Documentation
¶
Overview ¶
Package tokenstore keeps the secrets a client caches between its runs, as the refresh token of a login, in the most protected place the machine offers.
Three backends are known, tried in this order when none is asked:
keyring: the keyring of the user session, the Secret Service of a linux desktop, the macOS keychain or the Windows credential manager. A headless server usually has none.
agent: a file encrypted with a key derived from a signature the ssh-agent of the user makes, with an ed25519 or an rsa key, whose signatures are the same each time. The file is of no use without the agent holding that key: a backup, a copied home directory or a stolen disk do not open it. Whoever can use the agent can, as they can use the key itself.
file: a file only the user reads. It is what a token is worth on a machine whose other users the user trusts not to be root.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // Backends are the backends, in the order Auto tries them. Backends = []Backend{Keyring, Agent, File} // ErrNotFound is returned on the load of a secret the store does not // hold. ErrNotFound = errors.New("not found in the token store") )
var ErrAgentKeyMissing = errors.New("the ssh-agent does not hold the key the token was encrypted with")
ErrAgentKeyMissing is returned on the load of a secret encrypted with a key the agent does not hold now.
Functions ¶
This section is empty.
Types ¶
type Backend ¶
type Backend string
Backend names a place secrets are kept in.
func ParseBackend ¶
ParseBackend returns the backend s names, Auto being the empty string.
type Store ¶
type Store interface {
Backend() Backend
Load(name string) ([]byte, error)
Save(name string, b []byte) error
Delete(name string) error
}
Store keeps named secrets in a backend.
Source Files