Module peer 

Peer attestation for accepted connections.

Adapted from brightnexus-platform’s attestation.rs and the PeerInfo shape in brightnexus-core’s handler.rs. We derive the connecting peer’s (uid, gid, pid) from SO_PEERCRED (via Tokio’s UCred) and enrich it from /proc: the executable path, the process lineage, and any wrapping SSH session.

Detail note: Linux SO_PEERCRED is a snapshot of the peer’s creds captured at time of connect(2). For short-lived RPC connections, or when called from a systemd service, creds at connect time is almost always the same as current effective creds.

On MacOS (not officially supported, but it works), getpeerid/LOCAL_PEERPID returns the peer’s current effective creds.

Structs

PeerInfo

Identity and attestation facts about a connected peer.

Functions

detect_ssh_session

If any ancestor in lineage is an sshd, return the (user, remote_host, sshd_pid) session it established.

lineage_pids

Walk the parent-PID chain starting at pid (capped at [LINEAGE_CAP]).

read_proc_environ

Read a process’s environment from /proc/<pid>/environ.