Files

T

leetcrypt 425c299359 Initial commit: Incredigo — local-first RAM-only credential custody

v1: discover → migrate → expiry tracking → sealed export/import.

- vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop
- discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker,
  kube, git) and a file/dir harvester (--path)
- sink: gopass streaming insert; length-prefixed bundle framing; Sealer
  interface with three impls — age (default, authenticated), hmac
  (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback,
  unauthenticated; OpenSSL 3.x enc refuses AEAD)
- policy: local expiry engine, 60d/8w threshold parser
- audit: redacted append-only JSONL, injectable clock
- export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into
  locked memory; secrets stream gopass<->Sealer as bytes, never Go strings
- tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass;
  go test ./... green, -race clean

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-15 07:57:34 -07:00

2.5 KiB

Raw Blame History

credrot — dev handoff (resume on laptop)

Handed off from the phone (Termux/proot) session on 2026-06-15. Continue dev here.

What this project is

A local-first, encrypted, RAM-only credential custody tool. It discovers creds from common local locations, migrates them into gopass (GPG) without plaintext ever touching disk, and tracks their age. Full architecture + threat model in DESIGN.md; overview in README.md.

Locked decisions (already made with the user — don't relitigate):

Language: Go.
v1 scope: discover + migrate + expiry tracking. Provider rotation = v2, behind a Rotator interface.
openssl's role: sealed export/backup format only (gopass/GPG is the live store). No double-wrapping. Sealer is an interface so age can drop in later.

Current state

✅ DESIGN.md complete.
✅ Go scaffold written (~942 LOC). Working: scan, migrate, status; scanners aws + env; vault (memguard), gopass sink, openssl sealer, policy, audit.
⚠️ Never compiled — the phone had no Go toolchain. Treat as unverified.
🟡 export/import are stubbed (return "not implemented — see DESIGN.md §3.3").

Next steps (suggested order)

Get to a green build: go mod tidy && go build ./cmd/credrot. Fix whatever the compiler finds (memguard API surface is the most likely culprit — verify NewBufferFromBytes, LockedBuffer.Bytes(), Destroy, CatchInterrupt, Purge against the installed version).
Implement export/import per DESIGN.md §3.3: stream gopass show → Sealer.Seal via io.Pipe, passphrase from a locked buffer; define the record format (length-prefixed path\0secret is fine). Reverse for import.
Add scanners: netrc, ssh, docker, kube, git — see docs/ADDING_A_SCANNER.md. One file each.
Tests: table-driven scanner tests with temp-dir fixtures; assert no secret substrings leak into Identity/Meta. A vault test asserting zeroize.
Repo hygiene: git init. Per the user's rule, push to gitea only, never GitHub.

Gotchas carried over

Don't copy secret bytes into Go strings or heap slices that outlive immediate use — defeats the RAM-only guarantee. Pipe vault buffers straight to stdin.
Scanners must stay strictly read-only (O_RDONLY).
openssl enc GCM/PBKDF2 is finicky across versions; if it fights you, swap the default Sealer to age — nothing else changes.