Interface IPinUpdateSidecar
Scaffold interface for out-of-band TLS pin updates.
This is a forward-planning scaffold only. No production implementation is currently wired into the client. The NullPinUpdateSidecar default is always returned, meaning the static pin set from ClientSecurityBootstrap is never overridden at runtime.
Hard-coded compile-time pins (see ClientSecurityBootstrap) require shipping a new client build to rotate keys. That is unacceptable when a CA-incident or HSM rotation forces an emergency pin swap on a faster cadence than the client release pipeline.
The intended production implementation:
- Fetches a signed manifest (Ed25519 / RSA-PSS) from a well-known URL,
- Verifies the signature against a compile-time embedded public key (a separate trust anchor from the TLS PKI it is updating!),
- Returns the new pin set with an effective-from / expires-at window so the bootstrap can reject stale manifests.
The bootstrap MUST treat sidecar failures as advisory only and never downgrade pinning below what was statically configured. A compromised sidecar host must not be able to remove pins — only narrow them.
public interface IPinUpdateSidecarMethods
TryFetchUpdateAsync(CancellationToken)
Attempts to retrieve an updated pin manifest. Implementations must
validate signature + freshness before returning. Returning null
means "no update available" and is not an error.
Task<PinUpdateManifest> TryFetchUpdateAsync(CancellationToken cancellationToken)Parameters
cancellationTokenCancellationToken