Documentation
¶
Overview ¶
Package rekey re-encrypts every secret stored in the database under the primary key of the encryption keyset, so a key an operator rotated away from can be retired. It reads and writes rows of every Workspace (and the User and Staff member rows no Workspace owns), so it holds the raw client; it is the only place that sweeps the stored ciphertext.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Count ¶
type Count struct {
// Column names the stored secret, as "table.column".
Column string
// Rewritten values were sealed under an older key and now are under the primary one.
Rewritten int
// Current values were already under the primary key and were left alone.
Current int
// Raced rows changed while the sweep ran (a request saved them): their new value was
// sealed by the running server, so they are skipped. A second run counts them as current.
Raced int
}
Count is what one sweep did to a column.
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module re-encrypts the stored secrets.
Source Files
Click to show internal directories.
Click to hide internal directories.