leetcrypt
425c299359
v1: discover → migrate → expiry tracking → sealed export/import. - vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop - discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker, kube, git) and a file/dir harvester (--path) - sink: gopass streaming insert; length-prefixed bundle framing; Sealer interface with three impls — age (default, authenticated), hmac (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback, unauthenticated; OpenSSL 3.x enc refuses AEAD) - policy: local expiry engine, 60d/8w threshold parser - audit: redacted append-only JSONL, injectable clock - export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into locked memory; secrets stream gopass<->Sealer as bytes, never Go strings - tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass; go test ./... green, -race clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
106 lines
2.3 KiB
Go
106 lines
2.3 KiB
Go
package discover
|
|
|
|
import (
|
|
"bufio"
|
|
"context"
|
|
"math"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"incredigo/internal/vault"
|
|
)
|
|
|
|
func init() { Register(&envScanner{}) }
|
|
|
|
// envScanner reads .env files in the current working directory. It keeps only
|
|
// values that look secret-ish: the key name matches a sensitive pattern OR the
|
|
// value has high Shannon entropy. This avoids hoovering up PORT=8080 etc.
|
|
type envScanner struct{}
|
|
|
|
func (e *envScanner) Name() string { return "env" }
|
|
|
|
func (e *envScanner) files() []string {
|
|
matches, _ := filepath.Glob(".env")
|
|
more, _ := filepath.Glob(".env.*")
|
|
return append(matches, more...)
|
|
}
|
|
|
|
func (e *envScanner) Available() bool { return len(e.files()) > 0 }
|
|
|
|
var sensitiveHints = []string{
|
|
"secret", "token", "passwd", "password", "apikey", "api_key",
|
|
"private", "key", "credential", "auth", "access",
|
|
}
|
|
|
|
func (e *envScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
|
|
var creds []Credential
|
|
for _, p := range e.files() {
|
|
f, err := os.Open(p) // read-only
|
|
if err != nil {
|
|
return creds, err
|
|
}
|
|
fi, _ := f.Stat()
|
|
sc := bufio.NewScanner(f)
|
|
for sc.Scan() {
|
|
line := strings.TrimSpace(sc.Text())
|
|
if line == "" || strings.HasPrefix(line, "#") {
|
|
continue
|
|
}
|
|
line = strings.TrimPrefix(line, "export ")
|
|
k, val, ok := splitKV(line)
|
|
if !ok || val == "" {
|
|
continue
|
|
}
|
|
val = strings.Trim(val, `"'`)
|
|
if !looksSecret(k, val) {
|
|
continue
|
|
}
|
|
creds = append(creds, Credential{
|
|
Source: e.Name(),
|
|
Kind: KindToken,
|
|
Identity: filepath.Base(p) + " / " + k,
|
|
Location: p,
|
|
Modified: fi.ModTime(),
|
|
Secret: v.Store([]byte(val)),
|
|
})
|
|
}
|
|
f.Close()
|
|
if err := sc.Err(); err != nil {
|
|
return creds, err
|
|
}
|
|
}
|
|
return creds, nil
|
|
}
|
|
|
|
func looksSecret(key, val string) bool {
|
|
lk := strings.ToLower(key)
|
|
for _, h := range sensitiveHints {
|
|
if strings.Contains(lk, h) {
|
|
return true
|
|
}
|
|
}
|
|
// Fallback: long, high-entropy values are probably secrets.
|
|
return len(val) >= 16 && shannonEntropy(val) >= 3.5
|
|
}
|
|
|
|
func shannonEntropy(s string) float64 {
|
|
if s == "" {
|
|
return 0
|
|
}
|
|
var freq [256]float64
|
|
for i := 0; i < len(s); i++ {
|
|
freq[s[i]]++
|
|
}
|
|
n := float64(len(s))
|
|
var h float64
|
|
for _, c := range freq {
|
|
if c == 0 {
|
|
continue
|
|
}
|
|
p := c / n
|
|
h -= p * math.Log2(p)
|
|
}
|
|
return h
|
|
}
|