leetcrypt
425c299359
v1: discover → migrate → expiry tracking → sealed export/import. - vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop - discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker, kube, git) and a file/dir harvester (--path) - sink: gopass streaming insert; length-prefixed bundle framing; Sealer interface with three impls — age (default, authenticated), hmac (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback, unauthenticated; OpenSSL 3.x enc refuses AEAD) - policy: local expiry engine, 60d/8w threshold parser - audit: redacted append-only JSONL, injectable clock - export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into locked memory; secrets stream gopass<->Sealer as bytes, never Go strings - tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass; go test ./... green, -race clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
2.5 KiB
Markdown
46 lines
2.5 KiB
Markdown
# credrot — dev handoff (resume on laptop)
|
|
|
|
Handed off from the phone (Termux/proot) session on 2026-06-15. Continue dev here.
|
|
|
|
## What this project is
|
|
A **local-first, encrypted, RAM-only credential custody tool**. It discovers creds
|
|
from common local locations, migrates them into gopass (GPG) **without plaintext
|
|
ever touching disk**, and tracks their age. Full architecture + threat model in
|
|
[`DESIGN.md`](DESIGN.md); overview in [`README.md`](README.md).
|
|
|
|
**Locked decisions (already made with the user — don't relitigate):**
|
|
- Language: **Go**.
|
|
- v1 scope: **discover + migrate + expiry tracking**. Provider rotation = v2, behind
|
|
a `Rotator` interface.
|
|
- openssl's role: **sealed export/backup format only** (gopass/GPG is the live
|
|
store). No double-wrapping. `Sealer` is an interface so `age` can drop in later.
|
|
|
|
## Current state
|
|
- ✅ `DESIGN.md` complete.
|
|
- ✅ Go scaffold written (~942 LOC). Working: `scan`, `migrate`, `status`; scanners
|
|
`aws` + `env`; vault (memguard), gopass sink, openssl sealer, policy, audit.
|
|
- ⚠️ **Never compiled** — the phone had no Go toolchain. Treat as unverified.
|
|
- 🟡 `export`/`import` are **stubbed** (return "not implemented — see DESIGN.md §3.3").
|
|
|
|
## Next steps (suggested order)
|
|
1. **Get to a green build:** `go mod tidy && go build ./cmd/credrot`. Fix whatever
|
|
the compiler finds (memguard API surface is the most likely culprit — verify
|
|
`NewBufferFromBytes`, `LockedBuffer.Bytes()`, `Destroy`, `CatchInterrupt`,
|
|
`Purge` against the installed version).
|
|
2. **Implement `export`/`import`** per DESIGN.md §3.3: stream `gopass show` →
|
|
`Sealer.Seal` via `io.Pipe`, passphrase from a locked buffer; define the record
|
|
format (length-prefixed `path\0secret` is fine). Reverse for import.
|
|
3. **Add scanners:** `netrc`, `ssh`, `docker`, `kube`, `git` — see
|
|
[`docs/ADDING_A_SCANNER.md`](docs/ADDING_A_SCANNER.md). One file each.
|
|
4. **Tests:** table-driven scanner tests with temp-dir fixtures; assert no secret
|
|
substrings leak into `Identity`/`Meta`. A vault test asserting zeroize.
|
|
5. **Repo hygiene:** `git init`. Per the user's rule, **push to gitea only, never
|
|
GitHub.**
|
|
|
|
## Gotchas carried over
|
|
- Don't copy secret bytes into Go `string`s or heap slices that outlive immediate
|
|
use — defeats the RAM-only guarantee. Pipe `vault` buffers straight to stdin.
|
|
- Scanners must stay strictly read-only (`O_RDONLY`).
|
|
- openssl `enc` GCM/PBKDF2 is finicky across versions; if it fights you, swap the
|
|
default `Sealer` to `age` — nothing else changes.
|