Documentation
¶
Index ¶
- Constants
- func DirNameToID(dirName string) (store.ID, error)
- func GetIdentity(k KeyType, decryptionKey string) (age.Identity, error)
- func GetRecipients(k KeyType, encryptionKeys []string, opts ...RecipientOption) ([]age.Recipient, error)
- func IDToDirName(id store.ID) string
- func Persist(id store.ID, root *os.Root, metadata map[string]string, ...) error
- func RestoreMetadata(secretDir *os.Root) (map[string]string, error)
- type EncryptedSecret
- type KeyType
- type PromptFunc
- type RecipientOption
Constants ¶
const ( SecretFileName = "secret" MetadataFileName = "metadata.json" )
const MaxScryptWorkFactor = 22
MaxScryptWorkFactor is the largest scrypt work factor (2^logN) that may be used when encrypting a password-protected secret. It matches the default maximum work factor accepted by age when decrypting, so files written at or below this value remain decryptable by standard age tooling.
Variables ¶
This section is empty.
Functions ¶
func DirNameToID ¶
DirNameToID decodes a base64-encoded directory name back into a secret ID.
It returns an error if the directory name is not valid base64 or cannot be parsed into a store.ID.
func GetIdentity ¶
GetIdentity returns an age.Identity for the given key type and decryption key.
The identity implementation depends on the provided KeyType:
- PasswordKeyType → age.NewScryptIdentity
- AgeKeyType → age.ParseX25519Identity
- SSHKeyType → agessh.ParseIdentity
An error is returned if the key cannot be parsed or the key type is unsupported.
func GetRecipients ¶
func GetRecipients(k KeyType, encryptionKeys []string, opts ...RecipientOption) ([]age.Recipient, error)
GetRecipients returns a slice of age.Recipient for the given key type and encryption keys.
The recipient implementation depends on the provided KeyType:
- passwordKeyType → age.NewScryptRecipient
- ageKeyType → age.ParseX25519Recipient
- sshKeyType → agessh.ParseRecipient
Optional RecipientOption values tune recipient creation; see WithScryptWorkFactor.
An error is returned if the key cannot be parsed, an option is invalid, or the key type is unsupported.
func IDToDirName ¶
IDToDirName encodes a secret ID as a base64 string suitable for use as a directory name. This avoids issues with unsupported characters (such as slashes) in filesystem paths.
func Persist ¶
func Persist(id store.ID, root *os.Root, metadata map[string]string, secrets []EncryptedSecret) error
Persist writes a secret and its metadata to a new directory on disk.
The directory name is derived from the secret ID, base64-encoded to avoid unsupported characters. If the directory already exists, it is removed before writing, ensuring that secrets encrypted with different keys cannot become inconsistent.
Inside the directory, the function creates:
- metadata.json — a JSON-encoded metadata file (always public)
- secret<KeyType> — one encrypted secret file per key type
If any step fails, the directory is removed to prevent partial or inconsistent state. An error is returned in such cases.
Types ¶
type EncryptedSecret ¶
func RestoreSecret ¶
RestoreSecret reads the secret and metadata files from its scoped directory
type KeyType ¶
type KeyType string
KeyType identifies the type of encryption or decryption key associated with a secret (e.g., password, age, or SSH).
type PromptFunc ¶
PromptFunc is a callback invoked by the store when encrypting or decrypting a file. The function is expected to return the key material (as a byte slice) or an error if the key cannot be obtained.
type RecipientOption ¶ added in v0.2.1
type RecipientOption func(*recipientOptions)
RecipientOption configures how recipients are built by GetRecipients.
func WithScryptWorkFactor ¶ added in v0.2.1
func WithScryptWorkFactor(logN int) RecipientOption
WithScryptWorkFactor sets the scrypt work factor (2^logN) used for PasswordKeyType recipients. It is a no-op for age and ssh key types.
A zero value leaves the age default in place. Non-zero values are validated by GetRecipients, which returns an error when logN is outside 1..MaxScryptWorkFactor.
See the posixage.WithScryptWorkFactor option for a cost/security table and guidance on choosing a value.
Source Files