Documentation
¶
Overview ¶
Package encryption provides encryption and decryption actions for the operation graph.
Index ¶
- Constants
- type Provider
- func (p *Provider) CompensateDecryptSopsFile(activationRecord *op.ActivationRecord, receipt *Receipt) error
- func (p *Provider) CompensateEncryptFile(activationRecord *op.ActivationRecord, receipt *Receipt) error
- func (p *Provider) DecryptSopsFile(activationRecord *op.ActivationRecord, source *file.Regular, ...) (*file.Regular, *Receipt, error)
- func (p *Provider) EncryptFile(activationRecord *op.ActivationRecord, source *file.Regular, ...) (*file.Regular, *Receipt, error)
- type Receipt
Constants ¶
const ( DecryptSopsFile op.ActionName = "encryption.decrypt_sops_file" EncryptFile op.ActionName = "encryption.encrypt_file" )
Action-name constants for the encryption provider's plan-mode actions.
Each constant is the short dotted action label its method dispatches under. Pass these to plan.Plan, op.ReceiverRegistry().BuildAction, RuntimeEnvironment.ActionByName, or WithActionNamed in place of a string literal so a typo is a compile error and rename / find-references work through the constant.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Provider ¶
type Provider struct {
op.ProviderBase
// contains filtered or unexported fields
}
Provider provides encryption and decryption actions.
+devlore:access=planned
func NewProvider ¶
func NewProvider(runtimeEnvironment *op.RuntimeEnvironment) *Provider
NewProvider creates an encryption provider bound to the given runtime environment.
func (*Provider) CompensateDecryptSopsFile ¶
func (p *Provider) CompensateDecryptSopsFile(activationRecord *op.ActivationRecord, receipt *Receipt) error
CompensateDecryptSopsFile removes the decrypted file created by DecryptSopsFile.
Parameters:
- `activationRecord`: the dispatch activation (the required floor for compensating actions — step 27).
- `receipt`: the Receipt from Provider.DecryptSopsFile; nil or nil-resource receipts return nil.
Returns:
- `error`: non-nil when the decrypted file cannot be removed or the receipt's resource is not a file.Regular.
func (*Provider) CompensateEncryptFile ¶
func (p *Provider) CompensateEncryptFile(activationRecord *op.ActivationRecord, receipt *Receipt) error
CompensateEncryptFile removes the encrypted file created by EncryptFile.
Parameters:
- `activationRecord`: the dispatch activation (the required floor for compensating actions — step 27).
- `receipt`: the Receipt from Provider.EncryptFile; nil or nil-resource receipts return nil.
Returns:
- `error`: non-nil when the encrypted file cannot be removed or the receipt's resource is not a file.Regular.
func (*Provider) DecryptSopsFile ¶
func (p *Provider) DecryptSopsFile(activationRecord *op.ActivationRecord, source *file.Regular, destinationPath string, mode os.FileMode) (*file.Regular, *Receipt, error)
DecryptSopsFile reads an encrypted SOPS file and writes the decrypted content to destinationPath.
Identity for the destination is constructed by file.DiscoverRegular.
`mode` is floored: the decrypted product is plaintext whose sensitivity was already declared by the act of encrypting it, so a mode carrying group or other bits is refused rather than honored. 0o600 and 0o400 are the useful values; the default is 0o600.
Parameters:
- `activationRecord`: the dispatch activation (the required floor for compensable actions — step 27).
- `source`: file.Regular identifying the encrypted SOPS file.
- `destinationPath`: the path where the decrypted content will be written.
- `mode`: the os.FileMode applied to the decrypted file; refused if it grants group or other access.
Returns:
- `*file.Regular`: the destination resource with populated metadata.
- `*Receipt`: compensation state for removing the decrypted file.
- `error`: any error from the mode floor, reading, decrypting, or writing.
+devlore:defaults mode=0o600
func (*Provider) EncryptFile ¶
func (p *Provider) EncryptFile(activationRecord *op.ActivationRecord, source *file.Regular, destinationPath string, mode os.FileMode) (*file.Regular, *Receipt, error)
EncryptFile reads source's cleartext and writes the SOPS-encrypted content to destinationPath.
Recipients and document format come from the `.sops.yaml` governing source's path — discovered by the sops.Encrypter walking up from source to the [RuntimeEnvironment] Root, then the XDG fallback. Identity for the destination is constructed by file.DiscoverRegular.
`mode` is NOT floored here: the product is ciphertext, which is safe at rest by construction and is typically committed to a repository that will store it 0o644 regardless. The default stays 0o600 so behavior is unchanged unless a caller asks otherwise.
Parameters:
- `activationRecord`: the dispatch activation (the required floor for compensable actions — step 27).
- `source`: file.Regular identifying the cleartext file to encrypt.
- `destinationPath`: the path where the encrypted content will be written.
- `mode`: the os.FileMode applied to the encrypted file.
Returns:
- `*file.Regular`: the destination resource with populated metadata.
- `*Receipt`: compensation state for removing the encrypted file.
- `error`: any error from reading, encrypting, or writing.
+devlore:defaults mode=0o600
type Receipt ¶
type Receipt struct {
op.ReceiptBase
}
Receipt holds encryption-specific compensation state for a Provider.DecryptSopsFile call.
The embedded op.ReceiptBase carries the affected file.Resource (the decrypted destination file) and the opaque op.ReceiptBase.TransactionID minted at op.ReceiptBase.Commit time. The destination path is read through the resource's file.Resource.SourcePath during compensation; no per-receipt path field is needed.
Receipt has no provider-specific fields, so it inherits op.ReceiptBase.MarshalJSON and op.ReceiptBase.MarshalYAML unchanged. Only Receipt.RestoreEncoded is overridden, since rehydration requires the concrete file.Resource type that op.ReceiptBase cannot construct generically.
func (*Receipt) RestoreEncoded ¶
func (r *Receipt) RestoreEncoded( runtimeEnvironment *op.RuntimeEnvironment, base op.ReceiptData, _ map[string]any, ) error
RestoreEncoded reconstructs the receipt from its codec-decoded envelope, resolving its file.Resource against the rehydrated catalog.
It is the op.Receipt.RestoreEncoded override the recovery stack drives at re-arm (via [op.reconstructReceipt]) — the env is threaded in explicitly as a parameter, not read off the receiver, so the stack path (which loads a bare receipt before the catalog is rehydrated) can reconstruct it. The destination file.Resource is resolved from `base.ResourceURI` via the catalog namespace; the base is re-seated via op.NewReceiptBase so op.ReceiptBase.Restore's URI-match check has a live resource, then Restore writes the full base. Receipt has no provider-specific fields, so `fields` is unused.
Parameters:
- `runtimeEnvironment`: the resume environment; its catalog must hold (or be able to construct) the resource.
- `base`: the codec-decoded base execution state.
- `_`: the receipt's id-reference sub-field, unused (no provider-specific fields).
Returns:
- `error`: non-nil only when the runtime environment or its catalog is missing; resolution and restore failures are verified-side defects and assert.
Source Files
Directories