Crate hoike

Structs§

URGENT_POLL_SECS 🔒: Off-cycle urgent-revocation poll cadence (seconds). When any CA enables urgent_revocation, the loop wakes at min(batch_interval, URGENT_POLL_SECS) and, on the wakes between full passes, checks for newly-revoked serials so a fresh revocation does not wait a whole batch interval to propagate.

build_preferred_sig_algs_extension 🔒: Build the DER-encoded PreferredSignatureAlgorithms extension value.
check_trusted_channels 🔒: Validate transport-security posture for the management and inter-component channels (NIAP PPCA FTP_TRP.1 / FTP_ITC.1). Warnings are advisory; a cleartext forward_to without the explicit forward_insecure escape hatch is a hard failure (exit 1), matching how other hoike check gates behave.
decode_b64_field 🔒
load_live_signer 🔒
main 🔒
prepare_signer_material 🔒: Renewal runs before startup and every generation; an invalid replacement must never reach bundle publication. Valid external renewals need no command.
run_check 🔒
run_import 🔒
run_query 🔒
run_server 🔒
run_sign 🔒
run_signer_loop 🔒
serve_listener 🔒: Serve an axum router on addr, using TLS when tls is Some and the binary was built with --features tls. Falls back to plaintext otherwise (warning if TLS was requested but unavailable). Used for the metrics and admin management listeners; the OCSP data plane is always plaintext.
urgent_revocation_pass 🔒: One off-cycle urgent-revocation pass: for each opted-in CA, snapshot the source, diff against the last-known revoked set, and — if new revocations appeared — produce and reload an off-cycle bundle for just that scope, then announce it (generation + explicit urgent notice) over gossip.