Expand description
Encryption at rest for secrets files.
A passphrase is stretched into a 32-byte key with Argon2id (memory-hard), then the plaintext is sealed with XChaCha20-Poly1305 (authenticated, 24-byte random nonce). The on-disk envelope is a small text format so encrypted secrets can be committed and diffed line by line.
Functionsยง
- decrypt
- Decrypt an envelope produced by
encrypt. - encrypt
- Encrypt
plaintextwithpassphrase, returning the text envelope. - looks_
encrypted - Quick check used by tooling to decide whether a file is an envo envelope.
- resolve_
passphrase - Find the passphrase for crypto operations, in priority order: