time

Summary: Follow the JSONStats/fbstats pattern for the NTS cookie keystore: the open-source ntske package keeps the Keystore interface and the dumb InMemoryKeystore, while the Meta-specific fleet keystore lives internally. Single landing unit: it adds the internal keystore, removes the open-source derived plumbing, and rewires both mains, so the derived cookie-key logic is never duplicated across the open-source/internal boundary. New fbcode/ntp/ntske/keystore (package keystore): DerivedKeystore (HKDF-derived cookie keys from one Keychain-materialized master), master-key load that hex-decodes the Keychain value (whitespace stripped) and fails closed on a read error, bad hex, or an empty/under-length decoded key, plus MasterKeyFingerprint, Config, and NewKeystore. Implements ntske.Keystore and reuses the open-source cookie envelope. Placed under ntp/ntske/ to follow the per-binary subpackage convention. Open-source ntske: export the cookie envelope (SealEnvelope, OpenEnvelope) and MasterKeyLen -- now shared by InMemoryKeystore and the internal DerivedKeystore -- and delete derived_keystore.go and master_key.go together with their tests (derived_keystore_test.go, master_key_test.go). Verified no remaining OSS caller: cmd/ntskeserver already builds on InMemoryKeystore and cmd/ntsketest uses no keystore, so no cmd change is needed. Wire both internal mains (ntp/ntske, ntp/responder) to keystore.NewKeystore. Differential Revision: D115218895

Summary: The NTS cookie master key is stored in Keychain hex-encoded (secrets_tool get_from_group NTS_COOKIE_MASTER_KEY TIME), so the Tupperware-materialized file holds 128 hex chars, not the 64 raw octets the keystore needs. Decode it in LoadMasterKeyFromFile: trim surrounding whitespace (e.g. a trailing newline), hex-decode to raw bytes, then length-validate. Malformed hex or an under-length decoded key fails closed so a bad key never starts the server. KE and NTP decode identically, so they still agree on the raw key. Reviewed By: leoleovich Differential Revision: D115199117

Summary: Adds two dev/test binaries under to exercise the NTS-KE server end-to-end. is a smoke-test client: it dials the KE server over TLS 1.3 with ALPN , sends a NextProtocol=NTPv4 + AEAD + request, parses the response, and prints . Flags: , (trust a self-signed dev cert), (stop after the KE handshake, since the NTPv4 phase is not implemented yet), and . It mirrors the server's unexported record reader because the package exposes no reader-based helper, and re-uses the exported / and record constructors. is a thin standalone server: it loads a cert/key with , builds an , and runs until SIGINT/SIGTERM. It is the counterpart the client and connect to for local interop testing. Reviewed By: leoleovich Differential Revision: D111491705