leetcrypt
425c299359
v1: discover → migrate → expiry tracking → sealed export/import. - vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop - discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker, kube, git) and a file/dir harvester (--path) - sink: gopass streaming insert; length-prefixed bundle framing; Sealer interface with three impls — age (default, authenticated), hmac (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback, unauthenticated; OpenSSL 3.x enc refuses AEAD) - policy: local expiry engine, 60d/8w threshold parser - audit: redacted append-only JSONL, injectable clock - export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into locked memory; secrets stream gopass<->Sealer as bytes, never Go strings - tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass; go test ./... green, -race clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
104 lines
2.3 KiB
Go
104 lines
2.3 KiB
Go
package discover
|
|
|
|
import (
|
|
"bufio"
|
|
"context"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"incredigo/internal/vault"
|
|
)
|
|
|
|
func init() { Register(&awsScanner{}) }
|
|
|
|
// awsScanner reads ~/.aws/credentials (INI). Read-only: opens O_RDONLY and never
|
|
// writes back.
|
|
type awsScanner struct{}
|
|
|
|
func (a *awsScanner) Name() string { return "aws" }
|
|
|
|
func (a *awsScanner) path() string {
|
|
if p := os.Getenv("AWS_SHARED_CREDENTIALS_FILE"); p != "" {
|
|
return p
|
|
}
|
|
home, _ := os.UserHomeDir()
|
|
return filepath.Join(home, ".aws", "credentials")
|
|
}
|
|
|
|
func (a *awsScanner) Available() bool {
|
|
_, err := os.Stat(a.path())
|
|
return err == nil
|
|
}
|
|
|
|
func (a *awsScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
|
|
p := a.path()
|
|
f, err := os.Open(p) // read-only
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer f.Close()
|
|
|
|
fi, _ := f.Stat()
|
|
|
|
var creds []Credential
|
|
var profile, keyID string
|
|
|
|
flush := func(secret string) {
|
|
if profile == "" || secret == "" {
|
|
return
|
|
}
|
|
creds = append(creds, Credential{
|
|
Source: a.Name(),
|
|
Kind: KindAWSKey,
|
|
Identity: profile + " / " + redactMiddle(keyID),
|
|
Location: p,
|
|
Modified: fi.ModTime(),
|
|
Secret: v.Store([]byte(secret)),
|
|
Meta: map[string]string{"access_key_id": redactMiddle(keyID)},
|
|
})
|
|
keyID = ""
|
|
}
|
|
|
|
sc := bufio.NewScanner(f)
|
|
for sc.Scan() {
|
|
line := strings.TrimSpace(sc.Text())
|
|
if line == "" || strings.HasPrefix(line, "#") || strings.HasPrefix(line, ";") {
|
|
continue
|
|
}
|
|
if strings.HasPrefix(line, "[") && strings.HasSuffix(line, "]") {
|
|
profile = strings.TrimSpace(line[1 : len(line)-1])
|
|
keyID = ""
|
|
continue
|
|
}
|
|
k, val, ok := splitKV(line)
|
|
if !ok {
|
|
continue
|
|
}
|
|
switch strings.ToLower(k) {
|
|
case "aws_access_key_id":
|
|
keyID = val
|
|
case "aws_secret_access_key":
|
|
flush(val)
|
|
}
|
|
}
|
|
return creds, sc.Err()
|
|
}
|
|
|
|
func splitKV(line string) (k, v string, ok bool) {
|
|
i := strings.IndexByte(line, '=')
|
|
if i < 0 {
|
|
return "", "", false
|
|
}
|
|
return strings.TrimSpace(line[:i]), strings.TrimSpace(line[i+1:]), true
|
|
}
|
|
|
|
// redactMiddle keeps the first 4 and last 2 chars, masking the middle, so labels
|
|
// are human-recognizable without leaking the value.
|
|
func redactMiddle(s string) string {
|
|
if len(s) <= 8 {
|
|
return strings.Repeat("*", len(s))
|
|
}
|
|
return s[:4] + strings.Repeat("*", len(s)-6) + s[len(s)-2:]
|
|
}
|