open-envault 0.3.0

Local-first SOPS-compatible secrets for Git and Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

use serde::Serialize;
use sha2::{Digest, Sha256};

pub fn redact(value: &str) -> String {
    if value.is_empty() {
        "<empty>".into()
    } else {
        "<redacted>".into()
    }
}

#[derive(Debug, Serialize)]
pub struct Finding {
    pub variable: String,
    pub kind: String,
    pub message: String,
}

pub fn json<T: Serialize>(value: &T) -> anyhow::Result<String> {
    Ok(serde_json::to_string_pretty(value)?)
}

pub fn fingerprint(pepper: &str, value: &str) -> String {
    let mut key = [0u8; 64];
    let pepper = pepper.as_bytes();
    if pepper.len() > key.len() {
        key[..32].copy_from_slice(&Sha256::digest(pepper));
    } else {
        key[..pepper.len()].copy_from_slice(pepper);
    }
    let mut inner = Sha256::new();
    for byte in key {
        inner.update([byte ^ 0x36]);
    }
    inner.update(value.as_bytes());
    let inner = inner.finalize();
    let mut outer = Sha256::new();
    for byte in key {
        outer.update([byte ^ 0x5c]);
    }
    outer.update(inner);
    hex::encode(&outer.finalize()[..12])
}

#[derive(Debug, Serialize)]
pub struct CheckEnvelope<T: Serialize> {
    pub ok: bool,
    pub exit: u8,
    pub findings: T,
}

#[derive(Debug, Serialize)]
pub struct DiffEnvelope<T: Serialize> {
    pub ok: bool,
    pub exit: u8,
    pub variables: T,
}