Versions in this module Expand all Collapse all v0 v0.1.1 Jul 5, 2026 v0.1.0 Jun 29, 2026 Changes in this version + const AEADAES256GCM + const AuditCheckpointSchema + const EnvelopeSchema + const InventoryReportSchema + const KDFHKDFSHA256 + const MTCCheckpointSchema + const MTCLogSchema + const MTCProofSchema + const MTCTreeheadCacheSchema + const MerkleHashSHA256 + const ReadinessScanSchema + const RevocationManifestSchema + const SignatureSchema + const TLSReadinessPolicyPublicWeb2029 + const TLSVerificationCustom + const TLSVerificationSkipped + const TLSVerificationSystem + const TransparencyBundleSchema + const TransparencyCheckpointSchema + var ErrInvalidEnvelope = errors.New("invalid envelope") + var ErrInvalidSignature = errors.New("invalid signature") + var ErrKeyExists = errors.New("key already exists") + var ErrKeyNotFound = errors.New("key not found") + func ApplyTLSReadinessPolicy(report *InventoryReport, policyID string, now time.Time) error + func DefaultMTCTreeheadLogID(source string) string + func MTCLeafHash(entry MTCLogEntry) (string, error) + func MTCTreeheadEntryID(entry MTCTreeheadEntry) (string, error) + func MerkleRootHex(leaves [][]byte) string + func ParseRevocationSubject(subjectType, subject string) (string, string, error) + func PublicKeyFingerprint(publicKey []byte) string + func RevocationEventID(event RevocationEvent) (string, error) + func RevocationManifestDigest(manifest RevocationManifest) (string, error) + func RevocationManifestRoot(manifest RevocationManifest) (string, error) + func SignAuditCheckpoint(ctx context.Context, manager interface{ ... }, checkpoint *AuditCheckpoint, ...) error + func SignMTCCheckpoint(ctx context.Context, manager interface{ ... }, checkpoint *MTCCheckpoint, ...) error + func SignTransparencyCheckpoint(ctx context.Context, manager interface{ ... }, ...) error + func ValidateRevocationManifest(manifest RevocationManifest) error + func VerifyAuditCheckpoint(r io.Reader, checkpoint *AuditCheckpoint, publicKey *PublicKey) error + func VerifyMTCProof(proof *MTCProof, checkpoint *MTCCheckpoint, publicKey *PublicKey) error + func VerifyTransparencyBundle(bundle TransparencyBundle, publicKey *PublicKey) error + func VerifyTransparencyCheckpoint(report InventoryReport, checkpoint *TransparencyCheckpoint, ...) error + func VerifyTransparencyCheckpointWithRevocations(report InventoryReport, revocations *RevocationManifest, ...) error + func VerifyWithPublicKey(publicKey PublicKey, message []byte, sig *SignatureEnvelope) error + func WriteRevocationManifest(w io.Writer, manifest RevocationManifest) error + type Algorithm string + const AlgorithmMLDSA65 + const AlgorithmMLDSA87 + const AlgorithmMLKEM768 + func ParseAlgorithm(value string) (Algorithm, error) + func (a Algorithm) Use() (KeyUse, error) + func (a Algorithm) Validate() error + type AuditCheckpoint struct + AuditDigest string + CreatedAt time.Time + Hash string + LeafCount int + MerkleRoot string + Schema string + Signature *SignatureEnvelope + func BuildAuditCheckpoint(r io.Reader, now time.Time) (*AuditCheckpoint, error) + type AuditEvent struct + Algorithm Algorithm + Error string + KeyID string + KeyVersion int + Operation string + Success bool + Time time.Time + type Auditor interface + Record func(context.Context, AuditEvent) error + type AuditorFunc func(context.Context, AuditEvent) error + func (f AuditorFunc) Record(ctx context.Context, event AuditEvent) error + type EncryptOptions struct + AAD []byte + type Envelope struct + AEAD string + Ciphertext []byte + CreatedAt time.Time + EncapsulatedKey []byte + KDF string + KEM Algorithm + KeyID string + KeyVersion int + Nonce []byte + Salt []byte + Schema string + type FileAuditor struct + func NewFileAuditor(path string) (*FileAuditor, error) + func (a *FileAuditor) Record(ctx context.Context, event AuditEvent) error + type GenerateRequest struct + Algorithm Algorithm + ID string + type InventoryEntry struct + Algorithm Algorithm + CreatedAt time.Time + ID string + PublicKeyFingerprint string + RotationAgeHours int + Use KeyUse + Version int + type InventoryReport struct + CreatedAt time.Time + KeyStoreScanned bool + Keys []InventoryEntry + Policy string + Schema string + Targets []TLSReport + Warnings []string + func BuildInventoryReport(keys []KeyMetadata, targets []TLSReport, now time.Time) InventoryReport + type KeyMetadata struct + Algorithm Algorithm + CreatedAt time.Time + ID string + PublicKey []byte + Use KeyUse + Version int + type KeyRecord struct + Algorithm Algorithm + CreatedAt time.Time + ID string + PrivateKey []byte + PublicKey []byte + Use KeyUse + Version int + type KeyUse string + const KeyUseKEM + const KeyUseSignature + type MTCCheckpoint struct + GeneratedAt time.Time + Hash string + MerkleRoot string + Schema string + Signature *SignatureEnvelope + TreeSize int + func BuildMTCCheckpoint(log MTCLog, now time.Time) (*MTCCheckpoint, error) + type MTCLog struct + CreatedAt time.Time + Entries []MTCLogEntry + Hash string + Schema string + func NewMTCLog(now time.Time) MTCLog + func (l *MTCLog) Add(subject, publicKeyFingerprint string, metadata map[string]any, now time.Time) (MTCLogEntry, error) + type MTCLogEntry struct + Index int + IssuedAt time.Time + LeafHash string + Metadata map[string]any + PublicKeyFingerprint string + Subject string + type MTCProof struct + GeneratedAt time.Time + Hash string + Leaf MTCLogEntry + LeafIndex int + MerkleRoot string + Schema string + Siblings []MTCProofNode + TreeSize int + func BuildMTCProof(log MTCLog, leafIndex int, now time.Time) (*MTCProof, error) + type MTCProofNode struct + Hash string + Position string + type MTCTreeheadCache struct + FetchedAt time.Time + Schema string + Source string + Treeheads []MTCTreeheadEntry + func NewMTCTreeheadCache(source string, entries []MTCTreeheadEntry, now time.Time) MTCTreeheadCache + func ParseMTCTreeheadSource(data []byte, source string, publicKey *PublicKey, logID string, now time.Time) (MTCTreeheadCache, error) + type MTCTreeheadEntry struct + Checkpoint MTCCheckpoint + ID string + LogID string + PublicKey PublicKey + ReceivedAt time.Time + Source string + func NewMTCTreeheadEntry(source, logID string, checkpoint MTCCheckpoint, publicKey PublicKey, ...) (MTCTreeheadEntry, error) + type MTCTreeheadFinding struct + Evidence map[string]any + Message string + Severity string + Subject string + type MTCTreeheadVerifyResult struct + Findings []MTCTreeheadFinding + OK bool + Verified int + func VerifyMTCTreeheadCache(cache MTCTreeheadCache) (*MTCTreeheadVerifyResult, error) + type Manager struct + func NewManager(store Store, opts ...Option) *Manager + func (m *Manager) Decrypt(ctx context.Context, envelope *Envelope, opts EncryptOptions) (plaintext []byte, err error) + func (m *Manager) Encrypt(ctx context.Context, keyID string, plaintext []byte, opts EncryptOptions) (envelope *Envelope, err error) + func (m *Manager) ExportPublic(ctx context.Context, id string) (publicKey *PublicKey, err error) + func (m *Manager) Generate(ctx context.Context, req GenerateRequest) (meta *KeyMetadata, err error) + func (m *Manager) Get(ctx context.Context, id string) (meta *KeyMetadata, err error) + func (m *Manager) List(ctx context.Context) (keys []KeyMetadata, err error) + func (m *Manager) Rotate(ctx context.Context, id string) (meta *KeyMetadata, err error) + func (m *Manager) Sign(ctx context.Context, keyID string, message []byte, opts SignOptions) (signature *SignatureEnvelope, err error) + func (m *Manager) Verify(ctx context.Context, message []byte, sig *SignatureEnvelope) (err error) + type Option func(*Manager) + func WithAuditor(auditor Auditor) Option + func WithClock(now func() time.Time) Option + func WithRand(randReader io.Reader) Option + type PublicKey struct + Algorithm Algorithm + CreatedAt time.Time + ID string + PublicKey []byte + Use KeyUse + Version int + type ReadinessCategory struct + Applies bool + Evidence map[string]any + ID string + ScoreImpact int + Status string + Summary string + type ReadinessCoverage struct + Confidence string + CustomVerifiedTargetCount int + KeyCount int + KeyStoreScanned bool + ScoreImpact int + SystemVerifiedTargetCount int + TLSLifecycleReadinessTargetCount int + TLSTargetCount int + TLSTargetsScanned bool + UnverifiedTargetCount int + type ReadinessFinding struct + Evidence map[string]any + Message string + Severity string + Subject string + type ReadinessScan struct + Categories []ReadinessCategory + Coverage ReadinessCoverage + CreatedAt time.Time + Findings []ReadinessFinding + Inventory InventoryReport + Level string + Policy string + Schema string + Score int + Summary string + func BuildReadinessScan(report InventoryReport, now time.Time) ReadinessScan + type RevocationEvent struct + ID string + Metadata map[string]any + Reason string + RevokedAt time.Time + Subject string + Type string + type RevocationManifest struct + CreatedAt time.Time + Events []RevocationEvent + Hash string + Schema string + func NewRevocationManifest(now time.Time) RevocationManifest + func ReadRevocationManifest(r io.Reader) (RevocationManifest, error) + func (m *RevocationManifest) Add(subjectType, subject, reason string, metadata map[string]any, now time.Time) (RevocationEvent, error) + type SignOptions struct + Context []byte + Randomized bool + type SignatureEnvelope struct + Algorithm Algorithm + Context []byte + CreatedAt time.Time + KeyID string + KeyVersion int + Schema string + Signature []byte + type Store interface + Get func(ctx context.Context, id string) (KeyRecord, error) + GetVersion func(ctx context.Context, id string, version int) (KeyRecord, error) + List func(ctx context.Context) ([]KeyMetadata, error) + Put func(ctx context.Context, record KeyRecord) error + type TLSCertificate struct + DNSNames []string + FingerprintSHA256 string + Issuer string + NotAfter time.Time + NotBefore time.Time + PublicKeyAlgorithm string + RawBytes int + SignatureAlgorithm string + Subject string + type TLSInspectOptions struct + InsecureSkipVerify bool + PQC bool + RootCAs *x509.CertPool + ServerName string + Timeout time.Duration + type TLSReadiness struct + CertificateCount int + CertificateValidityDays int + ChainPublicKeyAlgorithms []string + ChainSignatureAlgorithms []string + ChainSizeBytes int + DaysUntilExpiry int + Findings []ReadinessFinding + HybridPQCKeyExchange bool + LeafPublicKeyAlgorithm string + LeafSignatureAlgorithm string + Policy TLSReadinessPolicy + ReadyFor47DayCerts bool + RecommendedRenewalCadenceDays int + RecommendedRenewalLeadTimeDays int + RenewalWindowRisk string + SANCount int + SANDCVReuseRisk string + SANDCVReuseRiskReason string + Target string + Verified bool + func EvaluateTLSReadiness(report TLSReport, policy TLSReadinessPolicy, now time.Time) TLSReadiness + type TLSReadinessPolicy struct + EffectiveDate time.Time + ID string + MaxDomainValidationReuseDays int + MaxValidityDays int + Name string + RecommendedRenewalCadenceDays int + RecommendedRenewalLeadTimeDays int + Source string + func PublicWeb2029TLSReadinessPolicy() TLSReadinessPolicy + func ResolveTLSReadinessPolicy(id string) (TLSReadinessPolicy, error) + type TLSReport struct + CertificateChainBytes int + CertificateCount int + Certificates []TLSCertificate + CipherSuite string + ECHAccepted bool + HybridPQCKeyExchange bool + InspectedAt time.Time + KeyExchange string + Leaf *TLSCertificate + OCSPStapled bool + Readiness *TLSReadiness + ServerName string + SignedCertificateStamps int + TLSVersion string + Target string + VerificationError string + VerificationMode string + Verified bool + Warnings []string + func InspectTLS(ctx context.Context, target string, opts TLSInspectOptions) (TLSReport, error) + type TransparencyBundle struct + Checkpoint TransparencyCheckpoint + Inventory InventoryReport + Revocations *RevocationManifest + Schema string + func BuildTransparencyBundle(report InventoryReport, checkpoint *TransparencyCheckpoint) (TransparencyBundle, error) + func BuildTransparencyBundleWithRevocations(report InventoryReport, revocations *RevocationManifest, ...) (TransparencyBundle, error) + type TransparencyCheckpoint struct + GeneratedAt time.Time + Hash string + InventoryRoot string + KeyCount int + MerkleRoot string + RevocationCount int + RevocationDigest string + RevocationRoot string + Schema string + Signature *SignatureEnvelope + TargetCount int + func BuildTransparencyCheckpoint(report InventoryReport, now time.Time) (*TransparencyCheckpoint, error) + func BuildTransparencyCheckpointWithRevocations(report InventoryReport, revocations *RevocationManifest, now time.Time) (*TransparencyCheckpoint, error)
Go to main page