Documentation
¶
Overview ¶
Package keys wires keyforge into SystemForge (ADR-013): one key library for every encryption need on the platform, with the root key read through omnivault and lifecycle events sent to the platform audit trail.
This first version runs keyforge's single-host setup: the keyring and its registry live together in one directory, so they are backed up together.
Index ¶
- Variables
- func CheckRootKeyLocation(vaultURI, secretPath, dir string) error
- func VaultSource(v vault.Vault, path string) local.RootKeySource
- type Keys
- func (k *Keys) Client() *keyforge.Client
- func (k *Keys) Close() error
- func (k *Keys) Open(ctx context.Context, purpose keyforge.Purpose, sealed, aad []byte) ([]byte, error)
- func (k *Keys) Ready(ctx context.Context) error
- func (k *Keys) Run(ctx context.Context) error
- func (k *Keys) Seal(ctx context.Context, purpose keyforge.Purpose, plaintext, aad []byte) ([]byte, error)
- type Options
Constants ¶
This section is empty.
Variables ¶
var ErrRootKeyInKeysDir = errors.New("keys: the root key must not be stored in or under the keys directory")
ErrRootKeyInKeysDir is returned when the root key would be stored in or under the keys directory. A backup or copy of that directory would then hold everything needed to decrypt the data the keys protect.
Functions ¶
func CheckRootKeyLocation ¶ added in v0.21.0
CheckRootKeyLocation refuses a root key that an omnivault file vault (a "file://" URI) would read from a file in or under dir. Other vaults keep secrets outside the filesystem layout and pass.
func VaultSource ¶
func VaultSource(v vault.Vault, path string) local.RootKeySource
VaultSource returns a root key source that reads the key from a secret in an omnivault vault. The secret holds 32 bytes as standard base64 or as 64 hex digits, the forms keyforge accepts from a file or the environment.
Types ¶
type Keys ¶
type Keys struct {
// contains filtered or unexported fields
}
Keys is a running key system.
func (*Keys) Open ¶
func (k *Keys) Open(ctx context.Context, purpose keyforge.Purpose, sealed, aad []byte) ([]byte, error)
Open decrypts a binary envelope produced by Keys.Seal with the same purpose and aad.
type Options ¶
type Options struct {
// Dir holds the keyring, the registry and the job state. Required.
Dir string
// Root supplies the root key that protects the keyring, for example
// [VaultSource]. It must not be a file in Dir. Required.
Root local.RootKeySource
// Purposes are the purposes to manage. Each gets a key on first start.
// Required.
Purposes []keyforge.Purpose
// Audit receives key lifecycle events. When it is nil and Logger is set,
// the events are logged instead. Optional.
Audit sfaudit.Store
// Logger receives key lifecycle events when Audit is nil. Optional.
Logger *slog.Logger
// AcceptRollback opens a keyring older than one this host has seen, as
// restoring from backup produces. Set it only after confirming the restore.
AcceptRollback bool
}
Options configures Open.
Source Files