Documentation
¶
Overview ¶
Package sealcli hosts the flag, key and payload plumbing the sealing CLIs share: the four key-source flags with their help text, the exactly-one-of-per-pair refusal keymaterial deliberately leaves to its callers, and the size-capped file-or-stdin payload read. The flags come in two roles — KeySources for a producer (sign PRIVATE, encrypt PUBLIC) and ConsumerKeySources for an opener (sign PUBLIC, encrypt PRIVATE) — and each command keeps only its own flags, its own required-flag checks and its own call into jose.
Index ¶
Constants ¶
const MaxPayloadBytes int64 = 1 << 20 // 1 MiB
MaxPayloadBytes is the ceiling open-event applies. A sealed body has a ~1.4 KB floor and an event document is orders of magnitude under it; the cap exists so a mistyped path (a log, a core dump, a tarball) is refused at the door rather than buffered whole and then refused by the JSON or JOSE parser. It is not a package-wide policy: each command chooses, and the sealing CLIs deliberately stay uncapped.
const Uncapped int64 = 0
Uncapped is the max a caller passes to ReadPayloadCapped to ask for no ceiling at all.
Variables ¶
var ErrPayloadTooLarge = errors.New("payload exceeds the size limit")
ErrPayloadTooLarge is what a payload over the caller's limit refuses with; only ReadPayloadCapped returns it.
var ErrUsage = errors.New("usage error")
ErrUsage marks flag-parse failures whose message the FlagSet already printed to stderr itself — a command must not print them a second time.
Functions ¶
func PositionalPath ¶
PositionalPath parses args with fs and returns the single optional positional argument: the payload path ReadPayload then consumes, "" when absent. A parse failure is wrapped in ErrUsage so the caller can tell the already-reported ones apart; a second positional argument is refused here.
func ReadPayload ¶
ReadPayload reads the whole payload from the positional file argument, or from stdin when the path is absent ("") or "-", with no size limit. A command that wants one calls ReadPayloadCapped instead: the ceiling is the CALLER's policy, so adding one to a new binary cannot shrink what an existing one accepts.
func ReadPayloadCapped ¶ added in v0.65.0
ReadPayloadCapped is ReadPayload with a ceiling: at most limit bytes are accepted, one byte more is ErrPayloadTooLarge and nothing is returned. limit of Uncapped (or any value below it) reads whatever the source holds.
Types ¶
type ConsumerKeySources ¶ added in v0.65.0
type ConsumerKeySources struct {
SignFile, SignValue, EncryptFile, EncryptValue string
}
ConsumerKeySources holds the four key-source flags an opening CLI takes. It is the inverse-role twin of KeySources: the same four flag NAMES, carrying the mirror halves — the producer's sign PUBLIC key and the audience's own encrypt PRIVATE key.
func ConsumerKeyFlags ¶ added in v0.65.0
func ConsumerKeyFlags(fs *flag.FlagSet, verifyUse, decryptUse string) *ConsumerKeySources
ConsumerKeyFlags registers the four key-source flags on fs in the consumer roles and returns the struct they bind to. verifyUse and decryptUse are the per-CLI purpose clauses appended to the two -key-file help strings, the same way KeyFlags takes them.
func (*ConsumerKeySources) Load ¶ added in v0.65.0
func (k *ConsumerKeySources) Load(signKid, encryptKid string) (*keymaterial.ConsumerKeys, error)
Load re-runs Validate, then loads and parses both keys and returns the consumer-role resolver under the given kids. The refusals precede any I/O.
func (*ConsumerKeySources) Validate ¶ added in v0.65.0
func (k *ConsumerKeySources) Validate() error
Validate enforces exactly-one-of per key-source pair, refusing with the same strings the producer pair uses so an operator reads one vocabulary across both binaries.
type KeySources ¶
KeySources holds the four key-source flags a seal CLI takes. SignOptional, set by a caller that can seal without signing, lets both sign sources be absent; the zero value keeps the sign pair required.
func KeyFlags ¶
func KeyFlags(fs *flag.FlagSet, signUse, encryptUse string) *KeySources
KeyFlags registers -sign-key-file, -sign-key-value, -encrypt-key-file and -encrypt-key-value on fs and returns the struct they bind to. signUse and encryptUse are the per-CLI purpose clauses appended to the two -key-file help strings ("used to sign the outbound JWS", "used to encrypt the subject member"), so each command keeps naming what its own keys are for.
func (*KeySources) Load ¶
func (k *KeySources) Load(signKid, encryptKid string) (*keymaterial.ProducerKeys, error)
Load re-runs Validate — so the type is safe to use without the CLI-side call — then loads and parses the keys and returns the producer-role resolver under the given kids. A SignOptional caller with no sign source gets a nil sign key. The refusals precede any I/O, so a mistyped invocation costs no file read.
func (*KeySources) Validate ¶
func (k *KeySources) Validate() error
Validate enforces exactly-one-of per key-source pair. keymaterial's loaders let the file source win when both are set, so the choice has to be refused by the caller; each CLI runs this first in its own flag validation, which is what keeps the refusals ahead of the required-flag messages in stderr.
Source Files