Help us shape the future of Go! Take the 2026 Go Developer Survey

keyring

package
v1.233.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 21, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Documentation

Overview

Package keyring provides a credential-agnostic key->string-value secret store backed by the OS keychain (zalando go-keyring), an encrypted file (99designs/keyring), or in-memory/noop backends. It carries no realm, credential-envelope, or expiry semantics — callers layer those on top. It is shared by the auth credential store (pkg/auth/credentials) and the keychain secrets store (pkg/store). See docs/prd/secrets-management.md.

Package keyring is a generated GoMock package.

Index

Constants

View Source
const (
	TypeSystem = "system"
	TypeFile   = "file"
	TypeMemory = "memory"
	TypeNoop   = "noop"
)

Backend type identifiers returned by Keyring.Type().

Variables

View Source
var (
	// ErrNotFound indicates the requested key does not exist in the backend.
	ErrNotFound = errors.New("keyring: key not found")
	// ErrListNotSupported indicates the backend cannot enumerate keys (e.g. the OS keychain).
	ErrListNotSupported = errors.New("keyring: listing keys is not supported by this backend")
	// ErrUnknownBackend indicates an unrecognized Config.Type.
	ErrUnknownBackend = errors.New("keyring: unknown backend type")
	// ErrUnavailable indicates a backend could not be initialized (e.g. no dbus in a container,
	// or the file directory could not be created).
	ErrUnavailable = errors.New("keyring: backend unavailable")
	// ErrPasswordRequired indicates the file backend needs a password but none was provided.
	ErrPasswordRequired = errors.New("keyring: password required")
	// ErrPasswordTooShort indicates the file backend password is below the minimum length.
	ErrPasswordTooShort = errors.New("keyring: password too short")
)

Functions

This section is empty.

Types

type Config

type Config struct {
	// Type is the backend: TypeSystem (default when empty), TypeFile, TypeMemory, or TypeNoop.
	Type string
	// ServiceName namespaces entries: the zalando account for the system backend and the
	// 99designs ServiceName for the file backend. Defaults to "atmos".
	ServiceName string
	// FileDir is the directory for the file backend. Empty uses the XDG data dir.
	FileDir string
	// PasswordEnv names the environment variable holding the file-backend password. Empty uses
	// ATMOS_KEYRING_PASSWORD.
	PasswordEnv string
}

Config selects and configures a Keyring backend.

type Keyring

type Keyring interface {
	// Get returns the value for key, or ErrNotFound if absent.
	Get(key string) (string, error)
	// Set stores value under key, overwriting any existing value.
	Set(key string, value string) error
	// Delete removes key. It is idempotent: deleting an absent key returns nil.
	Delete(key string) error
	// Has reports whether key exists.
	Has(key string) (bool, error)
	// List returns all stored keys. Backends that cannot enumerate (e.g. the OS keychain)
	// return ErrListNotSupported.
	List() ([]string, error)
	// Type returns the backend identifier (one of TypeSystem/TypeFile/TypeMemory/TypeNoop).
	Type() string
}

Keyring is a generic key->string-value secret store. Implementations persist raw string values; any structure (JSON, envelopes) is the caller's concern.

func New

func New(cfg Config) (Keyring, error)

New constructs the backend named by cfg.Type. It does NOT fall back between backends: callers that want resilience (e.g. system->noop in containers) implement that policy themselves, so a store that needs durable writes can surface a hard error instead of silently using noop.

type MockKeyring

type MockKeyring struct {
	// contains filtered or unexported fields
}

MockKeyring is a mock of Keyring interface.

func NewMockKeyring

func NewMockKeyring(ctrl *gomock.Controller) *MockKeyring

NewMockKeyring creates a new mock instance.

func (*MockKeyring) Delete

func (m *MockKeyring) Delete(key string) error

Delete mocks base method.

func (*MockKeyring) EXPECT

func (m *MockKeyring) EXPECT() *MockKeyringMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockKeyring) Get

func (m *MockKeyring) Get(key string) (string, error)

Get mocks base method.

func (*MockKeyring) Has

func (m *MockKeyring) Has(key string) (bool, error)

Has mocks base method.

func (*MockKeyring) List

func (m *MockKeyring) List() ([]string, error)

List mocks base method.

func (*MockKeyring) Set

func (m *MockKeyring) Set(key, value string) error

Set mocks base method.

func (*MockKeyring) Type

func (m *MockKeyring) Type() string

Type mocks base method.

type MockKeyringMockRecorder

type MockKeyringMockRecorder struct {
	// contains filtered or unexported fields
}

MockKeyringMockRecorder is the mock recorder for MockKeyring.

func (*MockKeyringMockRecorder) Delete

func (mr *MockKeyringMockRecorder) Delete(key any) *gomock.Call

Delete indicates an expected call of Delete.

func (*MockKeyringMockRecorder) Get

func (mr *MockKeyringMockRecorder) Get(key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockKeyringMockRecorder) Has

func (mr *MockKeyringMockRecorder) Has(key any) *gomock.Call

Has indicates an expected call of Has.

func (*MockKeyringMockRecorder) List

func (mr *MockKeyringMockRecorder) List() *gomock.Call

List indicates an expected call of List.

func (*MockKeyringMockRecorder) Set

func (mr *MockKeyringMockRecorder) Set(key, value any) *gomock.Call

Set indicates an expected call of Set.

func (*MockKeyringMockRecorder) Type

func (mr *MockKeyringMockRecorder) Type() *gomock.Call

Type indicates an expected call of Type.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL