Documentation
¶
Overview ¶
Package secrets provides an encrypted secret store — AES-256-GCM over ~/.ladyM.
Security boundary: this store prevents plaintext-at-rest — cat-ing secrets.enc will not reveal key values. It does NOT protect against full ~/.ladyM exfiltration (the master key and ciphertext live in the same directory). This is the explicit trade-off for cross-platform, non-interactive operation.
Index ¶
- func DeriveAESKey(userKey string) []byte
- func Dir() string
- type Store
- func (s *Store) Get(name string) (string, error)
- func (s *Store) HasMasterKey() bool
- func (s *Store) ListNames() ([]string, error)
- func (s *Store) MasterKeyPath() string
- func (s *Store) Remove(name string) (bool, error)
- func (s *Store) ResetMasterKey(newKey string) error
- func (s *Store) Set(name, value string) error
- func (s *Store) SetMasterKey(key string) ([]byte, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DeriveAESKey ¶
DeriveAESKey derives a 32-byte AES key from a user-supplied string via HKDF-SHA256 (salt=None, info="ladym-master-key"), matching the Python cryptography backend. The user's raw passphrase is never persisted.
Types ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is the encrypted secret store.
func (*Store) HasMasterKey ¶
HasMasterKey reports whether master.key exists.
func (*Store) MasterKeyPath ¶
MasterKeyPath returns the path to master.key (for display/diagnostics only).
func (*Store) ResetMasterKey ¶
ResetMasterKey re-encrypts every secret under a new master key.
Source Files