Documentation
¶
Overview ¶
Package keyring handles secure storage of cryptographic keys and secrets.
Secret reads are routed through keychain-auth — a standalone daemon that verifies process identity before granting access to OS keychain entries. Secret writes, deletes, keypair operations, and allowlist management remain direct (via go-keyring) because they don't require the same security posture as reads.
On Linux/WSL (where D-Bus Secret Service is typically unavailable), keypair storage falls back to file-based storage in ~/.agentsecrets/keyring.json.
Service name: "AgentSecrets" Keypair naming: "{email}_private_key", "{email}_public_key" Secret naming: "{projectID}:{environment}:{key}"
Index ¶
- func DeleteKeypair(email string) error
- func DeleteSecret(projectID, environment, key string) error
- func GetAllProjectSecrets(projectID, environment string) (map[string]string, error)
- func GetPrivateKey(email string) ([]byte, error)
- func GetPublicKey(email string) ([]byte, error)
- func GetSecret(projectID, environment, key string) (string, error)
- func GetWorkspaceAllowlist(workspaceID string) ([]string, error)
- func SetSecret(projectID, environment, key, value string) error
- func SetWorkspaceAllowlist(workspaceID string, domains []string) error
- func StoreKeypair(email string, privateKey, publicKey []byte) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DeleteKeypair ¶
DeleteKeypair removes both keys (used during logout).
func DeleteSecret ¶
DeleteSecret removes a secret from the keyring and its index.
func GetAllProjectSecrets ¶
GetAllProjectSecrets returns all secrets mapped for a specific project and environment from the keyring.
func GetPrivateKey ¶
GetPrivateKey retrieves the user's private key.
func GetPublicKey ¶
GetPublicKey retrieves the user's public key.
func GetSecret ¶
GetSecret retrieves a secret value via the keychain-auth daemon.
All secret reads are routed through the keychain-auth Unix socket. keychain-auth verifies that this process is a registered, unmodified AgentSecrets binary before granting access. It also handles legacy key format fallback internally.
The caller must ensure keychainauth.Init() has been called before invoking this function.
func GetWorkspaceAllowlist ¶ added in v1.1.0
GetWorkspaceAllowlist retrieves the allowlist for a workspace from the OS keychain.
func SetSecret ¶
SetSecret stores a decrypted secret in the keyring and updates the project environment's key index.
func SetWorkspaceAllowlist ¶ added in v1.1.0
SetWorkspaceAllowlist stores the allowlist for a workspace in the OS keychain.
func StoreKeypair ¶
StoreKeypair saves both private and public keys. Uses OS keychain when available, falls back to file on Linux/WSL.
Types ¶
This section is empty.
Source Files