vault

README

vault

Ansible Vault-compatible AES256 encryption for secrets, pure Go CGO=0.

Part of go-ansible — a pure-Go (CGO=0), functional-parity port of Ansible.

Documentation

Overview

Package vault implements the Ansible Vault 1.1 file format: AES-256 in CTR mode with a PBKDF2-HMAC-SHA256 derived key and an encrypt-then-MAC HMAC-SHA256 authentication tag, hex-wrapped at 80 columns.

The wire format is fixed by the reference implementation (ansible.parsing.vault.VaultAES256 in ansible-core) and is reproduced here byte-for-byte so files written by this package decrypt with the real `ansible-vault` and vice versa.

Index

• Variables
• func Decrypt(vaultText string, password string) ([]byte, error)
• func Encrypt(plaintext []byte, password string, vaultID string) (string, error)
• func FormatVersion(vaultText string) (string, error)
• func IsVault(data []byte) bool
• func VaultID(vaultText string) (string, error)

Variables

var ErrHMACMismatch = errors.New("vault: HMAC verification failed (wrong password?)")

ErrHMACMismatch is returned when decryption's integrity check fails — almost always a wrong password.

var ErrNotVault = errors.New("vault: not an ansible-vault payload")

ErrNotVault is returned when the input does not carry a recognized vault header.

Functions

func Decrypt

func Decrypt(vaultText string, password string) ([]byte, error)

Decrypt decrypts a full vault text (as produced by Encrypt, or by `ansible-vault encrypt`) with password.

func Encrypt

func Encrypt(plaintext []byte, password string, vaultID string) (string, error)

Encrypt encrypts plaintext under password and returns the full vault text (header line + 80-column-wrapped hex body), ready to write to a file or embed as a YAML block scalar.

vaultID, if non-empty, is appended to the header ($ANSIBLE_VAULT;1.1;AES256;vaultID) exactly as `ansible-vault --vault-id` does.

func FormatVersion

func FormatVersion(vaultText string) (string, error)

FormatVersion reports the vault format version string ("1.1" for everything this package produces or reads).

func IsVault

func IsVault(data []byte) bool

IsVault reports whether data begins with a recognized vault header, with or without a leading vault-id.

func VaultID

func VaultID(vaultText string) (string, error)

VaultID returns the vault-id label carried by a vault text's header (the part after the cipher name), or "" if none was set.