pgp

Documentation

Index

• Constants
• type GnuPGHome
  • func NewGnuPGHome() (GnuPGHome, error)
  • func (d GnuPGHome) ApplyToMasterKey(key *MasterKey)
  • func (d GnuPGHome) Import(armoredKey []byte) error
  • func (d GnuPGHome) ImportFile(path string) error
  • func (d GnuPGHome) String() string
  • func (d GnuPGHome) Validate() error
• type MasterKey
  • func MasterKeyFromFingerprint(fingerprint string) *MasterKey
  • func (key *MasterKey) Decrypt() ([]byte, error)
  • func (key *MasterKey) Encrypt(dataKey []byte) error
  • func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error
  • func (key *MasterKey) EncryptedDataKey() []byte
  • func (key *MasterKey) NeedsRotation() bool
  • func (key *MasterKey) SetEncryptedDataKey(enc []byte)
  • func (key MasterKey) ToMap() map[string]interface{}
  • func (key *MasterKey) ToString() string

Constants

const (
	// SopsGpgExecEnv can be set as an environment variable to overwrite the
	// GnuPG binary used.
	SopsGpgExecEnv = "FLUX_SOPS_GPG_EXEC"
)

Types

type GnuPGHome

type GnuPGHome string

GnuPGHome is the absolute path to a GnuPG home directory. A new keyring can be constructed by combining the use of NewGnuPGHome() and Import() or ImportFile().

func NewGnuPGHome

func NewGnuPGHome() (GnuPGHome, error)

NewGnuPGHome initializes a new GnuPGHome in a temporary directory. The caller is expected to handle the garbage collection of the created directory.

func (GnuPGHome) ApplyToMasterKey

func (d GnuPGHome) ApplyToMasterKey(key *MasterKey)

ApplyToMasterKey configures the GnuPGHome on the provided key if it passes Validate.

func (GnuPGHome) Import

func (d GnuPGHome) Import(armoredKey []byte) error

Import attempts to import the armored key bytes into the GnuPGHome keyring. It returns an error if the GnuPGHome does not pass Validate, or if the import failed.

func (GnuPGHome) ImportFile

func (d GnuPGHome) ImportFile(path string) error

ImportFile attempts to import the armored key file into the GnuPGHome keyring. It returns an error if the GnuPGHome does not pass Validate, or if the import failed.

func (GnuPGHome) String

func (d GnuPGHome) String() string

String returns the GnuPGHome as a string. It does not Validate.

func (GnuPGHome) Validate

func (d GnuPGHome) Validate() error

Validate ensures the GnuPGHome is a valid GnuPG home directory path. When validation fails, it returns a descriptive reason as error.

type MasterKey

type MasterKey struct {
	// Fingerprint contains the fingerprint of the PGP key used to Encrypt
	// or Decrypt the data key with.
	Fingerprint string
	// EncryptedKey contains the SOPS data key encrypted with PGP.
	EncryptedKey string
	// CreationDate of the MasterKey, used to determine if the EncryptedKey
	// needs rotation.
	CreationDate time.Time
	// contains filtered or unexported fields
}

MasterKey is a PGP key used to securely store SOPS' data key by encrypting it and decrypting it.

Adapted from https://github.com/mozilla/sops/blob/v3.7.2/pgp/keysource.go to be able to control the GPG home directory and have a "contained" environment.

We are unable to drop the dependency on the GPG binary (although we wish!) because the builtin GPG support in Go is limited, it does for example not offer support for FIPS: * https://github.com/golang/go/issues/11658#issuecomment-120448974 * https://github.com/golang/go/issues/45188

func MasterKeyFromFingerprint

func MasterKeyFromFingerprint(fingerprint string) *MasterKey

MasterKeyFromFingerprint takes a PGP fingerprint and returns a new MasterKey with that fingerprint.

func (*MasterKey) Decrypt

func (key *MasterKey) Decrypt() ([]byte, error)

Decrypt uses PGP to obtain the data key from the EncryptedKey store in the MasterKey and returns it.

func (*MasterKey) Encrypt

func (key *MasterKey) Encrypt(dataKey []byte) error

Encrypt encrypts the data key with the PGP key with the same fingerprint as the MasterKey.

func (*MasterKey) EncryptIfNeeded

func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error

EncryptIfNeeded encrypts the data key with PGP only if it's needed, that is, if it hasn't been encrypted already.

func (*MasterKey) EncryptedDataKey

func (key *MasterKey) EncryptedDataKey() []byte

EncryptedDataKey returns the encrypted data key this master key holds.

func (*MasterKey) NeedsRotation

func (key *MasterKey) NeedsRotation() bool

NeedsRotation returns whether the data key needs to be rotated or not.

func (*MasterKey) SetEncryptedDataKey

func (key *MasterKey) SetEncryptedDataKey(enc []byte)

SetEncryptedDataKey sets the encrypted data key for this master key.

func (MasterKey) ToMap

func (key MasterKey) ToMap() map[string]interface{}

ToMap converts the MasterKey into a map for serialization purposes.

func (*MasterKey) ToString

func (key *MasterKey) ToString() string

ToString returns the string representation of the key, i.e. its fingerprint.