hatchery-build 0.2.3

Remote build and sign service for hatchery nodes: admission by node status, recipes only, signing keys stay on the build host
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14

//! Remote build and sign for hatchery nodes.
//!
//! A node that must not compile locally and must not hold signing secrets asks C2
//! (`POST /v1/build` on the enrollment listener, signed with its identity key). C2 checks the
//! node's status and the `build` capability, then asks the build host, which checks admission
//! again, runs a configured recipe, hashes the artifact and signs a receipt with a key that
//! never leaves the host.

pub mod host;
pub mod http;
pub mod wire;

pub use host::{serve, Admission, BuildError, BuildHost, C2Admission, Recipe, Recipes, Signer};
pub use wire::{BuildReceipt, BuildResponse, HostRequest, ReceiptError, SignedBuildRequest};