Documentation
¶
Overview ¶
Package firecrackerlaunchgrant owns the private, operator-only M3/M4 boot-probe binding.
Index ¶
Constants ¶
const ( // Version is the only accepted private Firecracker launch-grant wire version. Version = "firecracker-launch-grant/v1" // OperatorBootProbeOperation is the sole internal operation kind that this grant can authorize. OperatorBootProbeOperation = "firecracker-boot-probe" // GuestProtocolV1 is the pinned guest protocol expected by this limited boot probe. GuestProtocolV1 = "agent-runtime-firecracker-guest/v1" )
Variables ¶
var ( // ErrInvalidGrant identifies a malformed, widened, or non-canonical private boot-probe grant. ErrInvalidGrant = errors.New("invalid Firecracker launch grant") )
Functions ¶
func ValidateBinding ¶
func ValidateBinding(grant Grant, envelope EnvelopeTuple, identity TrustedM4Identity, now time.Time) error
ValidateBinding confirms that a decoded grant remains bound to the exact authenticated M3 tuple and trusted M4 identity supplied by its caller. The caller owns envelope authentication and M4 identity derivation; this function performs no request-body interpretation or host effect.
Types ¶
type EnvelopeTuple ¶
type EnvelopeTuple struct {
EnvelopeID string `json:"envelope_id"`
DeliveryID string `json:"delivery_id"`
Nonce string `json:"nonce"`
IssuedAt time.Time `json:"issued_at"`
ExpiresAt time.Time `json:"expires_at"`
HostID string `json:"host_id"`
HostGeneration uint64 `json:"host_generation"`
AssignmentID string `json:"assignment_id"`
LeaseEpoch uint64 `json:"lease_epoch"`
FencingToken uint64 `json:"fencing_token"`
Tenant string `json:"tenant"`
Principal string `json:"principal"`
SandboxID string `json:"sandbox_id"`
OperationID string `json:"operation_id"`
OperationKind string `json:"operation_kind"`
EffectiveSpecDigest sandbox.Digest `json:"effective_spec_digest"`
CapabilityDigest sandbox.Digest `json:"capability_digest"`
CanonicalRequestDigest sandbox.Digest `json:"canonical_request_digest"`
}
EnvelopeTuple is the already-authenticated M3 assignment identity bound to one grant. It carries the bounded delivery nonce and validity interval, but excludes the signed envelope payload and signature.
type Grant ¶
type Grant struct {
Version string `json:"version"`
Envelope EnvelopeTuple `json:"envelope"`
M4 TrustedM4Identity `json:"m4"`
GuestProtocol string `json:"guest_protocol"`
SerialMarker string `json:"serial_marker"`
}
Grant is a private, short-lived operator boot probe authorization, not a public sandbox lifecycle capability. It contains no raw request body, control signature, credential, or host path.
func New ¶
func New(envelope EnvelopeTuple, identity TrustedM4Identity) (Grant, error)
New creates the sole fixed-purpose grant from an already-authenticated M3 tuple and trusted M4 identity tuple. It does not interpret DispatchBody or launch a Jailer, VMM, guest, or vsock connection.
type TrustedM4Identity ¶
type TrustedM4Identity struct {
VMID string `json:"vm_id"`
FixtureVersion string `json:"fixture_version"`
PlanDigest sandbox.Digest `json:"plan_digest"`
FixtureDigest sandbox.Digest `json:"fixture_digest"`
StageDigest sandbox.Digest `json:"stage_digest"`
AuthorityDigest sandbox.Digest `json:"authority_digest"`
}
TrustedM4Identity is the non-secret identity digest tuple constructed from the exact M4 plan, fixture set, stage, and Jailer authority. Its producer is responsible for deriving each digest from validated M4 values; this codec only accepts the resulting immutable tuple.
Source Files