handle AppError and senda structured JSON response.

write JSON error response with given status code and message.

HandleFunc registers a new route with the given pattern and handler function on the router mux

String implements flag.Value for mirrorFlags

write JSON response with given status code and data.

newTestRegistry starts an in-memory OCI registry and returns the server and its host:port address.

NewMockDeviceIdentity creates a MockDeviceIdentity with default values.

ValidateAndEnforceDefaults validates and normalizes the given config. It applies default values where required, verifies URLs, cron expressions, and h

Name returns the name of the process

NewAESProvider creates a new AESProvider instance.

EncryptConfig encrypts a configuration struct and returns encrypted bytes.

FromContext extracts the main logger from the context.

HashSecret computes an argon2id hash of the secret using a random salt.

NewMockProvider creates a MockProvider with sensible defaults.

pushImage pushes a random image with the given number of layers to the registry at the specified reference. Returns the pushed image.

VerifySecret checks if the given secret matches the stored hash.

GenerateToken creates a new join token.

Returns Harbor v2 client

HashPassword creates an Argon2id hash of the password.

SetPendingCRIResults stores CRI config results to be sent in the first heartbeat.

NewMemoryTokenStore creates a new in-memory token store.

NewSchedulerWithInterval creates a new scheduler with a parsed interval string

ServeHTTP would dispatch the request to the default mux

DecryptConfig decrypts encrypted bytes and unmarshals into the provided struct.

Encode encodes the token to a string suitable for transmission.

Handle registers a new route with the given pattern and handler on the router mux

NewConfigEncryptor creates a new ConfigEncryptor.

ReplaceURLHost replaces the scheme and host:port in raw with those from override.

Replicate replicates images from the source registry to the local registry. Before pulling, it checks which blobs already exist at the destination and

Stop signals the scheduler to stop and waits for all goroutines to complete

Helper function to colorize text

DefaultConfig returns a secure default TLS configuration.

RequireRole creates middleware that checks if user has the required role

VerifyPassword compares a password against an Argon2id hash.

DecodeToken decodes a token string into a JoinToken.

FormatRegistryURL formats the registry URL by trimming the "https://" or "http://" prefix if present

GetArtifacts returns the list of artifacts that needs to be pulled

LoadCertificate loads a certificate and key from files.

ResolveCRIConfigs determines which CRI configs to apply. Priority: explicitMirrors (--mirrors flag) > explicit runtimes > auto-detect.

Start launches Run in a goroutine with proper WaitGroup tracking. wg.Add must happen before the goroutine to avoid a race with Stop.

restoreBackup copies a backup file back to the original path.

Cleanup removes expired tokens and rate limit entries.

IsValidName validates if a name meets the requirements: 1. 1-255 characters long 2. Only lowercase characters, numbers, and ._- are allowed 3. Must st

LoadCAPool loads a CA certificate pool from a file.

You MUST use ResolveGroundControlURL to get the ground control URL.

SaveState writes the current stateMap and configDigest to disk.

Stop gracefully stops the SPIRE server subprocess.

Update robot account

Use adds middleware to the default router

Validate checks if the token is valid.

backupFile creates a timestamped backup of the given file. Returns the backup path, or empty string if the source does not exist.