manifest

type Certificate x509.Certificate

type File struct {
	// Data is the data to be saved as a file or environment variable.
	Data string
	// Encoding is the initial encoding of Data (as it is written in the manifest). One of {'string', 'base64', 'hex'}.
	Encoding string
	// NoTemplates specifies if Data contains templates which should be filled with information by the Coordinator.
	NoTemplates bool
}

type Manifest struct {
	// Packages contains the allowed enclaves and their properties.
	Packages map[string]quote.PackageProperties
	// Infrastructures contains the allowed infrastructure providers and their properties.
	Infrastructures map[string]quote.InfrastructureProperties
	// Marbles contains the allowed services with their corresponding enclave and configuration parameters.
	Marbles map[string]Marble
	// Users contains user definitions, including certificates used for authentication and permissions.
	Users map[string]User
	// Secrets holds user-specified secrets, which should be generated and later on stored in a marble (if not shared) or in the core (if shared).
	Secrets map[string]Secret
	// RecoveryKeys holds one or multiple RSA public keys to encrypt multiple secrets, which can be used to decrypt the sealed state again in case the encryption key on disk was corrupted somehow.
	RecoveryKeys map[string]string
	// Roles contains role definitions to manage permissions across the MarbleRun mesh
	Roles map[string]Role
	// TLS contains tags which can be assigned to Marbles to specify which connections should be elevated to TLS
	TLS map[string]TLStag
}

type Marble struct {
	// Package references one of the allowed enclaves in the manifest.
	Package string
	// MaxActivations allows to limit the number of marbles of a kind.
	MaxActivations uint
	// Parameters contains lists for files, environment variables and commandline arguments that should be passed to the application.
	// Placeholder variables are supported for specific assets of the marble's activation process.
	Parameters Parameters
	// TLS holds a list of tags which are specified in the manifest
	TLS []string
}

type Parameters struct {
	Files map[string]File
	Env   map[string]File
	Argv  []string
}

type PrivateKey []byte

type PublicKey []byte

type ReservedSecrets struct {
	RootCA     Secret
	MarbleCert Secret
}

type Role struct {
	// ResourceType is the type of the affected resources.
	ResourceType string
	// ResourceNames is a list of names of type ResourceType.
	ResourceNames []string
	// Actions are the allowed actions for the defined resources.
	Actions []string
}

type Secret struct {
	Type        string
	Size        uint
	Shared      bool
	UserDefined bool
	Cert        Certificate
	ValidFor    uint
	Private     PrivateKey
	Public      PublicKey
}

type SecretsWrapper struct {
	MarbleRun ReservedSecrets
	Secrets   map[string]Secret
}

type TLSTagEntry struct {
	Port              string
	Addr              string
	Cert              string
	DisableClientAuth bool
}

type TLStag struct {
	// Outgoing holds a list of all outgoing addresses that should be elevated to TLS.
	Outgoing []TLSTagEntry
	// Incoming holds a list of all incoming addresses that should be elevated to TLS.
	Incoming []TLSTagEntry
}

type User struct {
	// Certificate is the TLS certificate used by the user for authentication.
	Certificate string
	// Roles is a list of roles granting permissions to the user.
	Roles []string
}

type UserSecret struct {
	Cert    Certificate
	Private PrivateKey
	Key     []byte
}