Lexicon Garden

dev.knotless.runnerKey

Kept in the runner's account. An owner seals each secret it gives the runner to this key, with HPKE (RFC 9180) in base mode: DHKEM(P-256, HKDF-SHA256), HKDF-SHA256 and AES-128-GCM, so only the runner, which keeps the private half, can open it. The runner writes it again when its key changes; a value sealed to an older key names that key.

Repository @lexicons.knotless.dev did:plc:yqsg7znbbhfmj3a2nrpnaerk namespace authority
Details · record, key literal:self
Kindrecord
Record keyliteral:self
Authorityknotless.dev
Indexed
Compare Edit in builder → Fork →
cid bafyreieyofxr2artw7lmq7pl62xdwv4gwv4r3w27htdlmjgqidrrn5vram

Checks

Valid Lint pass
JSONDownload
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Kept in the runner's account. An owner seals each secret it gives the runner to this key, with HPKE (RFC 9180) in base mode: DHKEM(P-256, HKDF-SHA256), HKDF-SHA256 and AES-128-GCM, so only the runner, which keeps the private half, can open it. The runner writes it again when its key changes; a value sealed to an older key names that key.",
      "key": "literal:self",
      "record": {
        "properties": {
          "createdAt": {
            "description": "When the runner published this key.",
            "format": "datetime",
            "type": "string"
          },
          "key": {
            "description": "The public key, as a P-256 did:key.",
            "format": "did",
            "type": "string"
          }
        },
        "required": [
          "key",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "description": "The key a knotless runner opens the secrets owners give it with.",
  "id": "dev.knotless.runnerKey",
  "lexicon": 1
}