Documentation
¶
Overview ¶
Package credential manages the long-lived secrets a git automation service keeps on behalf of its users: platform access tokens, SSH key pairs, and per-repository deploy keys.
Three cooperating pieces:
- Manager (manager.go) stores encrypted credentials (AES-GCM) and hands back plaintext for a single operation. Keys are derived from a master secret; stored ciphertext never contains the raw token.
- SSHKey (sshkey.go) builds git-ready SSH authentication from a private key, and assembles the ssh command line for the native git backend (including optional host-key fingerprint pinning).
- DeployKey (deploykey.go) generates ed25519 deploy-key pairs whose public half is registered on the target platform via provider.DeploymentKeyManager; the private half stays in the manager's encrypted store.
The package deliberately contains no platform API calls: it is the storage and key-material layer beneath the provider and gitbackend packages.
Index ¶
- func FingerprintSHA256(authorizedKey string) string
- func MatchFingerprint(authorizedKey, want string) bool
- type CryptoManager
- type DeployKey
- type Manager
- type SSHKeyHelper
- func (h *SSHKeyHelper) AddHostKey(host string, key ssh.PublicKey)
- func (h *SSHKeyHelper) BuildSSHCommand(keyPath string) string
- func (h *SSHKeyHelper) BuildSSHCommandInsecure(keyPath string) string
- func (h *SSHKeyHelper) CleanupTempFile(filePath string)
- func (h *SSHKeyHelper) CreateTempKeyFile(keyContent string) (string, error)
- func (h *SSHKeyHelper) DetectKeyType(privateKey, passphrase string) string
- func (h *SSHKeyHelper) ExtractPublicKeyFromPrivateKey(privateKey, passphrase string) (string, error)
- func (h *SSHKeyHelper) GetHostKeyCallback() ssh.HostKeyCallback
- func (h *SSHKeyHelper) ProcessPrivateKey(privateKey, passphrase string) (string, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FingerprintSHA256 ¶
FingerprintSHA256 计算 authorized_keys 公钥的 SHA256 指纹。 返回 "SHA256:<base64>"(openssh -lf 格式,无填充)。
func MatchFingerprint ¶
MatchFingerprint 判断 authorized_keys 公钥是否匹配期望指纹。 期望值支持 "SHA256:xxx" 或裸 base64(自动补前缀)。
Types ¶
type CryptoManager ¶
type CryptoManager struct {
// contains filtered or unexported fields
}
CryptoManager provides AES-256-GCM encryption/decryption with an injectable key source. Use NewCryptoManager or NewCryptoManagerFromKey to create an instance. The zero-value CryptoManager is not usable.
The key material (passphrase) is stored in memory and a fresh argon2id key derivation is performed per encryption using a random salt, so identical plaintexts encrypt to different ciphertexts.
func NewCryptoManager ¶
func NewCryptoManager() (*CryptoManager, error)
NewCryptoManager creates a CryptoManager that reads the encryption key from the ENCRYPTION_KEY environment variable. The key may be a passphrase of any length; it is stretched to a 32-byte AES-256 key per ciphertext via argon2id with a random salt.
Returns an error if ENCRYPTION_KEY is unset or empty.
func NewCryptoManagerFromKey ¶
func NewCryptoManagerFromKey(key string) *CryptoManager
NewCryptoManagerFromKey creates a CryptoManager with an explicit key string. The key may be a passphrase of any length (including short, low-entropy passphrases); argon2id makes brute-forcing such passphrases expensive.
func (*CryptoManager) Decrypt ¶
func (cm *CryptoManager) Decrypt(cryptoText string) (string, error)
Decrypt decrypts ciphertext produced by Encrypt. Returns empty string for empty input. Only the current ciphertext version is supported; ciphertexts encrypted by older builds (single-iteration SHA-256 KDF) will fail to decrypt and must be re-encrypted with the current key.
func (*CryptoManager) Encrypt ¶
func (cm *CryptoManager) Encrypt(plaintext string) (string, error)
Encrypt encrypts plaintext using AES-256-GCM. Returns empty string for empty input. The output is base64url(version || salt || nonce || ciphertext).
func (*CryptoManager) RotateKey ¶
func (cm *CryptoManager) RotateKey(newKey string)
RotateKey replaces the current key material. Subsequent Encrypt calls use the new key; Decrypt calls for data encrypted with the old key will fail.
type DeployKey ¶
type DeployKey struct {
// PrivateKeyPEM PKCS#8 PEM 私钥内容
PrivateKeyPEM string
// PublicKeyAuthorized authorized_keys 一行公钥(可粘贴到目标平台)
PublicKeyAuthorized string
// Fingerprint SHA256 公钥指纹(openssh 格式),便于核对
Fingerprint string
}
DeployKey 镜像/备份专用部署密钥对。 私钥存 DB/密钥库,公钥交给目标平台做 deploy key(只读或只写)。
func GenerateEd25519DeployKey ¶
GenerateEd25519DeployKey 生成一对 Ed25519 部署密钥。 采用 Ed25519:短、快、无弱参数,是当前 SSH 部署密钥推荐算法。
type Manager ¶
type Manager struct{}
Manager provides helpers for constructing authenticated git remote URLs and SSH commands. It is stateless and safe for concurrent use.
func (*Manager) BuildAuthURL ¶
BuildAuthURL embeds credentials into a git remote URL. Supported authType values: "http_basic" (user:pass), "http_token" (token only), "ssh" (passthrough).
Credentials are interpolated via net/url so that characters with special meaning in the userinfo component (@, :, /, #, ?, etc.) are percent-encoded. Interpolating them raw produced malformed or ambiguous URLs and could leak the secret into the wrong URL component.
func (*Manager) BuildSSHCommand ¶
BuildSSHCommand returns a GIT_SSH_COMMAND value that uses the given key file with strict host key checking enabled (the secure default). Use BuildSSHCommandInsecure for CI environments where known_hosts is unavailable.
func (*Manager) BuildSSHCommandInsecure ¶
BuildSSHCommandInsecure returns a GIT_SSH_COMMAND value with host key checking disabled. Only suitable for CI/server environments where known_hosts cannot be populated. Do NOT use in production.
type SSHKeyHelper ¶
type SSHKeyHelper struct {
// contains filtered or unexported fields
}
SSHKeyHelper provides SSH key processing, temp file management, and host key verification for git operations.
An SSHKeyHelper is safe for concurrent use: the host-key store is guarded by a mutex so multiple SSH connections can share one helper.
func NewSSHKeyHelper ¶
func NewSSHKeyHelper() *SSHKeyHelper
NewSSHKeyHelper creates a new SSHKeyHelper instance.
func (*SSHKeyHelper) AddHostKey ¶
func (h *SSHKeyHelper) AddHostKey(host string, key ssh.PublicKey)
AddHostKey registers a known public key for a host.
func (*SSHKeyHelper) BuildSSHCommand ¶
func (h *SSHKeyHelper) BuildSSHCommand(keyPath string) string
BuildSSHCommand returns a GIT_SSH_COMMAND value that uses the given key file with strict host key checking enabled (the secure default). Use BuildSSHCommandInsecure for CI environments where known_hosts is unavailable.
func (*SSHKeyHelper) BuildSSHCommandInsecure ¶
func (h *SSHKeyHelper) BuildSSHCommandInsecure(keyPath string) string
BuildSSHCommandInsecure returns a GIT_SSH_COMMAND value with host key checking disabled. Only suitable for CI/server environments where known_hosts cannot be populated. Do NOT use in production.
func (*SSHKeyHelper) CleanupTempFile ¶
func (h *SSHKeyHelper) CleanupTempFile(filePath string)
CleanupTempFile removes a temporary key file. Safe to call with empty string.
func (*SSHKeyHelper) CreateTempKeyFile ¶
func (h *SSHKeyHelper) CreateTempKeyFile(keyContent string) (string, error)
CreateTempKeyFile writes keyContent to a temporary file with 0600 permissions. Returns the file path. Caller must defer CleanupTempFile(path).
func (*SSHKeyHelper) DetectKeyType ¶
func (h *SSHKeyHelper) DetectKeyType(privateKey, passphrase string) string
DetectKeyType returns the algorithm of the private key: rsa, ecdsa, ed25519, dsa, or unknown.
func (*SSHKeyHelper) ExtractPublicKeyFromPrivateKey ¶
func (h *SSHKeyHelper) ExtractPublicKeyFromPrivateKey(privateKey, passphrase string) (string, error)
ExtractPublicKeyFromPrivateKey extracts the public key in authorized_keys format from a private key string.
func (*SSHKeyHelper) GetHostKeyCallback ¶
func (h *SSHKeyHelper) GetHostKeyCallback() ssh.HostKeyCallback
GetHostKeyCallback returns an ssh.HostKeyCallback that accepts new hosts (trust-on-first-use) and verifies returning hosts against stored keys.
func (*SSHKeyHelper) ProcessPrivateKey ¶
func (h *SSHKeyHelper) ProcessPrivateKey(privateKey, passphrase string) (string, error)
ProcessPrivateKey normalizes a private key string and, if a passphrase is provided, decrypts it and re-encodes as unencrypted PEM. The returned content is ready to be written to a temp file or passed to ssh.ParsePrivateKey.
Source Files