexported fields
}

Service implements the GlobalSigner TEE master key management service.

func New

func New(cfg Config) (*Service, error)

New creates a new GlobalSigner service.

func (*Service) ActiveVersion

func (s *Service) ActiveVersion() string

ActiveVersion returns the currently active key version.

func (*Service) Derive

func (s *Service) Derive(ctx context.Context, req *DeriveRequest) (*DeriveResponse, error)

Derive performs deterministic child key derivation.

func (*Service) GetAttestation

func (s *Service) GetAttestation(ctx context.Context) (*MasterKeyAttestation, error)

GetAttestation returns the attestation for the active key.

func (*Service) GetKeyVersion

func (s *Service) GetKeyVersion(version string) (*KeyVersion, error)

GetKeyVersion returns information about a specific key version.

func (*Service) ListKeyVersions

func (s *Service) ListKeyVersions() []*KeyVersion

ListKeyVersions returns all loaded key versions.

func (*Service) Logger

func (s *Service) Logger() *logging.Logger

Logger returns the service logger.

func (*Service) RegisterRoutes

func (s *Service) RegisterRoutes(mux *http.ServeMux)

RegisterRoutes registers the GlobalSigner HTTP routes.

func (*Service) Rotate

func (s *Service) Rotate(ctx context.Context, force bool) (*RotateResponse, error)

Rotate performs a key rotation.

func (*Service) Sign

func (s *Service) Sign(ctx context.Context, req *SignRequest) (*SignResponse, error)

Sign performs domain-separated signing.

func (*Service) SignRaw

func (s *Service) SignRaw(ctx context.Context, req *SignRawRequest) (*SignResponse, error)

SignRaw signs data as-is without domain separation.

This is primarily intended for: - Neo transaction witness signing (hash.GetSignedData(net, tx)) - legacy on-chain messages that do not include a domain prefix

For most application-level signatures prefer Sign() which provides domain separation.

type SignRawRequest

type SignRawRequest = types.SignRawRequest

Type aliases for backward compatibility

type SignRequest

type SignRequest = types.SignRequest

Type aliases for backward compatibility

type SignResponse

type SignResponse = types.SignResponse

Type aliases for backward compatibility

type StatusResponse

type StatusResponse = types.StatusResponse

Type aliases for backward compatibility