keyringstore

package

v0.10.0 Latest Latest Go to latest Published: Aug 24, 2026 License: MIT Imports: 17 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/talkincode/sshx

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func Accounts(service string) ([]string, error)
func Backend() (string, error)
func CanReveal() bool
func Delete(service, account string) error
func Get(service, account string) (string, error)
func Set(service, account, password string) error
type Status
- func Inspect() Status

Constants ¶

View Source

const (
	// EnvBackend selects the secret persistence backend. Unset defaults to the
	// OS keyring. There is no silent fallback: an explicit local-vault choice
	// never degrades to the keyring, and a keyring failure never creates a vault.
	EnvBackend = "SSHX_SECRET_BACKEND"
	// EnvVaultPassphrase unlocks the local vault for unattended use.
	// #nosec G101 -- environment variable name, not a credential.
	EnvVaultPassphrase = "SSHX_VAULT_PASSPHRASE" //nolint:gosec
	// EnvVaultKeyFile is a 0600 file whose contents are the vault passphrase.
	// When set, it takes precedence over EnvVaultPassphrase.
	EnvVaultKeyFile = "SSHX_VAULT_KEY_FILE"

	BackendKeyring = "keyring"
	BackendVault   = "local-vault"

	UnlockNone    = "none"
	UnlockEnv     = "env"
	UnlockKeyFile = "keyfile"
	UnlockMissing = "missing"
)

Variables ¶

View Source

var ErrListUnsupported = errors.New("secret backend cannot list keys")

ErrListUnsupported reports that the selected backend cannot enumerate keys.

View Source

var ErrNotFound = errors.New("secret not found")

ErrNotFound reports that a key has no value in the selected backend.

View Source

var ErrRevealDenied = errors.New("local vault is write-only")

ErrRevealDenied reports that the selected backend never emits secret values on the CLI display path. Internal Get still works for stdin injection.

Functions ¶

func Accounts ¶ added in v0.10.0

func Accounts(service string) ([]string, error)

Accounts lists account names stored under service. The OS keyring backend cannot enumerate keys and returns ErrListUnsupported.

func Backend ¶ added in v0.10.0

func Backend() (string, error)

Backend returns the canonical backend name or an error for unknown values.

func CanReveal ¶ added in v0.10.0

func CanReveal() bool

CanReveal reports whether CLI --password-get may emit a secret value. The local vault is write-only; the OS keyring (and its E2E stand-in) may emit on a pipe for human capture.

func Delete ¶

func Delete(service, account string) error

Delete removes a secret from the selected backend.

func Get ¶

func Get(service, account string) (string, error)

Get returns a secret from the selected backend. Callers must not print the value on an Agent-facing surface when CanReveal is false.

func Set ¶

func Set(service, account, password string) error

Set stores a secret in the selected backend.

Types ¶

type Status ¶ added in v0.10.0

type Status struct {
	Backend string
	Unlock  string
}

Status is the non-secret view of the configured backend. Unlock names the configured factor, not whether a passphrase is currently valid.

func Inspect ¶ added in v0.10.0

func Inspect() Status

Inspect reports the configured backend without reading secrets.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL