Documentation
¶
Overview ¶
Package secrets provides authenticated encryption for credentials stored at rest (e.g. workspace provider configs), backed by Google Tink. Tink ciphertext carries the key id, so key rotation is native (a keyset can hold multiple keys with one primary for encryption). The keyset is loaded from config as a base64-encoded cleartext keyset today; swapping in a KMS-wrapped keyset later is a load-time change that leaves Encrypt/Decrypt callers untouched.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrCiphertext = errors.New("invalid or corrupt ciphertext")
ErrCiphertext is returned when a stored value cannot be decrypted.
Functions ¶
func GenerateKeysetBase64 ¶
GenerateKeysetBase64 mints a fresh AES-256-GCM keyset and returns it base64-encoded — for seeding env config and tests.
Types ¶
type Cipher ¶
type Cipher struct {
// contains filtered or unexported fields
}
Cipher encrypts and decrypts secret values with a Tink AEAD primitive.
func NewCipher ¶
NewCipher builds a Cipher from a base64-encoded Tink keyset. It fails fast (caller wires this at boot) when the keyset is missing or malformed.
func (*Cipher) Current ¶
Current reports whether a stored value is sealed under the primary key. Tink ciphertext starts with the byte 1 and the 4-byte big-endian id of the key that sealed it.
Source Files