configlock

Documentation

Overview

Package configlock protects runtime configuration with signed bundles and an explicit draft→…→active lifecycle.

Index

• Variables
• type Bundle
  • func (b *Bundle) ComputeContentHash()
  • func (b *Bundle) Sign(key signing.PrivateKey) error
  • func (b Bundle) VerifyContentHash() error
  • func (b Bundle) VerifySignatures(keys *signing.KeyRing) error
• type Manager
  • func NewManager(opts ...ManagerOption) *Manager
  • func (m *Manager) Activate(rev uint64) error
  • func (m *Manager) Active() (*Bundle, bool)
  • func (m *Manager) Approve(rev uint64) error
  • func (m *Manager) Draft(service, env string, content json.RawMessage) (*Bundle, error)
  • func (m *Manager) Get(rev uint64) (*Bundle, error)
  • func (m *Manager) SignRevision(rev uint64, key signing.PrivateKey) error
  • func (m *Manager) Stage(rev uint64) error
  • func (m *Manager) Validate(rev uint64) error
• type ManagerOption
  • func Production(v bool) ManagerOption
  • func RequireSignatures(v bool) ManagerOption
  • func WithKeyRing(keys *signing.KeyRing) ManagerOption
• type State

Variables

var (
	ErrInvalidState     = errors.New("configlock: invalid state transition")
	ErrHashMismatch     = errors.New("configlock: content hash mismatch")
	ErrUnsignedRequired = errors.New("configlock: signatures required for production activation")
	ErrBadSignature     = errors.New("configlock: invalid signature")
	ErrNotFound         = errors.New("configlock: bundle not found")
	ErrExpired          = errors.New("configlock: bundle expired")
)

Types

type Bundle

type Bundle struct {
	Version     uint32              `json:"version"`
	Revision    uint64              `json:"revision"`
	Service     string              `json:"service"`
	Environment string              `json:"environment"`
	CreatedAt   time.Time           `json:"created_at"`
	ActivatesAt *time.Time          `json:"activates_at,omitempty"`
	ExpiresAt   *time.Time          `json:"expires_at,omitempty"`
	Content     json.RawMessage     `json:"content"`
	ContentHash [32]byte            `json:"content_hash"`
	Signatures  []signing.Signature `json:"signatures,omitempty"`
	State       State               `json:"state"`
}

Bundle is a signed configuration payload.

func (*Bundle) ComputeContentHash

func (b *Bundle) ComputeContentHash()

ComputeContentHash sets ContentHash from Content bytes.

func (*Bundle) Sign

func (b *Bundle) Sign(key signing.PrivateKey) error

Sign appends an Ed25519 signature over the canonical bundle body.

func (Bundle) VerifyContentHash

func (b Bundle) VerifyContentHash() error

VerifyContentHash checks ContentHash matches Content.

func (Bundle) VerifySignatures

func (b Bundle) VerifySignatures(keys *signing.KeyRing) error

VerifySignatures checks all signatures against the key ring.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager tracks configuration lifecycle.

func NewManager

func NewManager(opts ...ManagerOption) *Manager

NewManager creates a configuration manager.

func (*Manager) Activate

func (m *Manager) Activate(rev uint64) error

Activate moves approved → active. Production + RequireSignatures rejects unsigned.

func (*Manager) Active

func (m *Manager) Active() (*Bundle, bool)

Active returns the active bundle copy, if any.

func (*Manager) Approve

func (m *Manager) Approve(rev uint64) error

Approve moves validated → approved.

func (*Manager) Draft

func (m *Manager) Draft(service, env string, content json.RawMessage) (*Bundle, error)

Draft creates a new draft bundle.

func (*Manager) Get

func (m *Manager) Get(rev uint64) (*Bundle, error)

Get returns a copy of a revision.

func (*Manager) SignRevision

func (m *Manager) SignRevision(rev uint64, key signing.PrivateKey) error

SignRevision signs a stored bundle.

func (*Manager) Stage

func (m *Manager) Stage(rev uint64) error

Stage moves draft → staged.

func (*Manager) Validate

func (m *Manager) Validate(rev uint64) error

Validate moves staged → validated after hash check.

type ManagerOption

type ManagerOption func(*Manager)

ManagerOption configures Manager.

func Production

func Production(v bool) ManagerOption

Production marks the environment as production (unsigned activation rejected when required).

func RequireSignatures

func RequireSignatures(v bool) ManagerOption

RequireSignatures forces signatures for activation when production is set.

func WithKeyRing

func WithKeyRing(keys *signing.KeyRing) ManagerOption

WithKeyRing sets trusted verification keys.

type State

type State string

State is the configuration lifecycle state.

const (
	StateDraft      State = "draft"
	StateStaged     State = "staged"
	StateValidated  State = "validated"
	StateApproved   State = "approved"
	StateActive     State = "active"
	StateSuperseded State = "superseded"
	StateRevoked    State = "revoked"
	StateRejected   State = "rejected"
)