secrets

Documentation

Overview

Package secrets resolves Stage 4 host-local env and envfile providers while exposing only opaque keyed versions for realization identity and evidence.

Index

• Variables
• func EnvfileVariable(ref domain.SecretRef) string
• func LoadHMACKey(path string) ([]byte, error)
• func LoadOrCreateHMACKey(path string) ([]byte, error)
• func ValidateEnvfile(path string, forbiddenRoots []string) error
• type EnvfileRequirement
• type EnvfileSkeleton
  • func EnvfileSkeletons(target domain.Target, binding domain.AgentTargetBinding) ([]EnvfileSkeleton, error)
• type LookupEnv
• type Resolver
  • func NewResolver(providers map[string]domain.SecretProvider, hmacKey []byte, lookup LookupEnv) (*Resolver, error)
  • func NewTargetResolver(target string, providers map[string]domain.SecretProvider, hmacKey []byte, ...) (*Resolver, error)
  • func (r *Resolver) Close()
  • func (r *Resolver) Resolve(ctx context.Context, providerAlias string, ref domain.SecretRef) (Value, error)
• type Value

Variables

var (
	ErrUnavailable     = errors.New("secrets: value unavailable")
	ErrUnsafeProvider  = errors.New("secrets: unsafe provider configuration")
	ErrUnknownProvider = errors.New("secrets: unknown provider")
)

Functions

func EnvfileVariable

func EnvfileVariable(ref domain.SecretRef) string

EnvfileVariable is the standard, reversible local envfile encoding for a provider-neutral namespace/key reference. Exact host aliases may override it for legacy names.

func LoadHMACKey

func LoadHMACKey(path string) ([]byte, error)

LoadHMACKey reads an existing protected target key without creating state. Dry-run reconciliation uses it so planning remains mutation-free.

func LoadOrCreateHMACKey

func LoadOrCreateHMACKey(path string) ([]byte, error)

LoadOrCreateHMACKey loads an owner-only 32-byte key or atomically creates one. Existing symlinks, wrong modes, and wrong lengths fail closed.

func ValidateEnvfile

func ValidateEnvfile(path string, forbiddenRoots []string) error

ValidateEnvfile proves an absolute ordinary owner-only file has no symlink in its existing path and does not live beneath any forbidden root.

Types

type EnvfileRequirement

type EnvfileRequirement struct {
	Reference string   `json:"reference"`
	Variable  string   `json:"variable"`
	Locations []string `json:"locations"`
}

type EnvfileSkeleton

type EnvfileSkeleton struct {
	Provider     string               `json:"provider"`
	Path         string               `json:"path"`
	Content      []byte               `json:"content"`
	Requirements []EnvfileRequirement `json:"requirements"`
}

func EnvfileSkeletons

func EnvfileSkeletons(target domain.Target, binding domain.AgentTargetBinding) ([]EnvfileSkeleton, error)

EnvfileSkeletons derives value-free dotenv files from the target's typed secret inputs. It never reads provider files or secret values. One skeleton is returned for each selected envfile provider, sorted by provider alias.

type LookupEnv

type LookupEnv func(string) (string, bool)

type Resolver

type Resolver struct {
	// contains filtered or unexported fields
}

func NewResolver

func NewResolver(providers map[string]domain.SecretProvider, hmacKey []byte, lookup LookupEnv) (*Resolver, error)

func NewTargetResolver

func NewTargetResolver(target string, providers map[string]domain.SecretProvider, hmacKey []byte, lookup LookupEnv) (*Resolver, error)

NewTargetResolver binds automatic env naming and keyed versions to one canonical target/secret scope. Stage 4 reconciliation always uses this constructor; NewResolver remains for callers that supply explicit aliases.

func (*Resolver) Close

func (r *Resolver) Close()

Close clears the copied HMAC key as soon as a bounded resolution phase is complete instead of retaining protected key material until garbage collection.

func (*Resolver) Resolve

func (r *Resolver) Resolve(ctx context.Context, providerAlias string, ref domain.SecretRef) (Value, error)

Resolve obtains plaintext just in time and derives a domain-separated HMAC version. Plaintext is returned to the caller but is never persisted here.

type Value

type Value struct {
	Plaintext []byte
	Version   string
}