self-hosted/docker-volume-backup
1
0
Fork 0
mirror of https://github.com/offen/docker-volume-backup.git synced 2025-11-23 21:44:40 +02:00
Code Issues Releases Activity

Support passing standard ssh keys to age encryption (#530)

Browse Source 
* Support passing standard ssh keys to age encryption

* Cover SSH keys in age test case
This commit is contained in:
Frederik Ring
2025-02-07 13:43:41 +01:00
committed by GitHub
parent 2652e05169
commit cbbaa6ba7a
5 changed files with 25 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
cmd/backup/encrypt_archive.go
View File

@@ -10,8 +10,10 @@ import (
"io"
"os"
"path"
"strings"
"filippo.io/age"
"filippo.io/age/agessh"
"github.com/ProtonMail/go-crypto/openpgp/armor"
openpgp "github.com/ProtonMail/go-crypto/openpgp/v2"
"github.com/offen/docker-volume-backup/internal/errwrap"
@@ -73,7 +75,7 @@ func (s *script) getConfiguredAgeRecipients() ([]age.Recipient, error) {
recipients := []age.Recipient{}
if len(s.c.AgePublicKeys) > 0 {
for _, pk := range s.c.AgePublicKeys {
pkr, err := age.ParseX25519Recipient(pk)
pkr, err := parseAgeRecipient(pk)
if err != nil {
return nil, errwrap.Wrap(err, "failed to parse age public key")
}
@@ -94,6 +96,18 @@ func (s *script) getConfiguredAgeRecipients() ([]age.Recipient, error) {
return recipients, nil
}
func parseAgeRecipient(arg string) (age.Recipient, error) {
// This logic is adapted from what the age CLI is doing
// stripping some special cases
switch {
case strings.HasPrefix(arg, "age1"):
return age.ParseX25519Recipient(arg)
case strings.HasPrefix(arg, "ssh-"):
return agessh.ParseRecipient(arg)
}
return nil, fmt.Errorf("unknown recipient type: %q", arg)
}
func (s *script) encryptWithAge(rec []age.Recipient) error {
return s.doEncrypt("age", func(ciphertextWriter io.Writer) (io.WriteCloser, error) {
return age.Encrypt(ciphertextWriter, rec...)