secret

183 Commits 6 Branches 0 Tags

3 Commits

Author	SHA1	Message	Date
clawbot	51e3731076	Wipe memguard buffers on every exit and restore echo (closes #35 ) check / check (push) Successful in 1m35s Details Entry() now returns the exit code and only main calls os.Exit, so the deferred memguard.Purge() in Entry() runs on success and on error; before, os.Exit(1) skipped every deferred Destroy(). SIGINT and SIGTERM go through memguard's handler, which wipes every buffer and exits with status 1. The passphrase prompt turns terminal echo off until its read returns, and the handler exits before that, so the handler first restores the terminal settings saved at startup, but only when this process is in the terminal's foreground process group: a background process that changes the terminal is stopped instead of exiting. Model: opus-5-5	2026-10-04 02:07:58 +02:00
clawbot	a5faec0466	Reject invalid secret names before any command builds a path (closes #33 ) check / check (push) Successful in 1m13s Details `secret rm ..` deleted the whole vault; `secret rm .` and `secret rm ""` deleted every secret. rm, mv, the version commands, encrypt and decrypt built paths from the name unchecked; import checked it only after reading the source file. Each now calls vault.ValidateSecretName, which wraps the existing rule, on the name as given, before building any path; MoveSecret checks both names before switching the current vault. Its error and README.md state the rule. The test-only copy of the rule in internal/secret is removed. The regression test runs each rejected command on a copy of two in-memory vaults and requires the exact error and an unchanged state directory. Model: opus-5-5	2026-10-04 01:29:28 +02:00
clawbot	7c6531eaf7	Keep the keychain unlocker passphrase in locked memory (closes #36 ) check / check (push) Successful in 39s Details The passphrase protecting the keychain unlocker's age key was a plain string passed through encoding/json, leaving copies in ordinary memory when an unlocker was created and each time one was used. It is now generated into a locked buffer, and KeychainData, moved to keychaindata.go, which is not darwin-only so its tests run on Linux, writes and reads the keychain JSON itself: encode copies the parts straight into a locked buffer, and decodeKeychainData takes the passphrase from a json.RawMessage that it wipes. The JSON field names are unchanged. keychainunlocker.go only calls this code and stores the item from the locked buffer without a string copy. Model: opus-5-5	2026-10-03 17:07:56 +02:00

Author

SHA1

Message

Date

clawbot

51e3731076

Wipe memguard buffers on every exit and restore echo (closes #35 )

check / check (push) Successful in 1m35s

Details

Entry() now returns the exit code and only main calls os.Exit, so the
deferred memguard.Purge() in Entry() runs on success and on error;
before, os.Exit(1) skipped every deferred Destroy().

SIGINT and SIGTERM go through memguard's handler, which wipes every
buffer and exits with status 1. The passphrase prompt turns terminal
echo off until its read returns, and the handler exits before that, so
the handler first restores the terminal settings saved at startup, but
only when this process is in the terminal's foreground process group: a
background process that changes the terminal is stopped instead of
exiting.

Model: opus-5-5

2026-10-04 02:07:58 +02:00

clawbot

a5faec0466

Reject invalid secret names before any command builds a path (closes #33 )

check / check (push) Successful in 1m13s

Details

`secret rm ..` deleted the whole vault; `secret rm .` and `secret rm ""`
deleted every secret. rm, mv, the version commands, encrypt and decrypt
built paths from the name unchecked; import checked it only after
reading the source file.

Each now calls vault.ValidateSecretName, which wraps the existing rule,
on the name as given, before building any path; MoveSecret checks both
names before switching the current vault. Its error and README.md state
the rule. The test-only copy of the rule in internal/secret is removed.

The regression test runs each rejected command on a copy of two
in-memory vaults and requires the exact error and an unchanged state
directory.

Model: opus-5-5

2026-10-04 01:29:28 +02:00

clawbot

7c6531eaf7

Keep the keychain unlocker passphrase in locked memory (closes #36 )

check / check (push) Successful in 39s

Details

The passphrase protecting the keychain unlocker's age key was a plain
string passed through encoding/json, leaving copies in ordinary memory
when an unlocker was created and each time one was used.

It is now generated into a locked buffer, and KeychainData, moved to
keychaindata.go, which is not darwin-only so its tests run on Linux,
writes and reads the keychain JSON itself: encode copies the parts
straight into a locked buffer, and decodeKeychainData takes the
passphrase from a json.RawMessage that it wipes. The JSON field names
are unchanged. keychainunlocker.go only calls this code and stores the
item from the locked buffer without a string copy.

Model: opus-5-5

2026-10-03 17:07:56 +02:00