Documentation
¶
Overview ¶
Package envimport is the env import-and-own pipeline (plan §7.9). A user-provided .env is an IMPORT SOURCE only — its values are copied into the encrypted store and the uploaded file is never the live file (Mooring renders a fresh 0600 --env-file from the store at every deploy). Every stage treats the input as hostile: parse (a dotenv reader, not a shell) → hygiene (key charset, NUL reject) → classify (biased to secret) → the §7.4 literal-secret HARD STOP → ingest by reference. Values are wrapped in secret.Redacted from parse-time so they never leak.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ValidateForIngest ¶
ValidateForIngest is the §7.4 literal-secret HARD STOP — override-proof. Before any entry is written, every PLAIN entry is re-linted; a secret-shaped value classified (or forced by an operator) as plain is rejected, so a mislabeled secret can never round-trip into a committable plain literal / canonical.yaml.
Types ¶
type Current ¶
Current is the backend's view of one already-stored entry (the caller resolves the value from the encrypted store; it never leaves the backend).
type DiffResult ¶
type DiffResult struct {
Added []string // new keys
Changed []string // existing PLAIN keys whose value changed
Unchanged []string // identical keys
Rotations []string // a secret whose value changed, OR a secret→plain downgrade — needs a per-secret confirm
}
DiffResult buckets an import against the current store, by key name only.
func Diff ¶
func Diff(current map[string]Current, imported []Entry) DiffResult
Diff compares imported entries against the current store. Value comparison happens here (backend-side); only key names are returned.
func (DiffResult) NeedsRotationConfirm ¶
func (d DiffResult) NeedsRotationConfirm() bool
NeedsRotationConfirm reports whether the import touches any live secret in a way that requires the separate per-secret confirmation.
type Entry ¶
type Entry struct {
Key string
Value secret.Redacted
Secret bool // classified secret-shaped (→ the encrypted store, by reference)
}
Entry is one classified, hygiene-checked env var. Value is Redacted from parse.
Source Files