Module crypto 

Native SOPS-over-age encryption for open_envault.

This crate implements the SOPS file format for dotenv documents with age recipients, so open_envault needs no external sops/rage binaries and files remain interchangeable with official SOPS. See store for the format and keys for age key handling.

Modules

keys

Age key handling: recipients, identities, data-key wrapping, and key generation.

store

SOPS-compatible dotenv store.

util

Small time helpers: SOPS metadata timestamps are RFC 3339, second precision, UTC (time.RFC3339 in Go).

value

SOPS value encryption: the ENC[AES256_GCM,...] strings.

Structs

Identity

The classic age identity type, which can decrypt files encrypted to the corresponding Recipient.

Recipient

The classic age recipient type. Files encrypted to this recipient can be decrypted with the corresponding Identity.

Functions

decrypt

Decrypt the file at path using environment-supplied identities only.

decrypt_for

Decrypt the file at path using identities from the environment and (when environment is given) the default per-user key file for that environment.

default_key_dir

Default per-user key directory (relative to the config home).

encrypt

Encrypt content and write it to path atomically for recipients.

generate_key

Generate a fresh age identity and write it to path (mode 0600). Returns the full key-file text so callers can print the public key.

recipients_of

List the recipients recorded in the encrypted file at path.