mirror of
https://github.com/sipeed/picoclaw.git
synced 2026-06-12 18:08:54 +00:00
sky5454
2f10b47f59
* feat(credential): add AES-GCM encryption, SecureStore, and onboard keygen - pkg/credential: new package with AES-256-GCM enc:// credential format, HKDF-SHA256 key derivation (passphrase + optional SSH key binding), ErrPassphraseRequired / ErrDecryptionFailed sentinel errors, and PassphraseProvider hook for runtime passphrase injection - pkg/credential/store: lock-free SecureStore via atomic.Pointer[string]; passphrase never written to disk or os.Environ - pkg/credential/keygen: ed25519 SSH key generation helper used by onboard - pkg/config: replace os.Getenv(PassphraseEnvVar) with credential.PassphraseProvider() at all three call sites so that LoadConfig and SaveConfig use whatever passphrase source is active - cmd/picoclaw/onboard: prompt for passphrase with echo-off, generate picoclaw-specific SSH key, re-encrypt existing config on re-onboard - docs/credential_encryption.md: design doc for the enc:// format * fix(credential): address Copilot review comments on PR #1521 - credential.go: decouple ErrPassphraseRequired from env var name; message is now 'enc:// passphrase required' since PassphraseProvider may come from any source, not just os.Environ - credential.go: Resolver resolves symlinks via EvalSymlinks before the isWithinDir containment check, preventing symlink-based path traversal for file:// credential references - store.go: tighten comment to describe only what SecureStore guarantees (in-memory only); remove claims about how callers transport the value - store_test.go: replace the meaningless GetReturnsCopy test (Go strings are immutable, equality across two calls proves nothing) with TestSecureStore_ConcurrentSetGet that exercises atomic.Pointer under 10-goroutine concurrent Set/Get load - config_test.go: update error-message assertion to match new sentinel text - docs/credential_encryption.md: remove reference to non-existent 'picoclaw encrypt' subcommand; describe the onboard flow instead * fix(config): encryptPlaintextAPIKeys: struct-based encryption, fail-fast, remove raw []byte * fix(credential): require SSH private key for encryption/decryption, remove passphrase-only mode * lint: fix credential keygen lint, fix test keygen * onboard: make encryption opt-in via --enc flag Encryption (passphrase prompt + SSH key generation) is now only triggered when the user passes --enc to 'picoclaw onboard'. Without the flag, onboard skips the credential-encryption setup and writes a plain config + workspace templates directly. - Add --enc BoolFlag in NewOnboardCommand() - Pass encrypt bool into onboard() - Guard passphrase prompt, SSH key generation, and related env-var setup behind the encrypt branch - Adjust 'Next steps' output so the passphrase reminder only appears when --enc was used
63 lines
1.9 KiB
Go
63 lines
1.9 KiB
Go
package credential
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
// DefaultSSHKeyPath returns the canonical path for the picoclaw-specific SSH key.
|
|
// The path is always ~/.ssh/picoclaw_ed25519.key (os.UserHomeDir is cross-platform).
|
|
func DefaultSSHKeyPath() (string, error) {
|
|
home, err := os.UserHomeDir()
|
|
if err != nil {
|
|
return "", fmt.Errorf("credential: cannot determine home directory: %w", err)
|
|
}
|
|
return filepath.Join(home, ".ssh", "picoclaw_ed25519.key"), nil
|
|
}
|
|
|
|
// GenerateSSHKey generates an Ed25519 SSH key pair and writes the private key
|
|
// to path (permissions 0600) and the public key to path+".pub" (permissions 0644).
|
|
// The ~/.ssh/ directory is created with 0700 if it does not exist.
|
|
// If the files already exist they are overwritten.
|
|
func GenerateSSHKey(path string) error {
|
|
if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
|
|
return fmt.Errorf("credential: keygen: cannot create directory %q: %w", filepath.Dir(path), err)
|
|
}
|
|
|
|
pubRaw, privRaw, err := ed25519.GenerateKey(rand.Reader)
|
|
if err != nil {
|
|
return fmt.Errorf("credential: keygen: ed25519 key generation failed: %w", err)
|
|
}
|
|
|
|
// Marshal private key as OpenSSH PEM.
|
|
block, err := ssh.MarshalPrivateKey(privRaw, "")
|
|
if err != nil {
|
|
return fmt.Errorf("credential: keygen: marshal private key: %w", err)
|
|
}
|
|
privPEM := pem.EncodeToMemory(block)
|
|
|
|
if err = os.WriteFile(path, privPEM, 0o600); err != nil {
|
|
return fmt.Errorf("credential: keygen: write private key %q: %w", path, err)
|
|
}
|
|
|
|
// Marshal public key as authorized_keys line.
|
|
sshPub, err := ssh.NewPublicKey(pubRaw)
|
|
if err != nil {
|
|
return fmt.Errorf("credential: keygen: marshal public key: %w", err)
|
|
}
|
|
pubLine := ssh.MarshalAuthorizedKey(sshPub)
|
|
|
|
pubPath := path + ".pub"
|
|
if err := os.WriteFile(pubPath, pubLine, 0o644); err != nil {
|
|
return fmt.Errorf("credential: keygen: write public key %q: %w", pubPath, err)
|
|
}
|
|
|
|
return nil
|
|
}
|