nx_acme.nx
buildroot/runtime/nx_acme.nx
about
nx_acme.nx -- ACME (RFC 8555) state machine + request builders.
The cert-issuance state machine for the audit-dashboard phase-3
chain. Composes shipped primitives:
nx_jose.nx -- JWS flattened-JSON sign (EdDSA)
nx_jwk.nx -- JWK canonical emit for OKP
nx_ed25519_signature.nx -- account-key signing
nx_https_client.nx -- HTTPS request to the CA
nx_x509.nx + nx_pem.nx -- CSR + cert handling (in cert-
finalize step, queued for v2)
Per cardinal feedback-no-third-party-trust-native-or-nothing:
the substrate's own ACME client. No certbot, no acme.sh, no
Caddy auto-TLS. This is the bits-up replacement.
This file is the STATE MACHINE + REQUEST BUILDER layer. Live HTTPS
I/O against a CA is the next slice (uses nx_https_client.nx).
State machine (RFC 8555 ยง7):
IDLE
-> DIRECTORY_FETCHING -> DIRECTORY_OK
-> NONCE_FETCHING -> NONCE_OK
-> ACCOUNT_REGISTERING -> ACCOUNT_REGISTERED
-> ORDER_CREATING -> ORDER_CREATED
-> AUTHZ_FETCHING -> AUTHZ_PENDING
-> CHALLENGE_RESPONDING -> CHALLENGE_VALIDATING
-> AUTHZ_VALID
-> ORDER_FINALIZING -> ORDER_VALID
-> CERT_DOWNLOADING -> COMPLETE
Failure terminal: ERROR_PERMANENT / ERROR_TRANSIENT
Per cardinal feedback-bounded-loop-discipline-jpl-rule-2: each
poll loop (challenge-validating, order-finalizing, cert-download)
has an explicit budget counter.
nx_capability_claims:
needs: [sealed_enum, jose_sign, https_client, x509]
provides: [acme_state_machine, acme_new_account_request_builder,
dependencies 3 imports · 1 importers
imports: nx_syscalls_x86_64.nxnx_jose.nxnx_jwk.nx
imported by: nx_acme_test.nx
structs
| 156 | struct AcmeOrder |
consts
| 52 | const NXACME_MAGIC_1024: i64 = 1024 |
| 56 | const NXACME_IDLE: i64 = 0 |
| 57 | const NXACME_DIRECTORY_FETCHING: i64 = 1 |
| 58 | const NXACME_DIRECTORY_OK: i64 = 2 |
| 59 | const NXACME_NONCE_FETCHING: i64 = 3 |
| 60 | const NXACME_NONCE_OK: i64 = 4 |
| 61 | const NXACME_ACCOUNT_REGISTERING: i64 = 5 |
| 62 | const NXACME_ACCOUNT_REGISTERED: i64 = 6 |
| 63 | const NXACME_ORDER_CREATING: i64 = 7 |
| 64 | const NXACME_ORDER_CREATED: i64 = 8 |
| 65 | const NXACME_AUTHZ_FETCHING: i64 = 9 |
| 66 | const NXACME_AUTHZ_PENDING: i64 = 10 |
| 67 | const NXACME_CHALLENGE_RESPONDING: i64 = 11 |
| 68 | const NXACME_CHALLENGE_VALIDATING: i64 = 12 |
| 69 | const NXACME_AUTHZ_VALID: i64 = 13 |
| 70 | const NXACME_ORDER_FINALIZING: i64 = 14 |
| 71 | const NXACME_ORDER_VALID: i64 = 15 |
| 72 | const NXACME_CERT_DOWNLOADING: i64 = 16 |
| 73 | const NXACME_COMPLETE: i64 = 17 |
| 74 | const NXACME_ERROR_PERMANENT: i64 = 18 |
| 75 | const NXACME_ERROR_TRANSIENT: i64 = 19 |
| 76 | const NXACME_STATE_N: i64 = 20 |
| 117 | const NXACME_CHALLENGE_HTTP_01: i64 = 0 |
| 118 | const NXACME_CHALLENGE_DNS_01: i64 = 1 |
| 119 | const NXACME_CHALLENGE_TLS_ALPN_01: i64 = 2 |
| 120 | const NXACME_CHALLENGE_N: i64 = 3 |
| 137 | const NXACME_OK: i64 = 0 |
| 138 | const NXACME_OOM_BUFFER: i64 = 1 |
| 139 | const NXACME_BAD_KEY: i64 = 2 |
| 140 | const NXACME_BAD_STATE: i64 = 3 |
| 141 | const NXACME_BAD_ARG: i64 = 4 |
| 142 | const NXACME_VERDICT_N: i64 = 5 |
| 165 | const ACME_ORDER_BYTES: i64 = 48 // 6 i64 fields |
functions
| 78 | func nx_acme_state_is_valid(s: i64) -> i64 |
| 84 | func nx_acme_state_name(s: i64) -> *u8 called by 1: main |
| 109 | func nx_acme_state_is_terminal(s: i64) -> i64 |
| 122 | func nx_acme_challenge_is_valid(c: i64) -> i64 called by 1: main |
| 128 | func nx_acme_challenge_name(c: i64) -> *u8 called by 1: main |
| 144 | func nx_acme_verdict_is_valid(v: i64) -> i64 called by 1: main |
| 167 | func nx_acme_order_init(order: *AcmeOrder, poll_budget: i64) -> i64 |
| 181 | func nx_acme_order_transition(order: *AcmeOrder, next_state: i64) -> i64 |
| 199 | func nx_acme_order_tick(order: *AcmeOrder) -> i64 |
| 222 | func nx_acme_protected_jwk_form( |
| 250 | func nx_acme_protected_kid_form( |
| 282 | func nx_acme_payload_new_account( |
| 314 | func nx_acme_build_new_account_jws( |