Documentation
¶
Overview ¶
Package secretfile creates a file that is going to hold a secret, so that the file is never wider than 0600 and never reached through a symlink as its final component (cli#1223). The destination is opened BEFORE the secret exists, and the caller commits or aborts afterwards.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( Rename = os.Rename Remove = os.Remove Write = func(f *os.File, b []byte) error { _, err := f.Write(b); return err } )
Rename, Write and Remove are seams so a test can force the late failures (the ones that happen after the secret was minted); production never changes them.
var ErrExists = errors.New("path already exists")
ErrExists reports a destination that already exists (a file, a directory or a symlink, dangling or not) and --force was not given.
var ErrIsDir = errors.New("path is a directory")
ErrIsDir reports a destination that is a directory, which --force never replaces.
Functions ¶
This section is empty.
Types ¶
type LeftBehindError ¶
LeftBehindError reports that cleanup could not remove the file Open created, so it may still hold part or all of the secret. Path is the file to delete.
func (*LeftBehindError) Error ¶
func (e *LeftBehindError) Error() string
func (*LeftBehindError) Unwrap ¶
func (e *LeftBehindError) Unwrap() error
type Pending ¶
type Pending struct {
// contains filtered or unexported fields
}
Pending is an opened, still empty destination.
func Open ¶
Open creates the destination: O_CREAT|O_EXCL|O_NOFOLLOW at 0600 on the path itself, or — with force — on a fresh temp file in the same directory, which Commit renames over the path. The final path component is never followed if it is a symlink (O_NOFOLLOW); symlinked parent directories are followed like any other path.
func (*Pending) Abort ¶
Abort closes and removes the file Open created. Safe to call after a failed Commit and more than once. Under force an existing destination is untouched. A *LeftBehindError means the file could not be removed and the caller must tell the user where it is.
func (*Pending) Commit ¶
Commit writes the secret and, under force, renames the temp over the destination. On any failure the file Open created is removed; if that removal fails too the error is a *LeftBehindError naming the file. The error never contains the secret unless the underlying write error does, so callers must not print it raw.
Source Files