keyring

Documentation

Overview

Package keyring seals secret bytes before they are persisted — per-session holder private keys, per-principal root signing keys, and vendor credentials — so raw secrets never land in the database. It is the port through which the broker turns an in-memory ed25519 key into opaque bytes for the Store and back again. The default implementation is AES-256-GCM under a master key; the same Sealer interface is satisfied by a KMS-backed implementation later, with zero call-site changes.

The master key is loaded from DELEGENT_MASTER_KEY (base64 of 32 bytes). For local development, an unset key falls back to a fixed dev key with a loud warning — never rely on that in production, where the master key belongs in KMS or a secret manager.

Index

• func IsDev(key []byte) bool
• func MasterKey() ([]byte, error)
• type Sealer
  • func FromEnv() (Sealer, error)
  • func NewAESSealer(key []byte) (Sealer, error)

Functions

func IsDev

func IsDev(key []byte) bool

IsDev reports whether key is the built-in dev fallback. The gateway refuses to run with it while agent-key auth is on — a public master key would let anyone unseal every stored credential and session key.

func MasterKey

func MasterKey() ([]byte, error)

MasterKey returns the 32-byte master key from DELEGENT_MASTER_KEY (base64), or the dev key (with a warning) when unset. This one stable key both seals session keys and derives the root signing key, so a restart can unseal and verify what a prior run wrote.

Types

type Sealer

type Sealer interface {
	Seal(plaintext []byte) ([]byte, error)
	Unseal(sealed []byte) ([]byte, error)
}

Sealer seals and unseals secret bytes. Seal output is opaque and self-describing (it carries its own nonce); Unseal fails closed on any tampering.

func FromEnv

func FromEnv() (Sealer, error)

FromEnv builds a Sealer from the master key.

func NewAESSealer

func NewAESSealer(key []byte) (Sealer, error)

NewAESSealer builds a Sealer from a 32-byte key.