 leetcrypt
|
71a74e7166
|
guide: read-only guided manual-rotation layer (links + worklist + TUI)
Advances the guided-rotation goal without rotating anything.
- internal/links: offline change-password URL generation — curated per-service
table + RFC 8615 /.well-known/change-password + parent-domain fallback; derives
a web host from a credential (git/netrc "user @ host", docker registry, aws)
- internal/worklist: secrets-free rotation worklist (source, identity, auto/manual,
link) + Markdown renderer
- internal/tui: Bubble Tea walk-through (one credential per screen, open link,
mark done/skip, progress) — READ-ONLY, enters/stores no secret
- cmd: `incredigo worklist` (offline, stdout/--out) and `incredigo guide` (TUI)
- tests: link derivation, worklist build/markdown + no-secret-column, TUI
navigation/done/quit/view
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-06-15 14:58:23 -07:00 |
|
|
leetcrypt
|
425c299359
|
Initial commit: Incredigo — local-first RAM-only credential custody
v1: discover → migrate → expiry tracking → sealed export/import.
- vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop
- discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker,
kube, git) and a file/dir harvester (--path)
- sink: gopass streaming insert; length-prefixed bundle framing; Sealer
interface with three impls — age (default, authenticated), hmac
(authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback,
unauthenticated; OpenSSL 3.x enc refuses AEAD)
- policy: local expiry engine, 60d/8w threshold parser
- audit: redacted append-only JSONL, injectable clock
- export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into
locked memory; secrets stream gopass<->Sealer as bytes, never Go strings
- tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass;
go test ./... green, -race clean
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-06-15 07:57:34 -07:00 |
|