envbundle

func Encrypt ¶

func Encrypt(bindings []envfile.Binding, recipients []string) ([]byte, string, error)

func Rewrap ¶

func Rewrap(ciphertext []byte, identity string, recipients []string) ([]byte, string, error)

Rewrap decrypts an age-encrypted blob with the local identity and re-encrypts it to the given recipient set (HUB-04). It is generic: it operates at the age layer and works for any age-encrypted blob (env or draft), because age has no native revocation — re-encryption to the reduced recipient set is the only way to limit a revoked device's future access. Returns the new ciphertext and its content-addressed age_blob:<sha256> ref.