secrets

package
v1.20.0-beta.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 19, 2026 License: MPL-2.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	SOPSFormatter    = "sops"
	SOPSFormatYAML   = "yaml"
	SOPSFormatJSON   = "json"
	SOPSFormatDotenv = "dotenv"
)
View Source 
const EncryptedFileName = "secrets.enc"
View Source 
const EnvBackend = "DEVSY_SECRETS_BACKEND"
View Source 
const EnvPassphrase = "DEVSY_SECRETS_PASSPHRASE" // #nosec G101 -- env var name, not a credential.
View Source 
const IndexFileName = "secrets.yaml"
View Source 
const KeyFileName = "secrets.key"
View Source 
const LocalSourceName = "local"

Variables

View Source 
var ErrSecretNotFound = errors.New("secret not found")

Functions

func CleanProjectSourcePath added in v1.18.0 

func CleanProjectSourcePath(value string) (string, error)

CleanProjectSourcePath validates a repository-controlled source path and returns a normalized repository-relative slash path.

func ModifySourceConfigs added in v1.18.0 

func ModifySourceConfigs(
	devsyConfig *config.Config,
	mutate func(sources []SourceConfig) ([]SourceConfig, error),
) error

ModifySourceConfigs serializes external source modifications across processes by holding the secret-sources lock while loading, mutating, and writing configuration.

func ParseSecretsFile 

func ParseSecretsFile(path string) (map[string]string, error)

func RegisterConfiguredSource added in v1.18.0 

func RegisterConfiguredSource(resolver *Resolver, sourceConfig SourceConfig) error

func ResolveProjectSourcePath added in v1.18.0 

func ResolveProjectSourcePath(root, value string) (string, error)

ResolveProjectSourcePath converts a repository-controlled relative path to a local path while enforcing containment, including after symlink resolution.

func SaveSourceConfigs added in v1.18.0 

func SaveSourceConfigs(devsyConfig *config.Config, sources []SourceConfig) error

SaveSourceConfigs writes external source metadata for the active context.

func ValidateName added in v1.10.0 

func ValidateName(name string) error

func ValidateProjectConfig added in v1.18.0 

func ValidateProjectConfig(cfg *ProjectConfig) error

func ValidateSourceName added in v1.18.0 

func ValidateSourceName(name string) error

Types

type Backend added in v1.10.0 

type Backend string
const (
	BackendAuto    Backend = "auto"
	BackendKeyring Backend = "keyring"
	BackendFile    Backend = "file"
)

type Kind added in v1.10.0 

type Kind string

Kind distinguishes secrets (values in the backend) from env vars (inline). 

const (
	KindSecret Kind = "secret"
	KindEnv    Kind = "env"
)

type LocalSource added in v1.18.0 

type LocalSource struct {
	// contains filtered or unexported fields
}

LocalSource adapts the Devsy Store to the generic source interface.

func NewLocalSource added in v1.18.0 

func NewLocalSource(store Store, contextName string) *LocalSource

func (*LocalSource) Get added in v1.18.0 

func (s *LocalSource) Get(_ context.Context, name string) (ResolvedSecret, error)

type ProjectConfig added in v1.18.0 

type ProjectConfig struct {
	SecretSources []SourceConfig `json:"secretSources,omitempty" yaml:"secretSources,omitempty"`
	Secrets       []string       `json:"secrets,omitempty"       yaml:"secrets,omitempty"`
}

ProjectConfig is the repository-owned subset of Devsy configuration used by secret discovery.

func LoadProjectConfigFromRoot added in v1.18.0 

func LoadProjectConfigFromRoot(root string) (*ProjectConfig, bool, error)

LoadProjectConfigFromRoot loads repository-owned config from a local checkout. A missing configuration is not an error.

func LoadProjectConfigFromRootWithOptions added in v1.18.0 

func LoadProjectConfigFromRootWithOptions(
	root, devContainerPath, devContainerID string,
) (*ProjectConfig, bool, error)

LoadProjectConfigFromRootWithOptions loads repository-owned config from a local checkout, checking the specified devcontainer path, conventional root devcontainer locations, and profile-specific devcontainer directories for customizations.devsy.

func ParseProjectConfig added in v1.18.0 

func ParseProjectConfig(data []byte) (*ProjectConfig, error)

type Redactor added in v1.10.0 

type Redactor struct {
	// contains filtered or unexported fields
}

func Combine 

func Combine(redactors ...*Redactor) *Redactor

Combine returns a redactor that masks the values known by every input. Nil redactors are ignored.

func NewEnvironmentRedactor 

func NewEnvironmentRedactor(env []string) *Redactor

NewEnvironmentRedactor protects values from environment variables that are conventionally credential-bearing, while leaving ordinary environment values available in diagnostics.

func NewRedactor added in v1.10.0 

func NewRedactor(secretsEnv []string) *Redactor

NewRedactor masks the values (not keys) of KEY=VALUE entries; empty values are ignored.

func (*Redactor) Redact added in v1.10.0 

func (r *Redactor) Redact(s string) string

type ResolvedSecret added in v1.18.0 

type ResolvedSecret struct {
	Name      string
	Value     string
	Sensitive bool
	Source    string
}

ResolvedSecret is the runtime value returned by a secret source.

type Resolver added in v1.18.0 

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver routes a SecretRef to an explicitly registered source instance.

func NewResolver added in v1.18.0 

func NewResolver() *Resolver

func NewResolverForConfig added in v1.18.0 

func NewResolverForConfig(devsyConfig *config.Config) (*Resolver, error)

NewResolverForConfig constructs the local Devsy source plus all external sources registered in the active local context.

func (*Resolver) Register added in v1.18.0 

func (r *Resolver) Register(name, typeName string, source Source) error

func (*Resolver) Resolve added in v1.18.0 

func (r *Resolver) Resolve(ctx context.Context, ref SecretRef) (ResolvedSecret, error)

type SOPSSource added in v1.18.0 

type SOPSSource struct {
	// contains filtered or unexported fields
}

SOPSSource resolves values from one SOPS-encrypted document. A source is command-scoped: decrypted values are cached in memory for the lifetime of the source instance.

func NewSOPSDataSource added in v1.18.0 

func NewSOPSDataSource(name, logicalPath, format string, encrypted []byte) *SOPSSource

NewSOPSDataSource is used for repository inspection where the encrypted file is read directly from a Git revision without being materialized on disk.

func NewSOPSSource added in v1.18.0 

func NewSOPSSource(name, filePath, format string) *SOPSSource

func (*SOPSSource) Get added in v1.18.0 

func (s *SOPSSource) Get(ctx context.Context, name string) (ResolvedSecret, error)

func (*SOPSSource) Validate added in v1.18.0 

func (s *SOPSSource) Validate(ctx context.Context) error

Validate forces decryption and document validation without exposing values.

type SecretMeta added in v1.10.0 

type SecretMeta struct {
	Name     string    `json:"name"`
	Context  string    `json:"context"`
	Kind     Kind      `json:"kind"`
	Value    string    `json:"value,omitempty"`
	Created  time.Time `json:"created"`
	LastUsed time.Time `json:"lastUsed,omitzero"`
	Backend  Backend   `json:"backend,omitempty"`

	Orphaned bool `json:"-"`
}

func (SecretMeta) Sensitive added in v1.10.0 

func (m SecretMeta) Sensitive() bool

type SecretRef added in v1.18.0 

type SecretRef struct {
	Type   string
	Source string
	Name   string
}

SecretRef identifies a named secret and the source instance that owns it. Unqualified references resolve from the local Devsy store. Qualified references use TYPE:SOURCE/NAME, for example sops:project/API_TOKEN.

func ParseRef added in v1.18.0 

func ParseRef(value string) (SecretRef, error)

func (SecretRef) String added in v1.18.0 

func (r SecretRef) String() string

type Source added in v1.18.0 

type Source interface {
	Get(ctx context.Context, name string) (ResolvedSecret, error)
}

Source resolves externally or locally owned secret values.

type SourceConfig added in v1.18.0 

type SourceConfig struct {
	Name   string `json:"name"             yaml:"name"`
	Type   string `json:"type"             yaml:"type"`
	Path   string `json:"path,omitempty"   yaml:"path,omitempty"`
	Format string `json:"format,omitempty" yaml:"format,omitempty"`
}

SourceConfig describes an external secret source. It contains references only; secret values and decryption credentials are never persisted here.

func AddSourceConfig added in v1.18.0 

func AddSourceConfig(sources []SourceConfig, source SourceConfig) ([]SourceConfig, error)

func FindSourceConfig added in v1.18.0 

func FindSourceConfig(sources []SourceConfig, name string) (SourceConfig, bool)

func LoadSourceConfigs added in v1.18.0 

func LoadSourceConfigs(devsyConfig *config.Config) ([]SourceConfig, error)

LoadSourceConfigs loads external sources registered for the active context.

func RemoveSourceConfig added in v1.18.0 

func RemoveSourceConfig(sources []SourceConfig, name string) ([]SourceConfig, bool)

type Store added in v1.10.0 

type Store interface {
	Set(context, name, value string, kind Kind) error
	Get(context, name string) (string, error)
	Meta(context, name string) (SecretMeta, error)
	List(context string) ([]SecretMeta, error)
	Delete(context, name string) error
}

func NewStoreForConfig added in v1.10.0 

func NewStoreForConfig(devsyConfig *config.Config) (Store, error)

type StreamingRedactor 

type StreamingRedactor struct {
	// contains filtered or unexported fields
}

StreamingRedactor preserves a short suffix between writes so secrets split across subprocess or logger chunks are still masked before they are forwarded. Call Flush when the stream ends to release the final suffix.

func NewStreamingRedactor 

func NewStreamingRedactor(r *Redactor) *StreamingRedactor

NewStreamingRedactor creates a chunk-safe redactor around r.

func (*StreamingRedactor) Flush 

func (r *StreamingRedactor) Flush() string

Flush returns the final pending suffix, redacted as a complete fragment.

func (*StreamingRedactor) RedactChunk 

func (r *StreamingRedactor) RedactChunk(chunk string) string

RedactChunk returns the portion safe to emit immediately.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.