ProfileSealKey

A key that only seals secrets, in a file of its own (llm-openai-compatible §OCP-K5).

Declared in src/libs/libsec/security/ProfileSealKey.hpp.

Detailed description

`NodeSecretSeal` needs key material, and `NodeSealKey` names it. A node's identity key is not always the right material: it loads after the stores that need it, a standalone app has none, and a node can change it while its profile stays. This key is a signing key in a file of its own, made on first use and readable by the user only. It is not an identity.

The file has the form of a key store's file, `KeyStore::makeFrontend`, and open() reads it with `KeyFactory::fromVariantMap`, the call that `KeyStore::setFrontend` makes. Neither activates a store, so open() is safe on an `AsyncStore`'s worker thread, where a wait on another store can need the same threads (§OCP-K3). It keeps no state: each call reads the file, so a caller keeps the key it got.

Member function documentation

open

[static] NodeSealKey ProfileSealKey::open(const QString &keyFile, ProfileSealKey::Make make, QString *error = nullptr)

The seal key in keyFile. With make Make::IfMissing, a missing or damaged file gets a new key, which open() writes before it returns it. A damaged file is replaced with a warning: the seals of its key could not be opened anyway. With Make::Never, or when the file cannot be written, the key is invalid and error says why.