Module signing 

The canonical bytes an operator signs, built on the operator’s own machine.

--sign-with takes a PKCS#8 Ed25519 key file and never sends it. This module builds the signed payload here, signs it here, and hands the caller a key_id and a detached signature. Those two fields are the only part of the signature that reaches a broker. The private key never leaves the machine that runs the command.

Why the byte layout is repeated rather than called

The audit crate owns the shared freeze field contract, and the broker re-exports it for compatibility. This module independently encodes those fields and the break-glass proposal fields; it does not call the broker’s private encoders. The golden vectors below pin these bytes field by field, so an encoder drift fails here rather than during an operator’s thaw.

The freeze layout

FREEZE_DOMAIN                     b"krabka-topic-freeze-v1\0"
cluster_id      u32 big-endian length, then the UTF-8 bytes
pattern_type    u8                3 literal, 4 prefixed
scope           u32 big-endian length, then the UTF-8 bytes
frozen          u8                1 freeze, 0 thaw
reason          u32 big-endian length, then the UTF-8 bytes
set_by          u32 big-endian length, then the UTF-8 bytes
set_at_ms       i64 big-endian
proposal_id     16 bytes

The break-glass approval layout

BREAK_GLASS_DOMAIN                b"krabka-break-glass-v1\0"
proposal_id     16 bytes
action          u8                the wire value of the action
target          u32 big-endian length, then the UTF-8 bytes
proposer        u32 big-endian length, then the UTF-8 bytes
created_at_ms   i64 big-endian
expires_at_ms   i64 big-endian

An approval signs the proposal that the broker holds, and not a proposal the caller supplies. So krabka-guard break-glass approve --sign-with reads the proposal back first and signs what the broker stored. The approvals list is outside the signed bytes on purpose: every approver signs the same payload, and a payload that grew with each approval could never verify twice.

Structs

ApprovalSigningInput

The break-glass proposal fields that an approval signature covers.

FreezeSigningInput

The freeze fields shared by the broker and operator CLI. Both sides encode these fields independently into the signed wire payload.

Constants

BREAK_GLASS_DOMAIN

Domain separator for a break-glass approval signature (KFC-9).

FREEZE_DOMAIN

Domain separator for a freeze record signature (KFC-9).

Functions

approval_signing_bytes

Build the canonical bytes that an approval of one proposal signs.

freeze_signing_bytes

Build the canonical bytes of a freeze record.

freeze_signing_input

Project the signed values from a described freeze returned by the broker.

load_signer

Read the PKCS#8 Ed25519 key at path as the key named key_id.