credentials

package
v0.2.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 12, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	FormatVersion  uint16 = 1
	Algorithm             = "xchacha20-poly1305"
	StatusActive          = "active"
	StatusRevoked         = "revoked"
	VersionCurrent        = "current"
	VersionPinned         = "pinned"
)
View Source 
const (
	AuthorityPassphraseMinimumBytes = 12
	AuthorityPassphraseMaximumBytes = 1024
)

Variables

View Source 
var (
	ErrNotFound  = errors.New("credential record not found")
	ErrConflict  = errors.New("credential state conflict")
	ErrRevoked   = errors.New("credential is revoked")
	ErrAmbiguous = errors.New("credential binding is ambiguous")
)
View Source 
var ErrPassphraseAuthentication = errors.New("encrypted key-encryption key credential could not be unlocked")

Functions

func CreateHostKey 

func CreateHostKey(path, id string) error

CreateHostKey creates the explicitly weaker host-file custody fallback. The file must be kept outside authority database backups and replaced by a systemd encrypted service credential for production deployments.

func CreatePassphraseKey added in v0.1.13 

func CreatePassphraseKey(path, id string, passphrase []byte) error

CreatePassphraseKey creates a random KEK and persists only an Argon2id-derived-key encrypted envelope. The passphrase and plaintext KEK are never written to disk.

func Decrypt 

func Decrypt(ctx context.Context, custodian KeyCustodian, storeID, kind string, encrypted EncryptedSecretVersion, use func([]byte) error) error

func InspectPassphraseCredential added in v0.1.13 

func InspectPassphraseCredential(path string) error

InspectPassphraseCredential validates the strict encrypted envelope without asking for or decrypting with the passphrase.

func IsPassphraseAuthentication added in v0.1.20 

func IsPassphraseAuthentication(err error) bool

func ValidateBinding 

func ValidateBinding(binding CredentialBinding, deploymentID string) error

func ValidateEncryptedVersion 

func ValidateEncryptedVersion(value EncryptedSecretVersion) error

func ValidateIdentifier 

func ValidateIdentifier(value string) bool

func ValidateRecord 

func ValidateRecord(record SecretRecord) error

Types

type Authority 

type Authority struct {
	// contains filtered or unexported fields
}

func NewAuthority 

func NewAuthority(repository Repository, custodian KeyCustodian) *Authority

func (*Authority) Backup 

func (a *Authority) Backup(ctx context.Context, path string) error

func (*Authority) Bind 

func (a *Authority) Bind(ctx context.Context, binding CredentialBinding) error

func (*Authority) Close 

func (a *Authority) Close() error

func (*Authority) Counts added in v0.1.26 

func (a *Authority) Counts(ctx context.Context) (SecretCounts, error)

func (*Authority) Create 

func (a *Authority) Create(ctx context.Context, reference, kind, createdBy string, plaintext []byte) (SecretRecord, error)

func (*Authority) History added in v0.1.4 

func (a *Authority) History(ctx context.Context, recordID string, limit int) ([]SecretVersionMetadata, error)

func (*Authority) List added in v0.1.1 

func (a *Authority) List(ctx context.Context, query string, limit int) ([]SecretRecord, error)

func (*Authority) Metadata 

func (a *Authority) Metadata(ctx context.Context, recordID string) (SecretRecord, error)

func (*Authority) ReadValue added in v0.1.26 

func (a *Authority) ReadValue(ctx context.Context, reference string, fn func(SecretRecord, []byte) error) error

func (*Authority) Revoke 

func (a *Authority) Revoke(ctx context.Context, recordID string, version uint64, reason string) error

func (*Authority) Rotate 

func (a *Authority) Rotate(ctx context.Context, recordID string, plaintext []byte) (SecretRecord, error)

func (*Authority) Use 

func (a *Authority) Use(ctx context.Context, key CredentialBindingKey, destination string, fn func([]byte) error) error

func (*Authority) UseResolved 

func (a *Authority) UseResolved(ctx context.Context, key CredentialBindingKey, destination string, fn func(ResolvedSecret, []byte) error) error

UseResolved copies and resolves authority state in a short repository read, closes that read transaction, and only then decrypts and invokes fn.

type CredentialBinding 

type CredentialBinding struct {
	Key             CredentialBindingKey `json:"key"`
	SecretRecord    string               `json:"secret_record"`
	VersionPolicy   string               `json:"version_policy"`
	PinnedVersion   uint64               `json:"pinned_version,omitempty"`
	Mode            string               `json:"mode"`
	Destinations    []string             `json:"destinations"`
	Enabled         bool                 `json:"enabled"`
	BindingRevision uint64               `json:"binding_revision"`
}

type CredentialBindingKey 

type CredentialBindingKey struct {
	AgentID      string `json:"agent_id"`
	StanzaID     string `json:"stanza_id"`
	DeploymentID string `json:"deployment_id"`
	Scope        string `json:"scope"`
}

func (CredentialBindingKey) Validate 

func (key CredentialBindingKey) Validate() error

type EncryptedSecretVersion 

type EncryptedSecretVersion struct {
	RecordID       string    `json:"record_id"`
	Version        uint64    `json:"version"`
	FormatVersion  uint16    `json:"format_version"`
	Algorithm      string    `json:"algorithm"`
	KEKID          string    `json:"kek_id"`
	KEKVersion     uint64    `json:"kek_version"`
	RecordNonce    []byte    `json:"record_nonce"`
	Ciphertext     []byte    `json:"ciphertext"`
	WrapNonce      []byte    `json:"wrap_nonce"`
	WrappedDEK     []byte    `json:"wrapped_dek"`
	CiphertextHash string    `json:"ciphertext_hash"`
	CreatedAt      time.Time `json:"created_at"`
}

func Encrypt 

func Encrypt(ctx context.Context, custodian KeyCustodian, storeID, recordID string, version uint64, kind string, plaintext []byte) (EncryptedSecretVersion, error)

type FileCustodian 

type FileCustodian struct {
	// contains filtered or unexported fields
}

func LoadFileCustodian 

func LoadFileCustodian(path string) (*FileCustodian, error)

func LoadPassphraseCustodian added in v0.1.13 

func LoadPassphraseCustodian(path string, passphrase []byte) (*FileCustodian, error)

LoadPassphraseCustodian unlocks an encrypted KEK envelope without retaining the passphrase. Authentication failures deliberately return one generic error that reveals no plaintext or envelope details.

func (*FileCustodian) ActiveKEK 

func (c *FileCustodian) ActiveKEK(ctx context.Context, fn func(KEKMetadata, []byte) error) error

func (*FileCustodian) Close 

func (c *FileCustodian) Close()

func (*FileCustodian) KEK 

func (c *FileCustodian) KEK(ctx context.Context, id string, version uint64, fn func([]byte) error) error

type KEKMetadata 

type KEKMetadata struct {
	ID      string `json:"id"`
	Version uint64 `json:"version"`
}

type KeyCustodian 

type KeyCustodian interface {
	ActiveKEK(context.Context, func(KEKMetadata, []byte) error) error
	KEK(context.Context, string, uint64, func([]byte) error) error
}

KeyCustodian lends a private copy of key material only for the duration of fn. Implementations must not log the key or expose printable key handles.

type Repository 

type Repository interface {
	StoreID() string
	DeploymentID() string
	Create(context.Context, SecretRecord, EncryptedSecretVersion) error
	AddVersion(context.Context, EncryptedSecretVersion) error
	Metadata(context.Context, string) (SecretRecord, error)
	CurrentByReference(context.Context, string) (SecretRecord, EncryptedSecretVersion, error)
	List(context.Context, string, int) ([]SecretRecord, error)
	Counts(context.Context) (SecretCounts, error)
	Version(context.Context, string, uint64) (EncryptedSecretVersion, error)
	History(context.Context, string, int) ([]SecretVersionMetadata, error)
	Bind(context.Context, CredentialBinding) error
	Resolve(context.Context, CredentialBindingKey) (ResolvedSecret, error)
	Revoke(context.Context, string, uint64, string, time.Time) error
	Backup(context.Context, string) error
	Close() error
}

type ResolvedSecret 

type ResolvedSecret struct {
	Record  SecretRecord
	Version EncryptedSecretVersion
	Binding CredentialBinding
}

type SecretCounts added in v0.1.26 

type SecretCounts struct {
	Total   int `json:"total"`
	Active  int `json:"active"`
	Revoked int `json:"revoked"`
}

type SecretRecord 

type SecretRecord struct {
	ID             string    `json:"id"`
	Reference      string    `json:"reference"`
	Kind           string    `json:"kind"`
	Status         string    `json:"status"`
	CurrentVersion uint64    `json:"current_version"`
	CreatedAt      time.Time `json:"created_at"`
	CreatedBy      string    `json:"created_by"`
	RevokedAt      time.Time `json:"revoked_at,omitempty"`
	Revocation     string    `json:"revocation_reason,omitempty"`
}

type SecretVersionMetadata added in v0.1.4 

type SecretVersionMetadata struct {
	RecordID       string    `json:"record_id"`
	Version        uint64    `json:"version"`
	FormatVersion  uint16    `json:"format_version"`
	Algorithm      string    `json:"algorithm"`
	KEKVersion     uint64    `json:"kek_version"`
	CreatedAt      time.Time `json:"created_at"`
	CiphertextHash string    `json:"ciphertext_hash"`
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.