Documentation
¶
Index ¶
Constants ¶
const KeyMasterPassphrase = "master-passphrase"
KeyMasterPassphrase is the keyring key for the master passphrase.
const Service = "lango"
Service is the service name used for all keyring operations.
Variables ¶
var ErrBiometricNotAvailable = errors.New("keyring: biometric authentication not available")
ErrBiometricNotAvailable is returned when biometric authentication hardware (e.g., Touch ID on macOS) is not available on the current system.
var ErrEntitlement = errors.New("keyring: missing code signing entitlement for biometric storage")
ErrEntitlement is returned when a keyring operation fails due to missing code signing entitlements (macOS errSecMissingEntitlement / -34018). With the login Keychain + BiometryCurrentSet approach, this error should no longer occur in normal usage. Retained as a safety net for edge cases (e.g., device passcode not set with kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly).
var ErrNotFound = errors.New("keyring: key not found")
ErrNotFound is returned when the requested key does not exist in the keyring.
var ErrTPMNotAvailable = errors.New("keyring: TPM device not available")
ErrTPMNotAvailable is returned when no TPM 2.0 device is accessible on the current system.
Functions ¶
func DetectSecureProvider ¶
func DetectSecureProvider() (Provider, SecurityTier)
DetectSecureProvider probes available security backends and returns the highest-tier provider. Returns (nil, TierNone) if no secure hardware backend is available — callers should fall back to keyfile or interactive prompt.
Types ¶
type BiometricProvider ¶
type BiometricProvider struct{}
BiometricProvider is a stub on platforms without macOS Touch ID support.
func NewBiometricProvider ¶
func NewBiometricProvider() (*BiometricProvider, error)
NewBiometricProvider always returns ErrBiometricNotAvailable on non-Darwin or non-CGO platforms.
func (*BiometricProvider) Delete ¶
func (*BiometricProvider) Delete(string, string) error
Delete is a no-op stub that always returns ErrBiometricNotAvailable.
func (*BiometricProvider) Get ¶
func (*BiometricProvider) Get(string, string) (string, error)
Get is a no-op stub that always returns ErrBiometricNotAvailable.
type KeyChecker ¶
KeyChecker is an optional interface that secure providers can implement to check key existence without triggering authentication (e.g., Touch ID). CLI status commands should prefer HasKey over Get to avoid unnecessary biometric prompts.
type Provider ¶
type Provider interface {
// Get retrieves a secret for the given service and key.
// Returns ErrNotFound if the key does not exist.
Get(service, key string) (string, error)
// Set stores a secret for the given service and key.
Set(service, key, value string) error
// Delete removes a secret for the given service and key.
// Returns ErrNotFound if the key does not exist.
Delete(service, key string) error
}
Provider abstracts OS keyring operations for testability.
type SecurityTier ¶
type SecurityTier int
SecurityTier represents the level of hardware-backed security available for keyring storage.
const ( // TierNone indicates no secure hardware backend; keyfile or interactive prompt only. TierNone SecurityTier = iota // TierTPM indicates TPM 2.0 sealed storage is available (Linux). TierTPM // TierBiometric indicates biometric-protected keyring is available (macOS Touch ID). TierBiometric )
func (SecurityTier) String ¶
func (t SecurityTier) String() string
String returns a human-readable label for the security tier.
type TPMProvider ¶
type TPMProvider struct {
// contains filtered or unexported fields
}
TPMProvider stores secrets as TPM2-sealed blobs on disk. Only the same TPM chip can unseal the data, providing hardware-bound protection.
func NewTPMProvider ¶
func NewTPMProvider() (*TPMProvider, error)
NewTPMProvider creates a new TPMProvider. Returns ErrTPMNotAvailable if the TPM2 device is not accessible.
func (*TPMProvider) Delete ¶
func (p *TPMProvider) Delete(service, key string) error
Delete removes the sealed blob file.
func (*TPMProvider) Get ¶
func (p *TPMProvider) Get(service, key string) (string, error)
Get retrieves and unseals a secret from the TPM-sealed blob.
func (*TPMProvider) HasKey ¶
func (p *TPMProvider) HasKey(service, key string) bool
HasKey checks if a sealed blob file exists for the given key without unsealing.
func (*TPMProvider) Set ¶
func (p *TPMProvider) Set(service, key, value string) error
Set seals a secret with the TPM and writes the sealed blob to disk.
Source Files