vault

Documentation

Overview

Package vault handles the on-disk format of .env.vault files.

Format:

The vault file stores the raw ciphertext as a base64-encoded string
wrapped with a header/footer for easy identification:

  #/---xenvsync vault---/
  <base64-encoded ciphertext>
  #/---end xenvsync vault---/

The key is NEVER included in the vault output.

Index

• func Decode(data []byte) ([]byte, error)
• func Encode(ciphertext []byte) []byte
• func EncodeV2(slots []KeySlot, ciphertext []byte) ([]byte, error)
• func IsV2(data []byte) bool
• type KeySlot
• type V2Vault
  • func DecodeV2(data []byte) (*V2Vault, error)

Functions

func Decode

func Decode(data []byte) ([]byte, error)

Decode extracts raw ciphertext bytes from a vault file.

func Encode

func Encode(ciphertext []byte) []byte

Encode wraps raw ciphertext bytes into the vault file format.

func EncodeV2

func EncodeV2(slots []KeySlot, ciphertext []byte) ([]byte, error)

EncodeV2 writes a V2 vault file with key slots and ciphertext.

func IsV2

func IsV2(data []byte) bool

IsV2 returns true if the data appears to be a V2 vault.

Types

type KeySlot

type KeySlot struct {
	Name         string `json:"name"`
	EphemeralPub string `json:"ephemeral_pub"` // base64
	EncryptedKey string `json:"encrypted_key"` // base64
}

KeySlot holds the encrypted symmetric key for one team member.

type V2Vault

type V2Vault struct {
	Slots      []KeySlot
	Ciphertext []byte
}

V2Vault represents a parsed V2 vault file.

func DecodeV2

func DecodeV2(data []byte) (*V2Vault, error)

DecodeV2 parses a V2 vault file into key slots and raw ciphertext.