dagger/keychain/encrypt.go

package keychain

import (
	"context"
	"fmt"
	"os"
	"time"

	"go.mozilla.org/sops/v3"
	sopsaes "go.mozilla.org/sops/v3/aes"
	sopsage "go.mozilla.org/sops/v3/age"
	"go.mozilla.org/sops/v3/cmd/sops/common"
	sopskeys "go.mozilla.org/sops/v3/keys"
	sopsyaml "go.mozilla.org/sops/v3/stores/yaml"
	"go.mozilla.org/sops/v3/version"
)

var (
	cipher = sopsaes.NewCipher()
)

// setupEnv: hack to inject a SOPS env var for age
func setupEnv() error {
	p, err := Path()
	if err != nil {
		return err
	}
	return os.Setenv("SOPS_AGE_KEY_FILE", p)
}

// Encrypt data using SOPS with the AGE backend, using the provided public key
func Encrypt(ctx context.Context, path string, plaintext []byte, key string) ([]byte, error) {
	if err := setupEnv(); err != nil {
		return nil, err
	}

	store := &sopsyaml.Store{}
	branches, err := store.LoadPlainFile(plaintext)
	if err != nil {
		return nil, err
	}

	ageKeys, err := sopsage.MasterKeysFromRecipients(key)
	if err != nil {
		return nil, err
	}
	ageMasterKeys := make([]sopskeys.MasterKey, 0, len(ageKeys))
	for _, k := range ageKeys {
		ageMasterKeys = append(ageMasterKeys, k)
	}
	var group sops.KeyGroup
	group = append(group, ageMasterKeys...)

	tree := sops.Tree{
		Branches: branches,
		Metadata: sops.Metadata{
			KeyGroups:       []sops.KeyGroup{group},
			EncryptedSuffix: "secret",
			Version:         version.Version,
		},
		FilePath: path,
	}

	// Generate a data key
	dataKey, errs := tree.GenerateDataKey()
	if len(errs) > 0 {
		return nil, fmt.Errorf("error encrypting the data key with one or more master keys: %v", errs)
	}

	err = common.EncryptTree(common.EncryptTreeOpts{
		DataKey: dataKey, Tree: &tree, Cipher: cipher,
	})
	if err != nil {
		return nil, err
	}
	return store.EmitEncryptedFile(tree)
}

// Reencrypt a file with new content using the same keys
func Reencrypt(_ context.Context, path string, plaintext []byte) ([]byte, error) {
	if err := setupEnv(); err != nil {
		return nil, err
	}

	current, err := os.ReadFile(path)
	if err != nil {
		return nil, err
	}

	// Load the encrypted file
	store := &sopsyaml.Store{}
	tree, err := store.LoadEncryptedFile(current)
	if err != nil {
		return nil, err
	}

	// Update the file with the new data
	newBranches, err := store.LoadPlainFile(plaintext)
	if err != nil {
		return nil, err
	}
	tree.Branches = newBranches

	// Re-encrypt the file
	key, err := tree.Metadata.GetDataKey()
	if err != nil {
		return nil, err
	}
	err = common.EncryptTree(common.EncryptTreeOpts{
		DataKey: key, Tree: &tree, Cipher: cipher,
	})
	if err != nil {
		return nil, err
	}

	return store.EmitEncryptedFile(tree)
}

// Decrypt data using sops
func Decrypt(_ context.Context, encrypted []byte) ([]byte, error) {
	if err := setupEnv(); err != nil {
		return nil, err
	}

	store := &sopsyaml.Store{}

	// Load SOPS file and access the data key
	tree, err := store.LoadEncryptedFile(encrypted)
	if err != nil {
		return nil, err
	}
	key, err := tree.Metadata.GetDataKey()
	if err != nil {
		return nil, err
	}

	// Decrypt the tree
	mac, err := tree.Decrypt(key, cipher)
	if err != nil {
		return nil, err
	}

	// Compute the hash of the cleartext tree and compare it with
	// the one that was stored in the document. If they match,
	// integrity was preserved
	originalMac, err := cipher.Decrypt(
		tree.Metadata.MessageAuthenticationCode,
		key,
		tree.Metadata.LastModified.Format(time.RFC3339),
	)
	if err != nil {
		return nil, err
	}
	if originalMac != mac {
		return nil, fmt.Errorf("failed to verify data integrity. expected mac %q, got %q", originalMac, mac)
	}

	return store.EmitPlainFile(tree.Branches)
}