Documentation
¶
Overview ¶
Package sops is the provider for the identities that decrypt sops-managed secrets: age identities and PGP private keys.
Neither has an issuer to ask or a revocation endpoint. An age identity is valid for as long as its checksum holds, which patty verifies offline, and a PGP key for as long as its packets parse. What makes such a leak matter is what the key decrypts, so the provider also watches every scanned object for sops material (.sops.yaml rules and encrypted files) and reports, per identity, the files that list its public key or fingerprint as a recipient. Everything that was encrypted to a leaked recipient stays readable to whoever holds the key; rotation only protects what is encrypted from now on.
Index ¶
- Constants
- func Fingerprint(key *packet.PublicKey) string
- func Recipient(identity string) (string, bool)
- type Provider
- func (*Provider) Find(content []byte) []detect.Token
- func (*Provider) Identifiers(tok detect.Token) []string
- func (*Provider) Kinds() []detect.KindInfo
- func (*Provider) LocalSources() detect.LocalSources
- func (*Provider) Name() string
- func (*Provider) Observe(content []byte) []detect.Sighting
- func (*Provider) Verify(_ context.Context, tok detect.Token) detect.Verification
Constants ¶
const ( // KindAge is an age X25519 identity (AGE-SECRET-KEY-1…), the private // half of an age1… recipient. KindAge detect.Kind = "age-identity" // KindPGP is an armored PGP private key block, named by the fingerprint // of its primary key. KindPGP detect.Kind = "pgp-private-key" )
Variables ¶
This section is empty.
Functions ¶
func Fingerprint ¶
Fingerprint renders a key's fingerprint the way gpg and sops write it: upper-case hex, forty characters for a version 4 key.
Types ¶
type Provider ¶
type Provider struct{}
Provider implements detect.Provider and detect.Correlator for sops.
func (*Provider) Find ¶
Find implements detect.Provider: one substring pass for the age prefix and one for the PGP armor header.
func (*Provider) Identifiers ¶
Identifiers implements detect.Correlator: the public key of an age identity, the fingerprint of a PGP key.
func (*Provider) Kinds ¶
Kinds implements detect.Provider. Neither kind can be revoked: an identity is not issued by anyone, so the advice is the rotation procedure.
func (*Provider) LocalSources ¶
func (*Provider) LocalSources() detect.LocalSources
LocalSources implements detect.Provider: where sops reads age identities from. PGP keys live in the GnuPG keyring, which is not a text file; `gpg --list-secret-keys` shows the fingerprints kept there.
func (*Provider) Observe ¶
Observe implements detect.Correlator. It returns the recipients and PGP fingerprints an object lists when the object is sops material: the creation rules of a .sops.yaml, or an encrypted file, recognisable by its ENC[…] values or its sops metadata block. Anything else costs a few substring searches and returns nil; the identity file itself, which names its own public key in a comment, is not sops material.
Source Files