encrypt

Documentation

Overview

Package encrypt provides full-package encryption for .adfir packages (plan §19). A sealed package directory is archived (tar) and encrypted to a single .adfir.enc file so logical paths (which can leak confidential project/repo names) never appear in the clear.

Crypto is standard library only (honoring the zero-third-party-deps policy): AES-256-GCM for the payload, PBKDF2-HMAC-SHA256 for passphrase key derivation. The public envelope header carries only non-secret parameters (salt, nonce, KDF iterations) — never a key or plaintext. This is not a novel construction; it composes reviewed standard primitives.

Index

• func Decrypt(inFile, destDir, passphrase string) error
• func Encrypt(pkgDir, outFile, passphrase string) error

Functions

func Decrypt

func Decrypt(inFile, destDir, passphrase string) error

Decrypt reads an encrypted file and extracts the package into destDir.

func Encrypt

func Encrypt(pkgDir, outFile, passphrase string) error

Encrypt archives the package directory and writes an encrypted file.