basil_core/
lib.rs

1// SPDX-FileCopyrightText: 2026 OpenBasil Contributors
2//
3// SPDX-License-Identifier: Apache-2.0
4
5//! `basil-core` library: broker core, service adapters, and transport wiring.
6//!
7//! - [`core::catalog`] is the key inventory + authorization policy loaded at
8//!   startup.
9//! - [`core::state`] bundles the loaded policy + backend manager shared across
10//!   tonic services.
11//! - [`service`] contains tonic service adapters.
12//! - [`transport`] owns tonic wiring, peer extraction, and authorization helpers.
13
14// Index/slice in test code is fine (fixed test fixtures); the no-panic
15// `indexing_slicing` gate has no test-allow config option, unlike unwrap/expect.
16#![cfg_attr(test, allow(clippy::indexing_slicing))]
17
18#[cfg(all(
19    feature = "keystore-backend",
20    not(any(feature = "db-keystore", feature = "onepassword"))
21))]
22compile_error!("feature `keystore-backend` requires feature `db-keystore`, `onepassword`, or both");
23
24/// Default Unix socket path used by the daemon and local client tooling.
25pub const DEFAULT_SOCKET_PATH: &str = "/tmp/basil-agent.sock";
26
27/// Ensure a process-wide default rustls [`CryptoProvider`](rustls::crypto::CryptoProvider)
28/// is installed before any `reqwest` client is built.
29///
30/// `reqwest` is compiled with the `rustls-no-provider` feature (its `rustls`
31/// feature would pull in the `aws-lc-rs` C toolchain, which is forbidden here),
32/// so building a client panics unless a default provider is already installed.
33/// This daemon must never panic, so we install the pure-Rust `ring` provider
34/// (the same one used for the JWKS server and gRPC transport) exactly once. A
35/// prior install by an embedder is fine and left untouched (the returned `Err`
36/// only signals that a provider was already set).
37pub(crate) fn ensure_crypto_provider() {
38    use std::sync::Once;
39    static INSTALL: Once = Once::new();
40    INSTALL.call_once(|| {
41        let _ = rustls::crypto::ring::default_provider().install_default();
42    });
43}
44
45pub mod agent_cli;
46pub mod bundle_cli;
47pub mod core;
48pub mod doctor;
49pub mod init;
50pub mod service;
51pub mod transport;
52pub mod unlock;
53
54#[cfg(feature = "tpm2")]
55pub use core::identity;
56pub use core::ml_dsa_sign;
57pub use core::{
58    actor, audit, backend, capability, catalog, decision, ed25519_sign, event, manager, minter,
59    ml_kem_envelope, peer, reconcile, reload, revocation, seal, state, x25519_seal,
60};
61pub use service::broker as grpc;
62#[cfg(feature = "http")]
63pub use service::jwks;
64pub use service::sds;
65pub use service::spiffe;
66pub use transport::grpc_server;
67
68pub use audit::{AuditLog, ReloadActor};
69#[cfg(feature = "keystore-backend")]
70pub use backend::keystore::KeystoreBackend;
71pub use backend::spiffe::{SpiffeConfig, SpiffeVaultBackend};
72pub use backend::vault::VaultBackend;
73pub use backend::{Backend, BackendError, NewKey};
74pub use capability::{
75    CapabilityError, CapabilityGap, CapabilityPolicy, CapabilitySummary, enforce_capabilities,
76};
77pub use catalog::{
78    BackendKind, Capability, Catalog, Config, LoadError, LoadWarning, MissingPolicy,
79    ResolvedPolicy, load,
80};
81pub use decision::{DecisionRecord, Outcome};
82pub use event::{BrokerEvent, BrokerEventKind, EventSource};
83pub use grpc_server::{DEFAULT_SOCKET_MODE, ServerConfig, run as run_grpc};
84pub use manager::{BackendManager, ManagerError};
85pub use peer::PeerInfo;
86pub use reconcile::{CheckReport, KeyCheck, KeyStatus, ReconcileError, ReconcileSummary};
87pub use reload::{ReloadError, ReloadInputs, ReloadOutcome, check_reload, reload_generation};
88pub use revocation::JwtRevocationStore;
89pub use seal::{
90    BackendCred, CredBundle, MasterKek, MethodKind, MethodRegistry, ParsedBundle, SealError,
91    SlotSpec, UnlockError, UnlockMethod,
92};
93pub use state::{
94    BrokerLimits, BrokerState, DEFAULT_MAX_ENCRYPT_SIZE, DEFAULT_MAX_PAYLOAD_SIZE,
95    DEFAULT_ROTATION_GRACE_VERSIONS, DEFAULT_SVID_TTL_SECS, Generation, INITIAL_GENERATION_ID,
96};
basil_core/lib.rs

basil_core/
lib.rs
