Documentation
¶
Overview ¶
Package secretsauce resolves secret values from either a literal plain-text value or the standard output of an external command.
A Source carries both a literal Value and a Command. Resolution prefers the literal value and otherwise executes the command, capturing its standard output as the secret. Commands are executed directly via argv without a shell, must reference an absolute-path executable, run under a timeout, and have their output size capped.
The package is self-contained and free of any application-specific naming so it can be reused independently.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Source ¶
type Source struct {
// Value is a literal plain-text secret. When non-empty (after trimming
// surrounding whitespace) it is returned as-is.
Value string
// Command is a command line whose standard output provides the secret. It
// is parsed into argv and executed directly, without a shell. The
// executable must be an absolute path.
Command string
}
Source describes how to obtain a single secret value. Value takes precedence over Command when both are set.
func FromEnv ¶
FromEnv builds a Source from environment variables using a conventional naming scheme. The literal value is read from name, and the command from name+"_COMMAND" (falling back to name+"_CMD").
func (Source) Resolve ¶
Resolve returns the secret value for the source. If Value is set it is returned directly; otherwise Command is executed and its standard output is returned. The name is used only to produce descriptive error messages and may be empty. When neither Value nor Command is set, Resolve returns an empty string and a nil error.
Source Files