Retracted: Retract versions that were accidentally published ahead of the v0.2.x series. These versions required Go 1.26 and broke linearity.

credstore

package

v0.4.1 Latest Latest Go to latest Published: May 1, 2026 License: MIT Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/aynaash/nextdeploy

Links

Open Source Insights

Documentation ¶

Overview ¶

Package credstore stores cloud-provider credentials at rest, encrypted with a per-machine master key.

Design follows the same headless-friendly pattern as shared/secrets: Linux/macOS uses a 0600 file in $HOME (works over SSH, in CI, in containers with no graphical session); Windows uses the Credential Manager via go-keyring.

Storage layout (Linux/macOS):

~/.nextdeploy/credstore/master.key      # 32-byte random AES-256 key, mode 0600
~/.nextdeploy/credstore/<provider>.enc  # AES-GCM(payload), mode 0600

Each provider entry is a JSON map of credential field → value, encrypted as a single blob. Adding/removing fields is a re-encrypt of the whole entry.

All values returned by Load are auto-registered with the sensitive package so log redaction kicks in without callers having to remember.

Index ¶

Variables
func Delete(provider string) error
func List() ([]string, error)
func Load(provider string) (map[string]string, error)
func Save(provider string, fields map[string]string) error

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrNotFound = errors.New("credstore: entry not found")

ErrNotFound signals that no entry exists for the requested provider.

Functions ¶

func Delete ¶

func Delete(provider string) error

Delete removes the entry for provider. Returns nil if the entry did not exist.

func List ¶

func List() ([]string, error)

List returns the provider names that have stored entries.

func Load ¶

func Load(provider string) (map[string]string, error)

Load returns the decrypted credentials for provider, or ErrNotFound. Every field value is registered with the sensitive scrubber before return.

func Save ¶

func Save(provider string, fields map[string]string) error

Save encrypts and writes the credentials for provider, replacing any existing entry. Field values are auto-registered with the sensitive scrubber.

Types ¶

This section is empty.

Source Files ¶

View all Source files

credstore.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL