package local¶

import "github.com/cloudboss/unobin/pkg/encrypters/local"

Constants¶

const (
    EnvKeyName = "env-key"
    NoopName   = "noop"
)

Functions¶

func Types¶

func Types() []sdkencrypt.EncrypterType

Types¶

type EnvKey¶

type EnvKey struct {
    // contains filtered or unexported fields
}

EnvKey uses AES-256-GCM with a 32 byte symmetric key read from a named environment variable. The env value must be the base64-encoded key.

func NewEnvKey¶

func NewEnvKey(envVar string) (*EnvKey, error)

NewEnvKey reads the env var, decodes the key, and returns an EnvKey encrypter. Errors when the env var is unset, not base64, or does not decode to 32 bytes.

func (*EnvKey) Decrypt¶

func (e *EnvKey) Decrypt(ciphertext []byte) ([]byte, error)

Decrypt opens a value produced by Encrypt. Errors on tampered or truncated bytes.

func (*EnvKey) Describe¶

func (e *EnvKey) Describe() sdkencrypt.Description

Describe names the env-key source and the env var the key is read from.

func (*EnvKey) Encrypt¶

func (e *EnvKey) Encrypt(plaintext []byte) ([]byte, error)

Encrypt seals plaintext with a fresh random nonce. Output bytes are `nonce || ciphertext+tag`.

type EnvKeyConfig¶

type EnvKeyConfig struct {
    EnvVar string
}

type Noop¶

type Noop struct{}

Noop passes bytes through unchanged. Useful in tests and for dev workflows where the operator has explicitly opted out of encryption.

func (Noop) Decrypt¶

func (Noop) Decrypt(p []byte) ([]byte, error)

func (Noop) Describe¶

func (Noop) Describe() sdkencrypt.Description

Describe names the noop key source. The empty Config marks the sealed body as plaintext with nothing more to configure.

func (Noop) Encrypt¶

func (Noop) Encrypt(p []byte) ([]byte, error)