4921690b5e
- pkg/credential: new package with AES-256-GCM enc:// credential format, HKDF-SHA256 key derivation (passphrase + optional SSH key binding), ErrPassphraseRequired / ErrDecryptionFailed sentinel errors, and PassphraseProvider hook for runtime passphrase injection - pkg/credential/store: lock-free SecureStore via atomic.Pointer[string]; passphrase never written to disk or os.Environ - pkg/credential/keygen: ed25519 SSH key generation helper used by onboard - pkg/config: replace os.Getenv(PassphraseEnvVar) with credential.PassphraseProvider() at all three call sites so that LoadConfig and SaveConfig use whatever passphrase source is active - cmd/picoclaw/onboard: prompt for passphrase with echo-off, generate picoclaw-specific SSH key, re-encrypt existing config on re-onboard - docs/credential_encryption.md: design doc for the enc:// format
62 lines
1.9 KiB
Go
62 lines
1.9 KiB
Go
package credential
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
// DefaultSSHKeyPath returns the canonical path for the picoclaw-specific SSH key.
|
|
// The path is always ~/.ssh/picoclaw_ed25519.key (os.UserHomeDir is cross-platform).
|
|
func DefaultSSHKeyPath() (string, error) {
|
|
home, err := os.UserHomeDir()
|
|
if err != nil {
|
|
return "", fmt.Errorf("credential: cannot determine home directory: %w", err)
|
|
}
|
|
return filepath.Join(home, ".ssh", "picoclaw_ed25519.key"), nil
|
|
}
|
|
|
|
// GenerateSSHKey generates an Ed25519 SSH key pair and writes the private key
|
|
// to path (permissions 0600) and the public key to path+".pub" (permissions 0644).
|
|
// The ~/.ssh/ directory is created with 0700 if it does not exist.
|
|
// If the files already exist they are overwritten.
|
|
func GenerateSSHKey(path string) error {
|
|
if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
|
|
return fmt.Errorf("credential: keygen: cannot create directory %q: %w", filepath.Dir(path), err)
|
|
}
|
|
|
|
pubRaw, privRaw, err := ed25519.GenerateKey(rand.Reader)
|
|
if err != nil {
|
|
return fmt.Errorf("credential: keygen: ed25519 key generation failed: %w", err)
|
|
}
|
|
|
|
// Marshal private key as OpenSSH PEM.
|
|
block, err := ssh.MarshalPrivateKey(privRaw, "")
|
|
if err != nil {
|
|
return fmt.Errorf("credential: keygen: marshal private key: %w", err)
|
|
}
|
|
privPEM := pem.EncodeToMemory(block)
|
|
|
|
if err := os.WriteFile(path, privPEM, 0o600); err != nil {
|
|
return fmt.Errorf("credential: keygen: write private key %q: %w", path, err)
|
|
}
|
|
|
|
// Marshal public key as authorized_keys line.
|
|
sshPub, err := ssh.NewPublicKey(pubRaw)
|
|
if err != nil {
|
|
return fmt.Errorf("credential: keygen: marshal public key: %w", err)
|
|
}
|
|
pubLine := ssh.MarshalAuthorizedKey(sshPub)
|
|
|
|
pubPath := path + ".pub"
|
|
if err := os.WriteFile(pubPath, pubLine, 0o644); err != nil {
|
|
return fmt.Errorf("credential: keygen: write public key %q: %w", pubPath, err)
|
|
}
|
|
|
|
return nil
|
|
}
|