Documentation
¶
Overview ¶
Package sealcli hosts the flag, key and payload plumbing the sealing CLIs share: the four key-source flags with their help text, the exactly-one-of-per-pair refusal keymaterial deliberately leaves to its callers, and the size-capped file-or-stdin payload read. The flags come in two roles — KeySources for a producer (sign PRIVATE, encrypt PUBLIC) and ConsumerKeySources for an opener (sign PUBLIC, encrypt PRIVATE). DocumentSpec turns the kid and subject flags into a raw-document Spec. Each command keeps only its own flags, its own required-flag checks and its own seal or open call.
Index ¶
- Constants
- Variables
- func DocumentSpec(signKid, encryptKid, subject string) (*sealed.Spec, error)
- func PositionalPath(fs *flag.FlagSet, args []string) (string, error)
- func ReadPayload(path string, stdin io.Reader) ([]byte, error)
- func ReadPayloadCapped(path string, stdin io.Reader, limit int64) ([]byte, error)
- type ConsumerKeySources
- type KeySources
Constants ¶
const MaxPayloadBytes int64 = 1 << 20 // 1 MiB
MaxPayloadBytes is the ceiling open-event applies. A sealed body has a ~1.4 KB floor and an event document is orders of magnitude under it; the cap exists so a mistyped path (a log, a core dump, a tarball) is refused at the door rather than buffered whole and then refused by the JSON or JOSE parser. It is not a package-wide policy: each command chooses, and the sealing CLIs deliberately stay uncapped.
const Uncapped int64 = 0
Uncapped is the max a caller passes to ReadPayloadCapped to ask for no ceiling at all.
Variables ¶
var ErrPayloadTooLarge = errors.New("payload exceeds the size limit")
ErrPayloadTooLarge is what a payload over the caller's limit refuses with; only ReadPayloadCapped returns it.
var ErrUsage = errors.New("usage error")
ErrUsage marks flag-parse failures whose message the FlagSet already printed to stderr itself — a command must not print them a second time.
Functions ¶
func DocumentSpec ¶ added in v0.66.0
DocumentSpec builds the raw-document Spec from the -sign-kid, -encrypt-kid and -subject flags. The wire carries each concrete Generation while the Spec names its Logical family, so the CLI takes the concrete kid and splits it rather than asking the operator for both.
func PositionalPath ¶
PositionalPath parses args with fs and returns the single optional positional argument: the payload path ReadPayload then consumes, "" when absent. A parse failure is wrapped in ErrUsage so the caller can tell the already-reported ones apart; a second positional argument is refused here.
func ReadPayload ¶
ReadPayload reads the whole payload from the positional file argument, or from stdin when the path is absent ("") or "-", with no size limit. A command that wants one calls ReadPayloadCapped instead: the ceiling is the CALLER's policy, so adding one to a new binary cannot shrink what an existing one accepts.
func ReadPayloadCapped ¶ added in v0.65.0
ReadPayloadCapped is ReadPayload with a ceiling: at most limit bytes are accepted, one byte more is ErrPayloadTooLarge and nothing is returned. limit of Uncapped (or any value below it) reads whatever the source holds.
Types ¶
type ConsumerKeySources ¶ added in v0.65.0
type ConsumerKeySources struct {
SignFile, SignValue, EncryptFile, EncryptValue string
}
ConsumerKeySources holds the four key-source flags an opening CLI takes. It is the inverse-role twin of KeySources: the same four flag NAMES, carrying the mirror halves — the producer's sign PUBLIC key and the audience's own encrypt PRIVATE key.
func ConsumerKeyFlags ¶ added in v0.65.0
func ConsumerKeyFlags(fs *flag.FlagSet, verifyUse, decryptUse string) *ConsumerKeySources
ConsumerKeyFlags registers the four key-source flags on fs in the consumer roles and returns the struct they bind to. verifyUse and decryptUse are the per-CLI purpose clauses appended to the two -key-file help strings, the same way KeyFlags takes them.
func (*ConsumerKeySources) Load ¶ added in v0.65.0
func (k *ConsumerKeySources) Load(signKid, encryptKid string) (*keymaterial.ConsumerKeys, error)
Load re-runs Validate, then loads and parses both keys and returns the consumer-role resolver under the given kids. The refusals precede any I/O.
func (*ConsumerKeySources) Validate ¶ added in v0.65.0
func (k *ConsumerKeySources) Validate() error
Validate enforces exactly-one-of per key-source pair, refusing with the same strings the producer pair uses so an operator reads one vocabulary across both binaries.
type KeySources ¶
KeySources holds the four key-source flags a seal CLI takes. SignOptional, set by a caller that can seal without signing, lets both sign sources be absent; the zero value keeps the sign pair required.
func KeyFlags ¶
func KeyFlags(fs *flag.FlagSet, signUse, encryptUse string) *KeySources
KeyFlags registers -sign-key-file, -sign-key-value, -encrypt-key-file and -encrypt-key-value on fs and returns the struct they bind to. signUse and encryptUse are the per-CLI purpose clauses appended to the two -key-file help strings ("used to sign the outbound JWS", "used to encrypt the subject member"), so each command keeps naming what its own keys are for.
func (*KeySources) Load ¶
func (k *KeySources) Load(signKid, encryptKid string) (*keymaterial.ProducerKeys, error)
Load re-runs Validate — so the type is safe to use without the CLI-side call — then loads and parses the keys and returns the producer-role resolver under the given kids. A SignOptional caller with no sign source gets a nil sign key. The refusals precede any I/O, so a mistyped invocation costs no file read.
func (*KeySources) Validate ¶
func (k *KeySources) Validate() error
Validate enforces exactly-one-of per key-source pair. keymaterial's loaders let the file source win when both are set, so the choice has to be refused by the caller; each CLI runs this first in its own flag validation, which is what keeps the refusals ahead of the required-flag messages in stderr.
Source Files