luci-go: github.com/luci/luci-go/server/secrets Index | Files | Directories

package secrets

import "github.com/luci/luci-go/server/secrets"

Package secrets provides an interface for a simple secret store: you ask it for a secret (a byte blob, identifies by some key), and it returns it to you (current version, as well as a bunch of previous versions). Caller are supposed to use the secret for an operation and then forget it (e.g. do not try to store it elsewhere).

Secure storage, retrieval and rotation of secrets is outside of the scope of this interface: it's the responsibility of the implementation.

Index

Package Files

context.go derived.go doc.go secrets.go

Variables

var (
    // ErrNoStoreConfigured is returned by GetSecret if secret store is not in
    // the context.
    ErrNoStoreConfigured = errors.New("secrets.Store is not in the context")
)
var (
    // ErrNoSuchSecret is returned by Store.GetSecret if it can't find a secret.
    ErrNoSuchSecret = errors.New("secret not found")
)

func Set Uses

func Set(c context.Context, s Store) context.Context

Set injects the Store object in the context to be returned by Get as is.

func SetFactory Uses

func SetFactory(c context.Context, f Factory) context.Context

SetFactory sets the function to produce Store instances when Get(c) is used.

type DerivedStore Uses

type DerivedStore struct {
    // contains filtered or unexported fields
}

DerivedStore implements Store by deriving secrets from some single master secret using HKDF.

Caches all derived secrets internally forever. Assumes the set of possible key names is limited.

func NewDerivedStore Uses

func NewDerivedStore(root Secret) *DerivedStore

NewDerivedStore returns a store that derives secrets from the given root key.

func (*DerivedStore) GetSecret Uses

func (d *DerivedStore) GetSecret(name string) (Secret, error)

GetSecret returns a generated secret given its key.

func (*DerivedStore) SetRoot Uses

func (d *DerivedStore) SetRoot(root Secret)

SetRoot replaces the root key used to derive secrets.

type Factory Uses

type Factory func(context.Context) Store

Factory knows how to make a new Store.

type Secret Uses

type Secret struct {
    Current  []byte   `json:"current"`            // current value of the secret, always set
    Previous [][]byte `json:"previous,omitempty"` // optional list of previous values, most recent first
}

Secret represents a current value of a secret as well as a set of few previous values. Previous values are important when key is being rotated: there may be valid outstanding derivatives of previous values of the secret.

func GetSecret Uses

func GetSecret(c context.Context, key string) (Secret, error)

GetSecret is a shortcut for grabbing a Store from the context and using its GetSecret method.

If the context doesn't have Store set, returns ErrNoStoreConfigured.

func (Secret) Blobs Uses

func (s Secret) Blobs() [][]byte

Blobs returns current blob and all previous blobs as one array.

func (Secret) Equal Uses

func (s Secret) Equal(a Secret) bool

Equal returns true if secrets are equal.

Does *not* run in constant time. Shouldn't be used in a cryptographic context due to susceptibility to timing attacks.

type StaticStore Uses

type StaticStore map[string]Secret

StaticStore is Store with predefined secrets.

func (StaticStore) GetSecret Uses

func (s StaticStore) GetSecret(k string) (Secret, error)

GetSecret returns a secret given its key or ErrNoSuchSecret if no such secret exists.

The caller must not mutate the secret.

type Store Uses

type Store interface {
    // GetSecret returns a secret given its key.
    //
    // Store may choose to autogenerate a secret if there's no existing one, or it
    // may choose to treat it as a error and return ErrNoSuchSecret.
    GetSecret(name string) (Secret, error)
}

Store knows how to retrieve (or autogenerate) a secret given its key.

func Get Uses

func Get(c context.Context) Store

Get grabs a Store by calling Factory stored in the context. If one hasn't been set, it returns nil.

Directories

PathSynopsis
testsecretsPackage testsecrets provides a dumb in-memory secret store to use in unit tests.

Package secrets imports 7 packages (graph). Updated 2019-07-12. Refresh now. Tools for package owners.