Documentation
¶
Index ¶
- Constants
- func DirNameToID(dirName string) (store.ID, error)
- func GetIdentity(k KeyType, decryptionKey string) (age.Identity, error)
- func GetRecipients(k KeyType, encryptionKeys []string) ([]age.Recipient, error)
- func IDToDirName(id store.ID) string
- func Persist(id store.ID, root *os.Root, metadata map[string]string, ...) error
- func RestoreMetadata(secretDir *os.Root) (map[string]string, error)
- type EncryptedSecret
- type KeyType
- type PromptFunc
Constants ¶
const ( SecretFileName = "secret" MetadataFileName = "metadata.json" )
Variables ¶
This section is empty.
Functions ¶
func DirNameToID ¶
DirNameToID decodes a base64-encoded directory name back into a secret ID.
It returns an error if the directory name is not valid base64 or cannot be parsed into a store.ID.
func GetIdentity ¶
GetIdentity returns an age.Identity for the given key type and decryption key.
The identity implementation depends on the provided KeyType:
- PasswordKeyType → age.NewScryptIdentity
- AgeKeyType → age.ParseX25519Identity
- SSHKeyType → agessh.ParseIdentity
An error is returned if the key cannot be parsed or the key type is unsupported.
func GetRecipients ¶
GetRecipients returns a slice of age.Recipient for the given key type and encryption keys.
The recipient implementation depends on the provided KeyType:
- passwordKeyType → age.NewScryptRecipient
- ageKeyType → age.ParseX25519Recipient
- sshKeyType → agessh.ParseRecipient
An error is returned if the key cannot be parsed or the key type is unsupported.
func IDToDirName ¶
IDToDirName encodes a secret ID as a base64 string suitable for use as a directory name. This avoids issues with unsupported characters (such as slashes) in filesystem paths.
func Persist ¶
func Persist(id store.ID, root *os.Root, metadata map[string]string, secrets []EncryptedSecret) error
Persist writes a secret and its metadata to a new directory on disk.
The directory name is derived from the secret ID, base64-encoded to avoid unsupported characters. If the directory already exists, it is removed before writing, ensuring that secrets encrypted with different keys cannot become inconsistent.
Inside the directory, the function creates:
- metadata.json — a JSON-encoded metadata file (always public)
- secret<KeyType> — one encrypted secret file per key type
If any step fails, the directory is removed to prevent partial or inconsistent state. An error is returned in such cases.
Types ¶
type EncryptedSecret ¶
func RestoreSecret ¶
RestoreSecret reads the secret and metadata files from its scoped directory
Source Files