identity

Documentation

Overview

Package identity holds the peer's ed25519 keypair and the secret seed behind the rotating pseudonymous evidence IDs (goal.md §8.6, plan C10). The seed never leaves the machine; only HMAC-derived, epoch-scoped buckets appear in uploads, so the server can dedupe within an epoch but cannot link across epochs or recover paths.

Index

• func Verify(pubB64, sigB64 string, msg []byte) bool
• type Identity
  • func LoadOrCreate(home string) (*Identity, error)
  • func (id *Identity) AnonID(epochDay string) string
  • func (id *Identity) PeerID() string
  • func (id *Identity) ProjectBucket(projectPath, epochMonth string) string
  • func (id *Identity) PubkeyB64() string
  • func (id *Identity) Sign(msg []byte) string

Functions

func Verify

func Verify(pubB64, sigB64 string, msg []byte) bool

Verify reports whether sigB64 is a valid ed25519 signature by pubB64 over msg. Malformed inputs verify as false, never panic.

Types

type Identity

type Identity struct {
	// contains filtered or unexported fields
}

Identity is the loaded local identity. The zero value is unusable; obtain one via LoadOrCreate.

func LoadOrCreate

func LoadOrCreate(home string) (*Identity, error)

LoadOrCreate reads home/identity.json, generating and persisting a new identity (file mode 0600) if none exists.

func (*Identity) AnonID

func (id *Identity) AnonID(epochDay string) string

AnonID derives the rotating anonymous evidence ID for one daily epoch ("2026-08-13"): hex(HMAC-SHA256(seed, "anon|"+epochDay))[:16].

func (*Identity) PeerID

func (id *Identity) PeerID() string

PeerID is the persistent public identity: "ed25519:" + hex(sha256(pubkey))[:16].

func (*Identity) ProjectBucket

func (id *Identity) ProjectBucket(projectPath, epochMonth string) string

ProjectBucket derives the rotating per-project dedup bucket for one monthly epoch ("2026-08"): hex(HMAC-SHA256(seed, "proj|"+path+"|"+month))[:12]. The absolute path stays inside the HMAC input; it is never recoverable from the 12-hex output.

func (*Identity) PubkeyB64

func (id *Identity) PubkeyB64() string

PubkeyB64 returns the base64 ed25519 public key (receipt peerPubkey field).

func (*Identity) Sign

func (id *Identity) Sign(msg []byte) string

Sign returns the base64 ed25519 signature over msg (canonical JSON).