Documentation
¶
Overview ¶
Package sensitive keeps the values of `sensitive = true` variables out of everything Orchard writes or prints. A Redactor replaces each occurrence of a sensitive string with a marker naming its variable («sensitive:dsn»), wherever the value has travelled: an action's outputs, an undo step, an error message, a component input. The markers are reversible, so teardown, once it has the values again, restores what the run really saw.
ponytail: only string values (and the strings inside lists, maps and objects) are matched; a sensitive number or bool, or a secret used as an object key, isn't.
Index ¶
- Constants
- func Marker(name string) string
- func Wrap(inner engine.Reporter, r *Redactor) engine.Reporter
- type Redactor
- type Reporter
- func (s *Reporter) ComponentVars(componentKey string, vars map[string]cty.Value)
- func (s *Reporter) NodeCompleted(nodeID string, outputs map[string]cty.Value, d time.Duration)
- func (s *Reporter) NodeFailed(nodeID string, err error)
- func (s *Reporter) NodeStarted(nodeID string)
- func (s *Reporter) NodeUndo(nodeID string, undo provider.Invocation)
- func (s *Reporter) RunCompleted(summary engine.RunSummary)
- func (s *Reporter) RunStarted(scenario string)
Constants ¶
const MinLength = 4
MinLength is the shortest sensitive string New accepts. Every occurrence of the value is replaced, so a secret such as "us" would turn up in unrelated outputs and bury the record in markers.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Redactor ¶
type Redactor struct {
// contains filtered or unexported fields
}
Redactor swaps sensitive strings for markers and back. A nil *Redactor, and one with nothing to redact, leaves values alone.
func New ¶
New builds a Redactor for the variables in vars that names marks sensitive. It refuses a sensitive string shorter than MinLength.
type Reporter ¶
Reporter redacts every value and error before passing the event on to Inner, so neither the terminal nor the run record sees a sensitive value. It forwards the optional engine.UndoReporter and engine.ComponentVarsReporter events when Inner takes them.
func (*Reporter) ComponentVars ¶
ComponentVars implements engine.ComponentVarsReporter.
func (*Reporter) NodeCompleted ¶
NodeCompleted implements engine.Reporter.
func (*Reporter) NodeFailed ¶
NodeFailed implements engine.Reporter.
func (*Reporter) NodeStarted ¶
NodeStarted implements engine.Reporter.
func (*Reporter) NodeUndo ¶
func (s *Reporter) NodeUndo(nodeID string, undo provider.Invocation)
NodeUndo implements engine.UndoReporter.
func (*Reporter) RunCompleted ¶
func (s *Reporter) RunCompleted(summary engine.RunSummary)
RunCompleted implements engine.Reporter.
func (*Reporter) RunStarted ¶
RunStarted implements engine.Reporter.
Source Files