internal/

Package buildinfo exposes version information injected at link time.

Package certificate parses, describes, creates, lints and compares X.509 certificates.

Package config loads the SSLKnife configuration file and resolves platform-specific default locations.

Package converter detects certificate/key container formats, decodes them into a common Bundle of objects, and encodes bundles into target formats.

Package crypto holds the small set of primitives the vault is built from: AES-256-GCM sealing, HKDF key derivation, Argon2id password hashing and random identifiers.

Package ct monitors Certificate Transparency for watched domains through CT search services (Cert Spotter, crt.sh).

Package database stores the SSLKnife inventory in an encrypted SQLite database (see docs/DESIGN.md §5 for the construction).

Package exitcode maps errors to the documented, deterministic process exit codes (see docs/DESIGN.md §7).

Package inventory implements the certificate and key inventory use cases on top of the encrypted database: import with de-duplication and automatic linking (issuer ↔ subject, certificate ↔ private key), chains, search and expiry.

Package keycache keeps an unlocked vault root key in a short-lived background process, so commands run shortly after one another do not ask for the password again (like sudo's timestamp).

Package keys parses, generates, describes and compares private and public keys in the formats SSLKnife supports.

Package logging configures structured logging with secret redaction.

Package netdial opens TCP connections directly or through an HTTP CONNECT or SOCKS5 proxy.

Package output renders command results as human-readable text, JSON or YAML.

Package prompt implements the small set of interactive TTY prompts SSLKnife needs: confirmations, passwords, free text and choices.

Package protocol reaches the point where a TLS ClientHello can be sent: directly for TLS-wrapped services, or after a plaintext STARTTLS-style negotiation (SMTP, IMAP, POP3, FTP, LDAP, XMPP, PostgreSQL, MySQL).

Package remotesync keeps the local encrypted inventory in step with a shared remote store (HashiCorp Vault KV v2), so several devices running SSLKnife see the same certificates, keys and SSH keys.

Package scanner enumerates TLS protocol versions, cipher suites and key exchange groups by sending its own ClientHello messages and reading only the server's reply.

Package search compiles the inventory query language into parameterised SQL.

Package secrets manages the vault root key: the keyslot file that stores it wrapped under password- or keychain-derived keys, and the providers used to unlock it (environment, OS keychain, TTY).

Package server runs the local SSLKnife web interface and REST API.

Package sshagent connects to a running ssh-agent and serves an in-memory agent over a Unix socket, so keys from the vault can be used by ssh without ever being written to disk.

Package sshkeys parses, describes, generates and certifies SSH keys (OpenSSH public/private keys, authorized_keys, RFC 4716 and OpenSSH certificates).

Package tlsinspect connects to TLS endpoints (directly or via STARTTLS), inspects the negotiated session and certificate chain, and combines the raw-probe scanner results into a full scan report.

Package vaultkv is a small HashiCorp Vault HTTP client covering what the remote inventory needs: the KV version 2 secrets engine, the Transit engine and token, AppRole and username/password (userpass, LDAP) authentication.

Package views defines the public JSON schema of inventory objects shared by the CLI (--json/--yaml) and the REST API.