leetcrypt
425c299359
v1: discover → migrate → expiry tracking → sealed export/import. - vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop - discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker, kube, git) and a file/dir harvester (--path) - sink: gopass streaming insert; length-prefixed bundle framing; Sealer interface with three impls — age (default, authenticated), hmac (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback, unauthenticated; OpenSSL 3.x enc refuses AEAD) - policy: local expiry engine, 60d/8w threshold parser - audit: redacted append-only JSONL, injectable clock - export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into locked memory; secrets stream gopass<->Sealer as bytes, never Go strings - tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass; go test ./... green, -race clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
87 lines
2.4 KiB
Markdown
87 lines
2.4 KiB
Markdown
# Adding a scanner
|
|
|
|
A scanner teaches incredigo to discover credentials from one location/format. Each
|
|
is a single self-contained file in `internal/discover/` that implements the
|
|
`Scanner` interface and registers itself in `init()`.
|
|
|
|
## The contract
|
|
|
|
```go
|
|
type Scanner interface {
|
|
Name() string
|
|
Available() bool
|
|
Scan(ctx context.Context, v *vault.Vault) ([]Credential, error)
|
|
}
|
|
```
|
|
|
|
Rules:
|
|
|
|
1. **Read-only, always.** Open files with `os.Open` (O_RDONLY). Never write,
|
|
rename, or truncate a source file.
|
|
2. **Never build plaintext into a long-lived value.** Read the secret into a
|
|
`[]byte`, hand it to `v.Store(secret)`, and put the returned `*vault.Handle` in
|
|
`Credential.Secret`. `Store` wipes your slice for you.
|
|
3. **Pre-redact identities.** `Identity` and any `Meta` values are printed and
|
|
logged. Use `redactMiddle(...)` (see `aws.go`) for key ids etc. Never put the
|
|
secret in `Identity`/`Meta`.
|
|
4. **Set `Modified`** from the file mtime — it feeds the expiry policy.
|
|
5. **`Available()` should be cheap** (a `stat`), and return false when the source
|
|
is absent so the run skips it cleanly.
|
|
|
|
## Template
|
|
|
|
```go
|
|
package discover
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"incredigo/internal/vault"
|
|
)
|
|
|
|
func init() { Register(&fooScanner{}) }
|
|
|
|
type fooScanner struct{}
|
|
|
|
func (f *fooScanner) Name() string { return "foo" }
|
|
|
|
func (f *fooScanner) path() string {
|
|
home, _ := os.UserHomeDir()
|
|
return filepath.Join(home, ".foo", "credentials")
|
|
}
|
|
|
|
func (f *fooScanner) Available() bool {
|
|
_, err := os.Stat(f.path())
|
|
return err == nil
|
|
}
|
|
|
|
func (f *fooScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
|
|
p := f.path()
|
|
b, err := os.ReadFile(p) // read-only
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
fi, _ := os.Stat(p)
|
|
|
|
secret := parseSecret(b) // your format logic
|
|
return []Credential{{
|
|
Source: f.Name(),
|
|
Kind: KindToken,
|
|
Identity: "foo / " + redactMiddle(/* a non-secret id */),
|
|
Location: p,
|
|
Modified: fi.ModTime(),
|
|
Secret: v.Store([]byte(secret)),
|
|
}}, nil
|
|
}
|
|
```
|
|
|
|
That's it — the registry picks it up automatically, and `scan`/`migrate`/`status`
|
|
all gain the new source with no other changes.
|
|
|
|
## Tests
|
|
|
|
Add `foo_test.go` with a fixture file in a temp dir; assert that `Scan` returns
|
|
the expected metadata and that `Identity`/`Meta` contain no secret substrings.
|