basil_core/
lib.rs

1// SPDX-FileCopyrightText: 2026 OpenBasil Contributors
2//
3// SPDX-License-Identifier: Apache-2.0
4
5//! `basil-core` library: broker core, service adapters, and transport wiring.
6//!
7//! - [`core::catalog`] is the key inventory + authorization policy loaded at
8//!   startup.
9//! - [`core::state`] bundles the loaded policy + backend manager shared across
10//!   tonic services.
11//! - [`service`] contains tonic service adapters.
12//! - [`transport`] owns tonic wiring, peer extraction, and authorization helpers.
13
14// Index/slice in test code is fine (fixed test fixtures); the no-panic
15// `indexing_slicing` gate has no test-allow config option, unlike unwrap/expect.
16#![cfg_attr(test, allow(clippy::indexing_slicing))]
17
18#[cfg(all(
19    feature = "keystore-backend",
20    not(any(feature = "db-keystore", feature = "onepassword"))
21))]
22compile_error!("feature `keystore-backend` requires feature `db-keystore`, `onepassword`, or both");
23
24/// Default Unix socket path used by the daemon and local client tooling.
25pub const DEFAULT_SOCKET_PATH: &str = "/tmp/basil-agent.sock";
26
27/// Ensure a process-wide default rustls [`CryptoProvider`](rustls::crypto::CryptoProvider)
28/// is installed before any `reqwest` client is built.
29///
30/// `reqwest` is compiled with the `rustls-no-provider` feature (its `rustls`
31/// feature would pull in the `aws-lc-rs` C toolchain, which is forbidden here),
32/// so building a client panics unless a default provider is already installed.
33/// This daemon must never panic, so we install the pure-Rust `ring` provider
34/// (the same one used for the JWKS server and gRPC transport) exactly once. A
35/// prior install by an embedder is fine and left untouched (the returned `Err`
36/// only signals that a provider was already set).
37pub(crate) fn ensure_crypto_provider() {
38    use std::sync::Once;
39    static INSTALL: Once = Once::new();
40    INSTALL.call_once(|| {
41        let _ = rustls::crypto::ring::default_provider().install_default();
42    });
43}
44
45pub mod agent_cli;
46pub mod bundle_cli;
47pub mod core;
48#[cfg(feature = "keystore-backend")]
49pub mod demo;
50pub mod doctor;
51pub mod init;
52pub mod service;
53pub mod transport;
54pub mod unlock;
55
56#[cfg(feature = "tpm2")]
57pub use core::identity;
58pub use core::ml_dsa_sign;
59pub use core::{
60    actor, audit, backend, capability, catalog, decision, ed25519_sign, event, manager, minter,
61    ml_kem_envelope, peer, reconcile, reload, revocation, seal, state, x25519_seal,
62};
63pub use service::broker as grpc;
64#[cfg(feature = "http")]
65pub use service::jwks;
66pub use service::sds;
67pub use service::spiffe;
68pub use transport::grpc_server;
69
70pub use audit::{AuditLog, ReloadActor};
71#[cfg(feature = "keystore-backend")]
72pub use backend::keystore::KeystoreBackend;
73pub use backend::spiffe::{SpiffeConfig, SpiffeVaultBackend};
74pub use backend::vault::VaultBackend;
75pub use backend::{Backend, BackendError, NewKey};
76pub use capability::{
77    CapabilityError, CapabilityGap, CapabilityPolicy, CapabilitySummary, enforce_capabilities,
78};
79pub use catalog::{
80    BackendKind, Capability, Catalog, Config, LoadError, LoadWarning, MissingPolicy,
81    ResolvedPolicy, load,
82};
83pub use decision::{DecisionRecord, Outcome};
84pub use event::{BrokerEvent, BrokerEventKind, EventSource};
85pub use grpc_server::{DEFAULT_SOCKET_MODE, ServerConfig, run as run_grpc};
86pub use manager::{BackendManager, ManagerError};
87pub use peer::PeerInfo;
88pub use reconcile::{CheckReport, KeyCheck, KeyStatus, ReconcileError, ReconcileSummary};
89pub use reload::{ReloadError, ReloadInputs, ReloadOutcome, check_reload, reload_generation};
90pub use revocation::JwtRevocationStore;
91pub use seal::{
92    BackendCred, CredBundle, MasterKek, MethodKind, MethodRegistry, ParsedBundle, SealError,
93    SlotSpec, UnlockError, UnlockMethod,
94};
95pub use state::{
96    BrokerLimits, BrokerState, DEFAULT_MAX_ENCRYPT_SIZE, DEFAULT_MAX_PAYLOAD_SIZE,
97    DEFAULT_ROTATION_GRACE_VERSIONS, DEFAULT_SVID_TTL_SECS, Generation, INITIAL_GENERATION_ID,
98};
basil_core/lib.rs

basil_core/
lib.rs
