Documentation
¶
Overview ¶
Package cli - `whisper encrypt` / `whisper decrypt`: hybrid public-key encryption TO a Whisper agent identity, the mirror image of `whisper sign`.
Two-tier, per the Whisper integration standard: - `whisper encrypt --to <agent-fqdn> <file>` (KEYLESS) encrypts a file (or stdin) FOR an agent using that agent's DNSSEC-published public key. No API key is needed: the recipient's key is discovered from the OPENPGPKEY (RFC 7929) record, DNSSEC-validated from the IANA root IN-PROCESS, so anyone can encrypt to an agent and trust comes ONLY from the DNSSEC chain. - `whisper decrypt <file.wenc>` (KEYED) the agent, authenticated, decrypts. It fetches its own per-agent private key from the control plane (or you supply it with --key for the sole-control / agent-held case) and opens the message.
Crypto: HPKE (RFC 9180) base mode with DHKEM(P-256, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM, over the SAME per-agent EC P-256 identity key that the TLSA/SMIMEA/OPENPGPKEY records pin. The implementation is the vetted github.com/cloudflare/circl/hpke; we never hand-roll the KEM/DEM.
Package cli is the scriptable Cobra surface of whisper-cli v2. Every subcommand is a thin shell over internal/client (DRY): build a Cypher op, decode the {ok,status, result} envelope, and render EITHER a human table (default) OR the verbatim envelope (--json). A failing op (ok:false) exits non-zero so scripts can branch on it.
The full-screen Bubble Tea TUI is a SEPARATE surface; running `whisper` with no subcommand on a TTY will launch it. This package is the automation layer: it never needs a TTY and never blocks on one.
Package cli - `whisper sign`: S/MIME / CMS signing anchored to your Whisper identity.
Two-tier, per the Whisper integration standard: - `whisper sign file <path>` (KEYED) issues your per-agent emailProtection cert from the control plane and produces a detached S/MIME (CMS/PKCS#7) signature you can hand to anyone. - `whisper sign verify …` (KEYLESS) checks a signature against your Whisper identity with NO API key: it validates the CMS signature AND matches the signer key to the DNSSEC-signed SMIMEA (RFC 8162) record, validated from the IANA root IN-PROCESS. Trust is DANE-anchored (the SMIMEA pins the signer's exact key), NOT a public S/MIME CA.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Version = versionFallback
Functions ¶
func Execute ¶
func Execute() int
Execute runs the root command and maps the result to a process exit code:
0 success 1 a control-plane / runtime failure (ok:false, transport, bad args we surfaced) 2 a usage error (unknown flag/subcommand - Cobra's own) 3+ a VERDICT a command was asked to gate on (see alertsExitGate): the command ran perfectly and the answer is the exit code. Kept distinct from 1 so a script can tell "the gate tripped" from "we could not tell", which are different decisions.
func NewRootCommand ¶
NewRootCommand builds the `whisper` command tree.
Types ¶
This section is empty.
Source Files
¶
- agent_resolve.go
- agents.go
- alerts.go
- alerts_watch.go
- browser.go
- connect.go
- connect_core.go
- daemon.go
- daemon_unix.go
- device.go
- domain.go
- encrypt.go
- enroll.go
- ensure.go
- graph.go
- guided.go
- init.go
- ip.go
- ledger.go
- login.go
- logs.go
- mcp.go
- mcp_graph.go
- mcp_reference.go
- output.go
- panel.go
- panel_show.go
- panel_show_other.go
- panel_sysproxy_deadman.go
- panel_sysproxy_other.go
- panel_sysproxy_preflight.go
- panel_sysproxy_record.go
- panel_view.go
- parentcmd.go
- policy.go
- query.go
- resolver.go
- root.go
- run.go
- session_registry.go
- sign.go
- status.go
- tier2_envelope.go
- token.go
- verify.go
- verify_signature.go
- verify_trustless.go
- whale.go
- whale_acl.go
- whale_direct_paths.go
- whale_dns.go
- whale_dns_record.go
- whale_exitnode.go
- whale_funnel.go
- whale_ip.go
- whale_migrate.go
- whale_netcheck.go
- whale_path_report.go
- whale_ping.go
- whale_route.go
- whale_serve.go
- whale_snapshot.go
- whale_ssh.go
- whale_status.go
- whale_syspolicy.go
- whale_syspolicy_other.go
- whale_v4.go
- whale_v4_probe.go
- whale_whois.go
- whoami.go