burstsecurity

Independent component of Burst Kit. See the workspace plans for V1 architecture.

Module path burstkit.dev/burstsecurity is provisional until repository ownership is selected. Run go test ./... from this directory.

PeerProfile.Validate checks certificates against explicit roots and expected identity. Apply fresh membership/revocation separately. FileIdentity reloads managed PEM credentials at each new handshake, checks key permissions, verifies chain/identity/usage/lifetime and rejects NotBefore rollback. Both storage nodes and managed control clients use it. Publish matching key/certificate files atomically; invalid updates fail closed.

ParseNodeCSR and DevelopmentCA support explicit local issuance. CSR signatures/keys are validated; the approved network/node binding chooses the sole URI SAN. The composing app persists consumption, certificate bytes and membership atomically and provides renewal and managed-certificate attestation/refresh. The library does not operate an issuer or SPIRE agent. Root-bundle changes still require restart, and managed certificate refresh still requires the control-plane attestation operation.