Documentation
¶
Overview ¶
Package secrets reads database secrets from the human (no-echo prompt) or the OS keychain, and scrubs them from error strings. A secret is a []byte that lives only in console memory; callers Wipe it when done.
Index ¶
- Constants
- Variables
- func KeychainDelete(profile, host string) error
- func KeychainGet(profile, host string) ([]byte, error)
- func KeychainSet(profile, host string, s []byte) error
- func PromptPassword(prompt string) ([]byte, error)
- func Sanitize(err error, secrets ...[]byte) string
- func SanitizeString(s string, secrets ...[]byte) string
- func Wipe(b []byte)
Constants ¶
const KeychainService = "locksql"
KeychainService is the service name of every locksql keychain item. The account is "<profile>@<host>".
const Redacted = "***"
Redacted replaces every occurrence of a secret in a sanitised string.
Variables ¶
var ( // ErrNotFound means the keychain has no item for the profile and host. ErrNotFound = errors.New("secrets: no keychain item") // headless Linux without a Secret Service. The console then behaves as // credentials = "ask". ErrUnavailable = errors.New("secrets: OS keychain unavailable") )
var ErrInterrupted = errors.New("secrets: password prompt interrupted")
ErrInterrupted means the human pressed Ctrl-C at the prompt.
var ErrNoTerminal = errors.New("secrets: no terminal to prompt for the password")
ErrNoTerminal means there is no controlling terminal to prompt on.
Functions ¶
func KeychainDelete ¶
KeychainDelete removes the item of profile@host. A missing item gives ErrNotFound.
func KeychainGet ¶
KeychainGet reads the secret of profile@host from the OS keychain.
func KeychainSet ¶
KeychainSet stores s as the secret of profile@host, replacing any previous one.
func PromptPassword ¶
PromptPassword prints prompt on the controlling terminal and reads a line with echo off. Ctrl-C restores the terminal and returns ErrInterrupted.
func Sanitize ¶
Sanitize returns err's message with every secret removed. Besides the raw value it removes the forms a driver might print: URL query, path and userinfo escaping, and Go/JSON string quoting. A nil err gives "".
func SanitizeString ¶
SanitizeString is Sanitize for a plain string.
Types ¶
This section is empty.
Source Files