Documentation
¶
Overview ¶
Package crypt encrypts and decrypts tracked dotfiles with age.
A repository file with the .crypt suffix holds an ASCII-armored age ciphertext. The recipient is derived from the configured identity, so a single private key is all that has to be set up. The identity file itself may be passphrase-protected (age -p); the passphrase is taken from the environment or asked for on the terminal.
Index ¶
Constants ¶
const ( EnvAgeIdentity = "DMAN_AGE_IDENTITY" EnvAgePassphrase = "DMAN_AGE_PASSPHRASE" )
Environment variables that override the config file.
Variables ¶
var ErrNoKey = errors.New("no encryption key configured")
ErrNoKey is returned when no identity is configured. Callers treat it as "encryption is not set up on this machine" and skip encrypted files.
var ReadPassphrase = func(prompt string) ([]byte, error) { if p, ok := os.LookupEnv(EnvAgePassphrase); ok { return []byte(p), nil } tty, err := os.OpenFile("/dev/tty", os.O_RDWR, 0) if err != nil { return nil, fmt.Errorf("identity file is passphrase-protected; set %s or run interactively", EnvAgePassphrase) } defer func() { _ = tty.Close() }() if _, err := fmt.Fprint(tty, prompt); err != nil { return nil, err } pass, err := term.ReadPassword(tty.Fd()) _, _ = fmt.Fprintln(tty) if err != nil { return nil, fmt.Errorf("read passphrase: %w", err) } return pass, nil }
ReadPassphrase asks for the passphrase of a protected identity file. It prefers EnvAgePassphrase and otherwise reads from the controlling terminal without echo. Tests replace it.
Functions ¶
func IsEncrypted ¶
IsEncrypted reports whether data looks like an age file, armored or not.
Types ¶
type Codec ¶
type Codec struct {
// contains filtered or unexported fields
}
Codec encrypts with the recipient derived from an identity file and decrypts with every identity in it. A nil *Codec is valid and reports ErrNoKey from every method, so callers can carry "no key" without branching.
func New ¶
New resolves the identity path (environment over config) and returns a Codec. It returns ErrNoKey when nothing is configured. A configured but missing identity file is reported as an error, not as ErrNoKey: that is a misconfiguration the user should see. Parsing the identity, and any passphrase prompt, is deferred to first use.
func (*Codec) Encrypt ¶
Encrypt returns the armored ciphertext of plaintext for the codec's recipient. Every call produces different bytes; compare plaintext, never ciphertext.
Source Files