mirror of
https://github.com/luxfi/keys.git
synced 2026-09-24 00:26:10 +00:00
zeekay
fe463af181
Fetching a secret should not know about who is asking — that's a transport-layer concern. Trust at the network boundary (NetworkPolicy + ZAP wire), not in the application envelope. API change (breaking): LoadMnemonic(ctx, addr, env, path) string, error LoadMnemonicFromKMS(ctx, addr, env, path) string, error dialKMS(ctx, addr) (MnemonicReader, error) ServiceIdentity type is retained for callers that need signing elsewhere; it's just no longer threaded through the mnemonic-fetch operation. Companion rip: KMS_ZAP_AUTH_ENABLED, ZAP_AUTH_REQUIRED, KMS_IAM_URL, KMS_IAM_CLIENT_ID, KMS_IAM_CLIENT_SECRET, KMS_ZAP_AUDIENCE — see luxfi/kms + luxfi/mpc follow-ups.