Documentation
¶
Overview ¶
Package keychain stores a secret in the operating system's keychain and reads it back, so a token need never sit in the configuration file. It links nothing: it drives the platform's own tool, which is what keeps the build pure Go.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoAccount = errors.New("no account name to store the secret under: neither the current user nor $USER names one")
ErrNoAccount reports that neither the current user's login name nor $USER gives the account name security needs to store a secret under.
var ErrNotKept = errors.New("the keychain did not keep the secret")
ErrNotKept reports a keychain that did not keep the secret it was handed.
var ErrNotRead = errors.New("the keychain could not be read")
ErrNotRead reports a keychain that could not be read for a reason other than holding no such secret.
var ErrNotStored = errors.New("the keychain holds no secret under that name")
ErrNotStored reports a keychain that holds no secret under the service asked for.
var ErrNotWired = errors.New("workflow drives no keychain on this system")
ErrNotWired reports a system with no keychain workflow drives: every one but macOS.
var ErrSecretNotOneLine = errors.New("the secret cannot be handed to security on one line")
ErrSecretNotOneLine reports a secret that cannot travel on one line of security's input: one holding a line break or a NUL byte, or one longer than the line security reads.
Functions ¶
func Storer ¶ added in v0.4.0
func Storer( goos string, run Runner, currentUser UserLookup, getenv func(string) string, ) func(ctx context.Context, service, secret string) error
Storer keeps a secret under the service named, in the keychain on goos, through run, under the context it is asked under and bounded as Item.Store is. It is nil where storing is not wired for goos, so a caller keeps the secret elsewhere there. Storing is wired for macOS, through the built-in `security`.
Types ¶
type Item ¶ added in v0.5.0
type Item struct {
// contains filtered or unexported fields
}
Item is a secret the macOS keychain holds under service, for the user running this program.
func Open ¶ added in v0.5.0
func Open(goos, service string, run Runner, currentUser UserLookup, getenv func(string) string) (Item, bool)
Open is the keychain item for service on goos, and false where no keychain is wired: everywhere but macOS, whose built-in `security` it drives.
func (Item) Read ¶ added in v0.5.0
Read is the secret the item holds, or ErrNotStored when there is none. Any other failure is ErrNotRead.
func (Item) Store ¶ added in v0.5.0
Store saves secret, replacing any the item held. security runs with -i, reading the command that stores the secret from its standard input, so the secret is never one of the program's arguments. It requires an account name, and the secret is stored under the login name of the user running this program: currentUser's, or getenv's $USER where that lookup fails or gives none.
type Runner ¶ added in v0.4.0
Runner runs a program with input on its standard input and returns what it wrote to standard output. proc.Capture satisfies it.
type UserLookup ¶ added in v0.4.0
UserLookup returns the user running this program. user.Current satisfies it.
Source Files