clawbot
db7d2c952e
check / check (push) Failing after 1s
init and vault create put the mnemonic into the process environment for vault.CreateVault to read back, so every program they ran, gpg included, inherited it, and SB_SECRET_MNEMONIC and SB_UNLOCK_PASSPHRASE were read at 13 places and never unset. Each command that may need them now reads both once, in its RunE, into locked buffers on the CLI Instance, and unsets them at once. The buffers are passed down: vault.CreateVault takes the mnemonic, a Vault carries Mnemonic and UnlockPassphrase, and the PGP, keychain and Secure Enclave unlocker constructors take both; CreatePGPUnlocker sets them on the vault it loads through SetMnemonic and SetUnlockPassphrase, new in VaultInterface. README warns against both variables. Model: opus-5-5
84 lines
2.1 KiB
Go
84 lines
2.1 KiB
Go
//go:build !darwin
|
|
|
|
package secret
|
|
|
|
import (
|
|
"errors"
|
|
|
|
"filippo.io/age"
|
|
"github.com/awnumar/memguard"
|
|
"github.com/spf13/afero"
|
|
)
|
|
|
|
// KeychainUnlockerMetadata is a stub for non-Darwin platforms
|
|
type KeychainUnlockerMetadata struct {
|
|
UnlockerMetadata
|
|
|
|
KeychainItemName string `json:"keychainItemName"`
|
|
}
|
|
|
|
// KeychainUnlocker is a stub for non-Darwin platforms
|
|
type KeychainUnlocker struct {
|
|
Directory string
|
|
Metadata UnlockerMetadata
|
|
fs afero.Fs
|
|
}
|
|
|
|
var errKeychainNotSupported = errors.New(
|
|
"keychain unlockers are only supported on macOS")
|
|
|
|
// NewKeychainUnlocker creates a stub KeychainUnlocker on non-Darwin
|
|
// platforms. The returned instance's methods that require macOS
|
|
// functionality will return errors.
|
|
func NewKeychainUnlocker(
|
|
fs afero.Fs, directory string, metadata UnlockerMetadata,
|
|
) *KeychainUnlocker {
|
|
return &KeychainUnlocker{
|
|
Directory: directory,
|
|
Metadata: metadata,
|
|
fs: fs,
|
|
}
|
|
}
|
|
|
|
// GetIdentity returns an error on non-Darwin platforms
|
|
func (k *KeychainUnlocker) GetIdentity() (*age.X25519Identity, error) {
|
|
return nil, errKeychainNotSupported
|
|
}
|
|
|
|
// GetType returns the unlocker type
|
|
func (k *KeychainUnlocker) GetType() string {
|
|
return "keychain"
|
|
}
|
|
|
|
// GetMetadata returns the unlocker metadata
|
|
func (k *KeychainUnlocker) GetMetadata() UnlockerMetadata {
|
|
return k.Metadata
|
|
}
|
|
|
|
// GetDirectory returns the unlocker directory
|
|
func (k *KeychainUnlocker) GetDirectory() string {
|
|
return k.Directory
|
|
}
|
|
|
|
// GetID returns the unlocker ID
|
|
func (k *KeychainUnlocker) GetID() string {
|
|
return k.Metadata.CreatedAt.Format("2006-01-02.15.04") + "-keychain"
|
|
}
|
|
|
|
// GetKeychainItemName returns an error on non-Darwin platforms
|
|
func (k *KeychainUnlocker) GetKeychainItemName() (string, error) {
|
|
return "", errKeychainNotSupported
|
|
}
|
|
|
|
// Remove returns an error on non-Darwin platforms
|
|
func (k *KeychainUnlocker) Remove() error {
|
|
return errKeychainNotSupported
|
|
}
|
|
|
|
// CreateKeychainUnlocker returns an error on non-Darwin platforms
|
|
func CreateKeychainUnlocker(
|
|
_ afero.Fs, _ string, _, _ *memguard.LockedBuffer,
|
|
) (*KeychainUnlocker, error) {
|
|
return nil, errKeychainNotSupported
|
|
}
|