39 lines
1.2 KiB
Go
39 lines
1.2 KiB
Go
package license
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/hyperboloide/lk"
|
|
)
|
|
|
|
// trustedPublicKeys are the keys a licence may be signed with, newest first.
|
|
//
|
|
// To rotate: prepend the new key, ship a server release that trusts both, then
|
|
// reissue. Remove a retired key only once every licence signed with it has
|
|
// expired.
|
|
//
|
|
// This is a slice from day one even though it holds one entry, because
|
|
// retrofitting a single-key verifier into a multi-key one during an incident is
|
|
// not a thing to plan for.
|
|
//
|
|
// These are compiled in and deliberately not configurable. A configurable trust
|
|
// root is a licensing bypass: a self-hosted operator could point it at a keypair
|
|
// they generated themselves.
|
|
var trustedPublicKeys = []string{
|
|
// Populated in Task 6 with the real production key.
|
|
// Until then this slice is empty and every licence fails to verify,
|
|
// which is the correct default for a build with no trust root.
|
|
}
|
|
|
|
func publicKeys() ([]*lk.PublicKey, error) {
|
|
out := make([]*lk.PublicKey, 0, len(trustedPublicKeys))
|
|
for i, s := range trustedPublicKeys {
|
|
k, err := lk.PublicKeyFromB32String(s)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("trusted public key %d is malformed: %w", i, err)
|
|
}
|
|
out = append(out, k)
|
|
}
|
|
return out, nil
|
|
}
|