backupseal

package

v0.62.2 Latest Latest Go to latest Published: Nov 6, 2026 License: AGPL-3.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/arnakoff/api

Links

Open Source Insights

Documentation ¶

Overview ¶

Package backupseal encrypts the backups of the key store with age (filippo.io/age), for the public key of the owner (#75): the process that seals a backup cannot open it. It also opens a dump sealed for a key drawn for one restore in production (#297).

Index ¶

Variables
type Opener
- func NewOpener(identity string) (*Opener, error)
- func (o *Opener) OpenDump(sealed []byte) ([]byte, error)
type Sealer
- func New(recipient string) (*Sealer, error)
- func (s *Sealer) Seal(w io.Writer) (io.WriteCloser, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrIdentity = errors.New("restore identity must be one age private key")

ErrIdentity means the identity is not one native age private key.

View Source

var ErrRecipient = errors.New("backup recipient must be one age public key")

ErrRecipient means the recipient is not one native age public key.

Functions ¶

This section is empty.

Types ¶

type Opener ¶ added in v0.58.0

type Opener struct {
	// contains filtered or unexported fields
}

Opener decrypts a dump sealed for one identity: in production, a key drawn for one restore, never the owner's (#297). It implements app.KeyDumpOpener.

func NewOpener ¶ added in v0.58.0

func NewOpener(identity string) (*Opener, error)

NewOpener returns an Opener for identity, one native age private key, such as the "AGE-SECRET-KEY-PQ-1…" printed by age-keygen -pq, or ErrIdentity. The error never quotes identity.

func (*Opener) OpenDump ¶ added in v0.58.0

func (o *Opener) OpenDump(sealed []byte) ([]byte, error)

OpenDump decrypts sealed whole: age authenticates every chunk and the end of the file, so a dump altered or cut short fails here.

type Sealer ¶

type Sealer struct {
	// contains filtered or unexported fields
}

Sealer encrypts backups for one recipient. It implements app.BackupSealer.

func New ¶

func New(recipient string) (*Sealer, error)

New returns a Sealer for recipient, one native age public key, such as the "age1pq1…" printed by age-keygen -pq, or ErrRecipient.

func (*Sealer) Seal ¶

func (s *Sealer) Seal(w io.Writer) (io.WriteCloser, error)

Seal returns a WriteCloser encrypting what is written to it into w; Close writes the last chunk.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL