daemon: refactoring to enable applications running in-library self-contained daemon logic (a.k.a standalone mode)

acceptance/daemon_vs_standalone/BUILD.bazel

@@ -0,0 +1,24 @@
+load("//acceptance/common:topogen.bzl", "topogen_test")
+
+# Test with standalone daemon (embedded daemon using topology files) - default
+topogen_test(
+    name = "test_standalone",
+    src = "test.py",
+    args = [
+        "--executable=end2end_integration:$(location //tools/end2end_integration)",
+    ],
+    data = ["//tools/end2end_integration"],
+    topo = "//topology:tiny.topo",
+)
+
+# Test with remote daemon (connecting to sciond via gRPC)
+topogen_test(
+    name = "test_daemon",
+    src = "test.py",
+    args = [
+        "--executable=end2end_integration:$(location //tools/end2end_integration)",
+        "--use-daemon",
+    ],
+    data = ["//tools/end2end_integration"],
+    topo = "//topology:tiny.topo",
+)

acceptance/daemon_vs_standalone/test.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+
+# Copyright 2025 SCION Association
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Test that compares daemon vs standalone mode for end2end connectivity.
+
+This test runs the end2end_integration test in two modes:
+- Daemon mode: Uses remote SCION daemon connector (connecting via gRPC)
+- Standalone mode: Uses embedded daemon with topology files (no sciond)
+
+The daemon mode can be selected via --use-daemon flag:
+- With --use-daemon: Uses remote daemon connector (via gRPC)
+- Without --use-daemon (default): Uses standalone daemon connector
+"""
+
+from plumbum import cli
+
+from acceptance.common import base
+
+
+class Test(base.TestTopogen):
+    """
+    Tests end2end connectivity using either daemon or standalone mode.
+    """
+
+    use_daemon = cli.Flag(
+        "--use-daemon",
+        help="Use remote SCION daemon instead of standalone daemon",
+    )
+
+    def setup_start(self):
+        super().setup_start()
+        self.await_connectivity()
+
+    def _run(self):
+        ping_test = self.get_executable("end2end_integration")
+
+        if self.use_daemon:
+            print("=== Running with remote daemon (sciond) ===")
+            ping_test["-d", "-sciond", "-outDir", self.artifacts].run_fg()
+        else:
+            print("=== Running with standalone daemon ===")
+            ping_test["-d", "-outDir", self.artifacts].run_fg()
+
+
+if __name__ == "__main__":
+    base.main(Test)

daemon/BUILD.bazel

@@ -7,21 +7,18 @@ go_library(
     importpath = "github.com/scionproto/scion/daemon",
     visibility = ["//visibility:public"],
     deps = [
-        "//daemon/drkey:go_default_library",
-        "//daemon/fetcher:go_default_library",
-        "//daemon/internal/servers:go_default_library",
+        "//daemon/grpc:go_default_library",
         "//pkg/addr:go_default_library",
         "//pkg/daemon:go_default_library",
-        "//pkg/grpc:go_default_library",
-        "//pkg/log:go_default_library",
+        "//pkg/daemon/asinfo:go_default_library",
+        "//pkg/daemon/fetcher:go_default_library",
+        "//pkg/daemon/private/engine:go_default_library",
         "//pkg/metrics:go_default_library",
         "//pkg/private/prom:go_default_library",
-        "//pkg/private/serrors:go_default_library",
+        "//private/drkey:go_default_library",
         "//private/env:go_default_library",
         "//private/revcache:go_default_library",
         "//private/trust:go_default_library",
-        "//private/trust/grpc:go_default_library",
-        "//private/trust/metrics:go_default_library",
         "@com_github_opentracing_opentracing_go//:go_default_library",
         "@com_github_prometheus_client_golang//prometheus:go_default_library",
     ],

daemon/cmd/daemon/BUILD.bazel

@@ -15,24 +15,22 @@ go_library(
     deps = [
         "//daemon:go_default_library",
         "//daemon/config:go_default_library",
-        "//daemon/drkey:go_default_library",
-        "//daemon/drkey/grpc:go_default_library",
-        "//daemon/fetcher:go_default_library",
         "//daemon/mgmtapi:go_default_library",
         "//pkg/addr:go_default_library",
+        "//pkg/daemon/fetcher:go_default_library",
+        "//pkg/daemon/private/trust:go_default_library",
         "//pkg/experimental/hiddenpath:go_default_library",
         "//pkg/experimental/hiddenpath/grpc:go_default_library",
         "//pkg/grpc:go_default_library",
         "//pkg/log:go_default_library",
         "//pkg/metrics:go_default_library",
         "//pkg/private/prom:go_default_library",
         "//pkg/private/serrors:go_default_library",
-        "//pkg/proto/crypto:go_default_library",
         "//pkg/proto/daemon:go_default_library",
-        "//pkg/scrypto/cppki:go_default_library",
-        "//pkg/scrypto/signed:go_default_library",
         "//private/app:go_default_library",
         "//private/app/launcher:go_default_library",
+        "//private/drkey:go_default_library",
+        "//private/drkey/grpc:go_default_library",
         "//private/mgmtapi/cppki/api:go_default_library",
         "//private/mgmtapi/segments/api:go_default_library",
         "//private/pathdb:go_default_library",

daemon/cmd/daemon/main.go

@@ -35,32 +35,30 @@ import (
 
 	"github.com/scionproto/scion/daemon"
 	"github.com/scionproto/scion/daemon/config"
-	sd_drkey "github.com/scionproto/scion/daemon/drkey"
-	sd_grpc "github.com/scionproto/scion/daemon/drkey/grpc"
-	"github.com/scionproto/scion/daemon/fetcher"
 	api "github.com/scionproto/scion/daemon/mgmtapi"
 	"github.com/scionproto/scion/pkg/addr"
+	"github.com/scionproto/scion/pkg/daemon/fetcher"
+	daemontrust "github.com/scionproto/scion/pkg/daemon/private/trust"
 	"github.com/scionproto/scion/pkg/experimental/hiddenpath"
 	hpgrpc "github.com/scionproto/scion/pkg/experimental/hiddenpath/grpc"
 	libgrpc "github.com/scionproto/scion/pkg/grpc"
 	"github.com/scionproto/scion/pkg/log"
 	"github.com/scionproto/scion/pkg/metrics"
 	"github.com/scionproto/scion/pkg/private/prom"
 	"github.com/scionproto/scion/pkg/private/serrors"
-	cryptopb "github.com/scionproto/scion/pkg/proto/crypto"
 	sdpb "github.com/scionproto/scion/pkg/proto/daemon"
-	"github.com/scionproto/scion/pkg/scrypto/cppki"
-	"github.com/scionproto/scion/pkg/scrypto/signed"
 	"github.com/scionproto/scion/private/app"
 	"github.com/scionproto/scion/private/app/launcher"
+	sddrkey "github.com/scionproto/scion/private/drkey"
+	sdgrpc "github.com/scionproto/scion/private/drkey/grpc"
 	cppkiapi "github.com/scionproto/scion/private/mgmtapi/cppki/api"
 	segapi "github.com/scionproto/scion/private/mgmtapi/segments/api"
 	"github.com/scionproto/scion/private/pathdb"
 	"github.com/scionproto/scion/private/periodic"
 	"github.com/scionproto/scion/private/revcache"
 	"github.com/scionproto/scion/private/segment/segfetcher"
 	segfetchergrpc "github.com/scionproto/scion/private/segment/segfetcher/grpc"
-	infra "github.com/scionproto/scion/private/segment/verifier"
+	segverifier "github.com/scionproto/scion/private/segment/verifier"
 	"github.com/scionproto/scion/private/service"
 	"github.com/scionproto/scion/private/storage"
 	"github.com/scionproto/scion/private/storage/drkey/level2"
@@ -155,8 +153,9 @@ func realMain(ctx context.Context) error {
 			[]string{"driver", "operation", prom.LabelResult},
 		),
 	})
-	engine, err := daemon.TrustEngine(
-		errCtx, globalCfg.General.ConfigDir, topo.IA(), trustDB, dialer,
+	certsDir := filepath.Join(globalCfg.General.ConfigDir, "certs")
+	engine, err := daemontrust.NewEngine(
+		errCtx, certsDir, topo.IA(), trustDB, dialer,
 	)
 	if err != nil {
 		return serrors.Wrap("creating trust engine", err)
@@ -168,7 +167,7 @@ func realMain(ctx context.Context) error {
 		MaxCacheExpiration: globalCfg.TrustEngine.Cache.Expiration.Duration,
 	}
 	trcLoader := trust.TRCLoader{
-		Dir: filepath.Join(globalCfg.General.ConfigDir, "certs"),
+		Dir: certsDir,
 		DB:  trustDB,
 	}
 	//nolint:staticcheck // SA1019: fix later (https://github.com/scionproto/scion/issues/4776).
@@ -186,7 +185,7 @@ func realMain(ctx context.Context) error {
 	}, 10*time.Second, 10*time.Second)
 	defer trcLoaderTask.Stop()
 
-	var drkeyClientEngine *sd_drkey.ClientEngine
+	var drkeyClientEngine *sddrkey.ClientEngine
 	if globalCfg.DRKeyLevel2DB.Connection != "" {
 		backend, err := storage.NewDRKeyLevel2Storage(globalCfg.DRKeyLevel2DB)
 		if err != nil {
@@ -215,10 +214,10 @@ func realMain(ctx context.Context) error {
 		}
 		defer level2DB.Close()
 
-		drkeyFetcher := &sd_grpc.Fetcher{
+		drkeyFetcher := &sdgrpc.Fetcher{
 			Dialer: dialer,
 		}
-		drkeyClientEngine = &sd_drkey.ClientEngine{
+		drkeyClientEngine = &sddrkey.ClientEngine{
 			IA:      topo.IA(),
 			DB:      level2DB,
 			Fetcher: drkeyFetcher,
@@ -254,9 +253,9 @@ func realMain(ctx context.Context) error {
 		}
 	}
 
-	createVerifier := func() infra.Verifier {
+	createVerifier := func() segverifier.Verifier {
 		if globalCfg.SD.DisableSegVerification {
-			return acceptAllVerifier{}
+			return segverifier.AcceptAllVerifier{}
 		}
 		return compat.Verifier{Verifier: trust.Verifier{
 			Engine:             engine,
@@ -272,21 +271,21 @@ func realMain(ctx context.Context) error {
 	)
 	sdpb.RegisterDaemonServiceServer(server, daemon.NewServer(
 		daemon.ServerConfig{
-			IA:       topo.IA(),
-			MTU:      topo.MTU(),
-			Topology: topo,
+			IA:          topo.IA(),
+			MTU:         topo.MTU(),
+			LocalASInfo: topo,
 			Fetcher: fetcher.NewFetcher(
 				fetcher.FetcherConfig{
-					IA:         topo.IA(),
-					MTU:        topo.MTU(),
-					Core:       topo.Core(),
-					NextHopper: topo,
-					RPC:        requester,
-					PathDB:     pathDB,
-					Inspector:  engine,
-					Verifier:   createVerifier(),
-					RevCache:   revCache,
-					Cfg:        globalCfg.SD,
+					IA:            topo.IA(),
+					MTU:           topo.MTU(),
+					Core:          topo.Core(),
+					NextHopper:    topo,
+					RPC:           requester,
+					PathDB:        pathDB,
+					Inspector:     engine,
+					Verifier:      createVerifier(),
+					RevCache:      revCache,
+					QueryInterval: globalCfg.SD.QueryInterval.Duration,
 				},
 			),
 			Engine:      engine,
@@ -367,26 +366,6 @@ func realMain(ctx context.Context) error {
 	return g.Wait()
 }
 
-type acceptAllVerifier struct{}
-
-func (acceptAllVerifier) Verify(ctx context.Context, signedMsg *cryptopb.SignedMessage,
-	associatedData ...[]byte,
-) (*signed.Message, error) {
-	return nil, nil
-}
-
-func (v acceptAllVerifier) WithServer(net.Addr) infra.Verifier {
-	return v
-}
-
-func (v acceptAllVerifier) WithIA(addr.IA) infra.Verifier {
-	return v
-}
-
-func (v acceptAllVerifier) WithValidity(cppki.Validity) infra.Verifier {
-	return v
-}
-
 func loaderMetrics() topology.LoaderMetrics {
 	updates := prom.NewCounterVec("", "",
 		"topology_updates_total",