Struct RevocationList 

pub struct RevocationList { /* private fields */ }

Persistent host revocation manager.

Thread-safe via internal Mutex. Reads and writes a JSON file on disk so that bans survive kernel restarts.

Implementations

impl RevocationList

pub fn generation(&self) -> u64

How many times the subject list has changed in this process. A caller that read the list, then did something slow, compares this to know a revocation landed in between.

pub fn set_audit(&self, sink: AuditSink) -> bool

Install the sink every revocation and un-revocation is recorded in (first call wins). The kernel points it at the chain at boot, so a revocation applied by the operator, by a mesh notice or by any other caller is chained without that caller having to remember to.

pub fn revoke_subject( &self, kind: RevocationKind, id: &str, reason: &str, ) -> Result<bool, RevocationError>

Revoke a package id, signer key or artifact hash and persist it, recorded as revoked by local. See Self::revoke_subject_by.

pub fn revoke_subject_by( &self, kind: RevocationKind, id: &str, reason: &str, by: &str, ) -> Result<bool, RevocationError>

Self::revoke_subject naming who revoked it, for the audit record.

Returns Ok(true) if newly added, Ok(false) if already revoked. A new revocation is audited before the persistence result is returned: if the write fails the entry still holds in memory (fail-closed) and the record says persisted: false, so the event is never lost with the write. The caller still gets the error.

pub fn revoke_audited( &self, kind: RevocationKind, id: &str, reason: &str, by: &str, sink: Option<&'_ dyn Fn(&str, Value)>, ) -> Result<bool, RevocationError>

Self::revoke_subject_by recording to sink instead of the installed one.

pub fn unrevoke_subject( &self, kind: RevocationKind, id: &str, ) -> Result<bool, RevocationError>

Remove a subject revocation, recorded as lifted by local. Returns Ok(true) if it was present.

pub fn unrevoke_subject_by( &self, kind: RevocationKind, id: &str, by: &str, ) -> Result<bool, RevocationError>

Self::unrevoke_subject naming who lifted it. Chained like a revocation (workload.unrevoke), including when the write fails.

pub fn unrevoke_audited( &self, kind: RevocationKind, id: &str, by: &str, sink: Option<&'_ dyn Fn(&str, Value)>, ) -> Result<bool, RevocationError>

Self::unrevoke_subject_by recording to sink instead of the installed one.

pub fn is_subject_revoked(&self, kind: RevocationKind, id: &str) -> bool

Whether a subject is revoked. Invalid ids are never revoked.

pub fn find_subject( &self, kind: RevocationKind, id: &str, ) -> Option<RevokedSubject>

Look up a revoked subject by kind and id.

pub fn list_subjects(&self, kind: Option<RevocationKind>) -> Vec<RevokedSubject>

List revoked subjects, optionally filtered by kind.

pub fn first_revoked<'a>( &self, package_id: Option<&str>, signer_keys: impl IntoIterator<Item = &'a String>, artifact_hashes: impl IntoIterator<Item = &'a String>, ) -> Option<RevokedSubject>

First revoked subject among a package id, signers and artifact hashes.

pub fn subjects_error(&self) -> Option<String>

Load error of the subjects file, if the list is poisoned.

pub fn subjects_path(&self) -> PathBuf

Path of the subjects file.

impl RevocationList

pub fn new(path: PathBuf) -> Self

Create a new empty revocation list that persists to path.

pub fn load(path: PathBuf) -> Self

Load the ban list from disk. If the file does not exist or is malformed, starts with an empty list.

pub fn revoke_host(&self, host_id: &str, reason: &str) -> bool

Revoke a host. Adds to the ban list and persists to disk.

Returns true if newly added, false if already revoked.

pub fn is_revoked(&self, host_id: &str) -> bool

Check whether a host is currently revoked.

pub fn list_revoked(&self) -> Vec<RevokedHost>

List all revoked hosts.

pub fn unrevoke_host(&self, host_id: &str) -> bool

Remove a host from the ban list. Returns true if it was present.

pub fn len(&self) -> usize

Return the number of revoked hosts.

pub fn is_empty(&self) -> bool

Check if the revocation list is empty.

pub fn path(&self) -> PathBuf

Get the file path used for persistence.