Documentation
¶
Overview ¶
Package envelope seals a backup generation to operator-held age recipients and names the keys it needs (ADR-0204 Decisions 1-3, 5): the box writes what it cannot read.
Index ¶
- func Fingerprint(b []byte) string
- func LoadMaster(cfg config.Config, log *slog.Logger) ([]byte, error)
- func Opener(ids []age.Identity) backup.Opener
- func ParseIdentities(name string, r io.Reader) ([]age.Identity, error)
- func ReadIdentities(paths []string) ([]age.Identity, error)
- func ReadSecretsKey(cfg config.Config) ([]byte, error)
- type Config
- type Sealer
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Fingerprint ¶
Fingerprint is the first 16 lowercase hex of SHA-256(label ‖ 0x00 ‖ b) (Decision 3).
func LoadMaster ¶
LoadMaster migrates a working-directory master and loads the node master secret from its place, gateway on or off (Decision 7). The daemon and funcd upgrade (ADR-0207) load it alike.
func Opener ¶
Opener binds the operator's identities (Decision 5). For a manifest naming recipients, the Unseal decrypts with the identities among them, and no match is fault.Invalid naming both fingerprint sets. A manifest naming none reads the bytes as is. Either way a store file whose seal disagrees with its manifest is fault.Invalid.
func ParseIdentities ¶
ParseIdentities parses the identities of r, named name in errors, with ReadIdentities' rules: a Restore reads its owner's identity from a Secret key (ADR-0222 Decision 6).
func ReadIdentities ¶
ReadIdentities reads the operator's age identity files (Decision 5): X25519 or hybrid identities only; another type, or a file that does not parse (one encrypted with age -p), is fault.Invalid naming the file.
Types ¶
type Config ¶
type Config struct {
Recipients []string
None, NoSecrets bool
SecretsKey, Master []byte
KeyPrefix string
Logger *slog.Logger
}
Config is backup.encryption (Decision 2). Recipients are the paths of age recipients files; SecretsKey is secrets.encryptionKeyFile's bytes (nil ⇒ none); Master is the node master secret. NoSecrets (ADR-0209), for a store holding no Secret, skips only the secrets-key rule and the secrets-key warning. KeyPrefix names the config keys in errors ("" ⇒ "backup.", as backup.Config); Logger takes the warnings and the start line (nil ⇒ slog.Default()).
type Sealer ¶
type Sealer struct {
// contains filtered or unexported fields
}
Sealer seals the store files of a run to the configured recipients and carries the manifest's key records.
func FromConfig ¶
FromConfig applies Decision 2's start rules when backup.target is set: a violation is refused, and the keys' fingerprints are logged. nil without a target.
func New ¶
New checks cfg against Decision 2; a violation is fault.Invalid naming the key and file. It logs the keys' fingerprints, never their bytes, and the warnings of an unsealed or secrets-key-less configuration.
func Parse ¶
Parse is the Sealer of inline recipients (ADR-0222 Decision 6): Decision 2's recipient rules on age1… and age1pq1… strings, with NoSecrets, and no none. It logs nothing; a violation is fault.Invalid naming the recipient.
Source Files