diff --git a/go/delivery/enrolment.go b/go/delivery/enrolment.go index 24b624e..4526bbd 100644 --- a/go/delivery/enrolment.go +++ b/go/delivery/enrolment.go @@ -303,30 +303,6 @@ func (a RedeemAnswer) SignedBytes() []byte { return raw } -// **The vault's enrolment verbs** (ADR 0561 §5, ADR 0587 §3, §5), asked by mesh-enrolment alone. -const ( - EnrolmentTokenVerb = "enrolment-token" - NodeAccountVerb = "node-account" -) - -// EnrolmentTokenAnswer is what enrolment-token answers: what the joining machine must trust (the bus's address, its -// certificate's fingerprint, the vault's public signing key in base64), never the token; Sealed holds the token sealed -// to the operator key when asked with sealed, relayed by tokens as it is; Dropped says a drop left neither the token -// nor its hash. -type EnrolmentTokenAnswer struct { - Node string `json:"node"` - Broker string `json:"broker,omitempty"` - Fingerprint string `json:"fingerprint,omitempty"` - Signer string `json:"signer,omitempty"` - Sealed string `json:"sealed,omitempty"` - Dropped bool `json:"dropped,omitempty"` -} - -// NodeAccountAnswer is what node-account answers: the login minted, the account sealed to the sealing key the node -// presented (base64), never in the clear; Retired says a retire left no account. -type NodeAccountAnswer struct { - Node string `json:"node"` - Login string `json:"login,omitempty"` - Account string `json:"account,omitempty"` - Retired bool `json:"retired,omitempty"` -} +// The vault's enrolment verbs (ADR 0561 §5, ADR 0587 §3, §5), asked by mesh-enrolment alone, and their answers are the +// vault's contract's (mesh-contracts meshvault: VerbEnrolmentToken, EnrolmentTokenAnswer, VerbNodeAccount, +// NodeAccountAnswer; novox/hq ADR 0627 §1). diff --git a/go/delivery/signers.go b/go/delivery/signers.go index 04c86bf..5a6b435 100644 --- a/go/delivery/signers.go +++ b/go/delivery/signers.go @@ -39,11 +39,8 @@ const ( SignersKeyKey = "key" SignersAuthorityKey = "authority" - // SignVerb is the vault's verb that signs. - SignVerb = "sign" - // SignedEvent is what the vault says when it signed (Signed), on SignedSubject. - SignedEvent = "signed" - SignedSubject = "mesh.mod." + VaultModule + ".event." + SignedEvent + // The verb sign, its answer and the event signed are the vault's contract's (mesh-contracts meshvault: VerbSign, + // SignAnswer, HolderEventSigned, HolderSubjectSigned, SignedHolderEvent; novox/hq ADR 0627 §1). // KindNodeCertificate is a node's certificate for its internal name, asked by that node's node-engine alone. KindNodeCertificate = "node-certificate" @@ -200,28 +197,6 @@ func SignMessage(key ed25519.PrivateKey, context string, msg []byte) []byte { return ed25519.Sign(key, append([]byte(context), msg...)) } -// Signed is the vault's `signed`: who asked, the kind, the node, and the sha256 digest of what was signed. Never a key. -type Signed struct { - Caller string `json:"caller"` - Kind string `json:"kind"` - Node string `json:"node,omitempty"` - Digest string `json:"digest"` - Signer string `json:"signer"` - At time.Time `json:"at"` -} - -// SignAnswer is what `sign` answers: for a node certificate the certificate as PEM and the authority that signed it, -// for an enrolment the signature in base64; always the signer's fingerprint and the digest. Never a key's private half. -type SignAnswer struct { - Kind string `json:"kind"` - Node string `json:"node,omitempty"` - Certificate string `json:"certificate,omitempty"` - Authority string `json:"authority,omitempty"` - Signature string `json:"signature,omitempty"` - Signer string `json:"signer"` - Digest string `json:"digest"` -} - // DigestOf is the digest a `signed` names: `sha256:` of the bytes signed. func DigestOf(b []byte) string { sum := sha256.Sum256(b)