Documentation
¶
Overview ¶
Package secret provides pluggable credential sources for run-as operations.
The whole point of this package is one small seam:
type Provider interface { Credential() (Credential, error) }
In the old days, the run-as account's password was a plaintext constant hardcoded into every script. That worked — and it was the single biggest liability in the codebase. Here, the call site that needs a credential depends only on the Provider interface; *where* the secret actually lives is a configuration decision, not a code change.
Providers, weakest to strongest:
Plaintext - literal password in source. Possible, but it announces itself. Env - read from environment variables (out of the binary). DPAPI - Windows DPAPI-encrypted blob on disk (no key to ship). [windows] CredMan - Windows Credential Manager entry (binary carries no secret). [windows]
The lesson worth keeping: make the insecure path possible but obvious, and make the secure path the easy default.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrUnsupportedPlatform = errors.New("winadmin/secret: provider not supported on this platform")
ErrUnsupportedPlatform is returned by OS-specific providers (DPAPI, CredMan) when built for a non-Windows target.
Functions ¶
func EncryptDPAPI ¶
EncryptDPAPI is a non-functional stub off Windows.
Types ¶
type CredMan ¶
CredMan is a non-functional stub off Windows.
func (CredMan) Credential ¶
func (CredMan) Credential() (Credential, error)
Credential implements Provider; always returns ErrUnsupportedPlatform here.
type Credential ¶
Credential is a resolved set of logon values.
Domain may be a real domain ("ACME") or a machine name for a local account. An empty Domain is interpreted as "." (the local machine) by the runas package.
func (Credential) IsZero ¶
func (c Credential) IsZero() bool
IsZero reports whether the credential carries no user and no password.
func (Credential) String ¶
func (c Credential) String() string
String redacts the password so credentials never leak into logs.
type DPAPI ¶
DPAPI is a non-functional stub off Windows.
func (DPAPI) Credential ¶
func (DPAPI) Credential() (Credential, error)
Credential implements Provider; always returns ErrUnsupportedPlatform here.
type Env ¶
Env reads a credential from environment variables. This gets the secret out of the binary and into the deployment surface (a systemd unit, a CI secret, a launchd plist, etc.) — the first meaningful step up from Plaintext.
Zero-value field names fall back to sane defaults:
UserVar -> WINADMIN_USER DomainVar -> WINADMIN_DOMAIN PasswordVar -> WINADMIN_PASSWORD
func (Env) Credential ¶
func (e Env) Credential() (Credential, error)
Credential implements Provider.
type Plaintext ¶
Plaintext is the deliberately-insecure option: a literal credential compiled into the program. It exists on purpose — for bootstrapping, for parity with the old scripts, and so the insecure choice is a deliberate, visible one.
Reach for Env, DPAPI, or CredMan the moment you can. Swapping is a one-line change because everything downstream only sees Provider.
func (Plaintext) Credential ¶
func (p Plaintext) Credential() (Credential, error)
Credential implements Provider.
type Provider ¶
type Provider interface {
Credential() (Credential, error)
}
Provider yields a Credential at runtime. Implementations decide where the secret physically lives.
Source Files