hugo/IronStorage
1
0
Fork 0
Code Issues 28 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix CLI passphrase provisioning

Browse Source 
Closes #60
This commit is contained in:
Hermes Agent
2026-08-10 07:43:19 +00:00
parent b503de8b2e
commit c82c792699
4 changed files with 514 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
crates/storage/src/crypto.rs
View File

@@ -93,13 +93,27 @@ impl KeyInfo {
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum SecretProviderError {
Missing,
Denied,
Unavailable,
Cancelled,
PersistenceFailed,
}
/// Supplies an unlock secret without exposing it to configuration or the key store.
pub trait SecretProvider {
fn secret_for(&mut self, key: &KeyInfo) -> Result<SecretBytes, SecretProviderError>;
/// Confirm that the supplied secret successfully unlocked the key.
///
/// Providers that provision secrets interactively can defer persistence
/// until this callback proves that the candidate was correct.
fn secret_accepted(&mut self, _key: &KeyInfo) -> Result<(), SecretProviderError> {
Ok(())
}
/// Report that the supplied secret did not unlock the key.
fn secret_rejected(&mut self, _key: &KeyInfo) {}
}
#[derive(Clone, Eq, PartialEq)]
@@ -417,27 +431,27 @@ impl KeyStore {
return Err(CryptoError::MissingSecretKey);
}
let mut unavailable = None;
let mut provider_failure = None;
let mut attempted = false;
for (fingerprint, material) in &candidates {
let secret = material.secret.as_ref().expect("filtered secret key");
let supplied = if secret_requires_password(secret) {
let info = key_info(material);
match provider.secret_for(&info) {
let key = secret_requires_password(secret).then(|| key_info(material));
let supplied = if let Some(info) = key.as_ref() {
match provider.secret_for(info) {
Ok(passphrase) => passphrase,
Err(SecretProviderError::Unavailable) => {
unavailable.get_or_insert_with(|| CryptoError::SecretProvider {
fingerprint: (*fingerprint).clone(),
reason: SecretProviderError::Unavailable,
});
continue;
}
Err(reason @ SecretProviderError::Cancelled) => {
return Err(CryptoError::SecretProvider {
fingerprint: (*fingerprint).clone(),
reason,
});
}
Err(reason) => {
provider_failure.get_or_insert_with(|| CryptoError::SecretProvider {
fingerprint: (*fingerprint).clone(),
reason,
});
continue;
}
}
} else {
SecretBytes::new(Vec::new())
@@ -449,13 +463,24 @@ impl KeyStore {
if let Ok(mut decrypted) = message.decrypt(&password, secret)
&& let Ok(plaintext) = decrypted.as_data_vec()
{
if let Some(info) = key.as_ref() {
provider.secret_accepted(info).map_err(|reason| {
CryptoError::SecretProvider {
fingerprint: (*fingerprint).clone(),
reason,
}
})?;
}
return Ok(SecretBytes::new(plaintext));
}
if let Some(info) = key.as_ref() {
provider.secret_rejected(info);
}
}
if attempted {
Err(CryptoError::DecryptionFailed)
} else {
Err(unavailable.expect("every candidate was unavailable"))
Err(provider_failure.expect("every candidate had a provider failure"))
}
}
@@ -475,21 +500,38 @@ impl KeyStore {
let target = signing_target(secret).ok_or_else(|| CryptoError::MissingSigningKey {
fingerprint: signer.0.clone(),
})?;
let supplied = if signing_target_requires_password(target) {
provider.secret_for(&key_info(material)).map_err(|reason| {
CryptoError::SecretProvider {
let key = signing_target_requires_password(target).then(|| key_info(material));
let supplied = if let Some(info) = key.as_ref() {
provider
.secret_for(info)
.map_err(|reason| CryptoError::SecretProvider {
fingerprint: signer.0.clone(),
reason,
}
})?
})?
} else {
SecretBytes::new(Vec::new())
};
let password = Password::from(supplied.expose());
let signature = match target {
let signature = match match target {
SigningTarget::Primary(key) => sign_data(key, &password, data),
SigningTarget::Subkey(key) => sign_data(key, &password, data),
}?;
} {
Ok(signature) => signature,
Err(error) => {
if let Some(info) = key.as_ref() {
provider.secret_rejected(info);
}
return Err(error);
}
};
if let Some(info) = key.as_ref() {
provider
.secret_accepted(info)
.map_err(|reason| CryptoError::SecretProvider {
fingerprint: signer.0.clone(),
reason,
})?;
}
let mut bytes = Vec::new();
signature
.to_writer(&mut bytes)

163
crates/storage/src/secret_store.rs
View File

@@ -25,6 +25,8 @@ const RECORD_VERSION: u8 = 1;
const MAX_SECRET_BYTES: usize = 1024;
const MAX_CACHE_LIFETIME: Duration = Duration::from_secs(15 * 60);
const MAX_CACHE_CAPACITY: usize = 128;
const OPENPGP_PASSPHRASE_SERVICE: &str = "de.rfc1437.ironstorage.openpgp-passphrase";
const HTTPS_GIT_SERVICE: &str = "de.rfc1437.ironstorage.https-git";
/// The purpose and stable, non-secret identity of an OS credential.
#[derive(Clone, Eq, Ord, PartialEq, PartialOrd)]
@@ -154,15 +156,12 @@ impl SecretLocator {
fn service_and_user(&self) -> (&'static str, String) {
match self {
Self::OpenPgpPassphrase { fingerprint } => {
("org.ironstorage.openpgp-passphrase", fingerprint.clone())
(OPENPGP_PASSPHRASE_SERVICE, fingerprint.clone())
}
Self::HttpsGitCredential {
server_id,
application_id,
} => (
"org.ironstorage.https-git",
format!("{server_id}/{application_id}"),
),
} => (HTTPS_GIT_SERVICE, format!("{server_id}/{application_id}")),
}
}
}
@@ -276,6 +275,24 @@ impl fmt::Display for SecretStoreError {
impl Error for SecretStoreError {}
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum OpenPgpPassphrasePromptError {
Cancelled,
Unavailable,
}
/// Collects an OpenPGP passphrase for storage-owned provisioning.
///
/// Implementations are presentation adapters only. Storage decides when a
/// prompt is required and persists the candidate only after the crypto layer
/// confirms that it successfully unlocked the requested key.
pub trait OpenPgpPassphrasePrompt: Send + Sync {
fn request_passphrase(
&mut self,
key: &KeyInfo,
) -> Result<SecretBytes, OpenPgpPassphrasePromptError>;
}
/// Mockable contract implemented by each operating-system adapter.
pub trait SecretStoreBackend: Send + Sync {
fn create(
@@ -318,6 +335,12 @@ struct StoreState {
unlocked: bool,
sequence: u64,
cache: BTreeMap<SecretLocator, CachedSecret>,
pending_openpgp: Option<PendingOpenPgpPassphrase>,
}
struct PendingOpenPgpPassphrase {
reference: SecretReference,
value: SecretBytes,
}
pub struct SecretStore<B> {
@@ -325,6 +348,7 @@ pub struct SecretStore<B> {
cache_policy: SecretCachePolicy,
protections: SecretProtectionPolicy,
state: Mutex<StoreState>,
openpgp_prompt: Option<Box<dyn OpenPgpPassphrasePrompt>>,
}
impl<B> fmt::Debug for SecretStore<B> {
@@ -352,10 +376,20 @@ impl<B: SecretStoreBackend> SecretStore<B> {
unlocked: false,
sequence: 0,
cache: BTreeMap::new(),
pending_openpgp: None,
}),
openpgp_prompt: None,
}
}
pub fn with_openpgp_passphrase_prompt(
mut self,
prompt: impl OpenPgpPassphrasePrompt + 'static,
) -> Self {
self.openpgp_prompt = Some(Box::new(prompt));
self
}
pub fn is_locked(&self) -> bool {
self.state.lock().map_or(true, |state| !state.unlocked)
}
@@ -377,6 +411,7 @@ impl<B: SecretStoreBackend> SecretStore<B> {
.map_err(|_| SecretStoreError::Unavailable)?;
state.unlocked = false;
state.cache.clear();
state.pending_openpgp = None;
self.backend.lock()
}
@@ -503,6 +538,17 @@ impl<B: SecretStoreBackend> SecretStore<B> {
Ok(state)
}
fn clear_pending_openpgp(&self, reference: &SecretReference) {
if let Ok(mut state) = self.state.lock()
&& state
.pending_openpgp
.as_ref()
.is_some_and(|pending| &pending.reference == reference)
{
state.pending_openpgp = None;
}
}
fn cache_get(&self, state: &mut StoreState, locator: &SecretLocator) -> Option<SecretBytes> {
let SecretCachePolicy::Timed { .. } = self.cache_policy else {
return None;
@@ -563,7 +609,63 @@ impl<B: SecretStoreBackend> SecretProvider for SecretStore<B> {
fn secret_for(&mut self, key: &KeyInfo) -> Result<SecretBytes, SecretProviderError> {
let reference = SecretReference::openpgp_passphrase(key.fingerprint().as_str())
.map_err(|_| SecretProviderError::Unavailable)?;
self.retrieve(&reference).map_err(provider_error)
self.clear_pending_openpgp(&reference);
match self.retrieve(&reference) {
Ok(secret) => Ok(secret),
Err(SecretStoreError::Missing) if self.openpgp_prompt.is_some() => {
let candidate = self
.openpgp_prompt
.as_mut()
.expect("checked prompt")
.request_passphrase(key)
.map_err(prompt_error)?;
validate_secret(&candidate).map_err(|_| SecretProviderError::PersistenceFailed)?;
let output = copy_secret(&candidate);
let mut state = self
.state
.lock()
.map_err(|_| SecretProviderError::Unavailable)?;
if !state.unlocked {
return Err(SecretProviderError::Unavailable);
}
state.pending_openpgp = Some(PendingOpenPgpPassphrase {
reference,
value: candidate,
});
Ok(output)
}
Err(error) => Err(provider_error(error)),
}
}
fn secret_accepted(&mut self, key: &KeyInfo) -> Result<(), SecretProviderError> {
let reference = SecretReference::openpgp_passphrase(key.fingerprint().as_str())
.map_err(|_| SecretProviderError::Unavailable)?;
let pending = {
let mut state = self
.state
.lock()
.map_err(|_| SecretProviderError::Unavailable)?;
match state.pending_openpgp.take() {
Some(pending) if pending.reference == reference => Some(pending),
Some(pending) => {
state.pending_openpgp = Some(pending);
None
}
None => None,
}
};
if let Some(pending) = pending {
self.create(&pending.reference, pending.value)
.map_err(persistence_error)?;
}
Ok(())
}
fn secret_rejected(&mut self, key: &KeyInfo) {
if let Ok(reference) = SecretReference::openpgp_passphrase(key.fingerprint().as_str()) {
self.clear_pending_openpgp(&reference);
}
}
}
@@ -591,11 +693,31 @@ impl<B: SecretStoreBackend> GitCredentialProvider for SecretStore<B> {
fn provider_error(error: SecretStoreError) -> SecretProviderError {
match error {
SecretStoreError::Missing => SecretProviderError::Missing,
SecretStoreError::Denied => SecretProviderError::Denied,
SecretStoreError::Cancelled => SecretProviderError::Cancelled,
_ => SecretProviderError::Unavailable,
}
}
fn prompt_error(error: OpenPgpPassphrasePromptError) -> SecretProviderError {
match error {
OpenPgpPassphrasePromptError::Cancelled => SecretProviderError::Cancelled,
OpenPgpPassphrasePromptError::Unavailable => SecretProviderError::Unavailable,
}
}
fn persistence_error(error: SecretStoreError) -> SecretProviderError {
match error {
SecretStoreError::Denied => SecretProviderError::Denied,
SecretStoreError::Cancelled => SecretProviderError::Cancelled,
SecretStoreError::Unavailable | SecretStoreError::Locked => {
SecretProviderError::Unavailable
}
_ => SecretProviderError::PersistenceFailed,
}
}
fn git_provider_error(error: SecretStoreError) -> GitError {
match error {
SecretStoreError::Cancelled => GitError::CredentialCancelled,
@@ -746,7 +868,10 @@ fn copy_secret(value: &SecretBytes) -> SecretBytes {
#[cfg(test)]
mod tests {
use super::{RECORD_MAGIC, RECORD_VERSION, SecretBytes, SecretStoreError, decode_record};
use super::{
HTTPS_GIT_SERVICE, OPENPGP_PASSPHRASE_SERVICE, RECORD_MAGIC, RECORD_VERSION, SecretBytes,
SecretLocator, SecretStoreError, decode_record,
};
fn openpgp_record(fingerprint: &[u8], secret: &[u8]) -> SecretBytes {
let mut record = Vec::new();
@@ -774,4 +899,28 @@ mod tests {
Err(SecretStoreError::Corrupted)
));
}
#[test]
fn native_service_names_use_the_canonical_bundle_identifier() {
let openpgp = SecretLocator::OpenPgpPassphrase {
fingerprint: "0123456789ABCDEF0123456789ABCDEF01234567".to_owned(),
};
let git = SecretLocator::HttpsGitCredential {
server_id: "server".to_owned(),
application_id: "application".to_owned(),
};
assert_eq!(
openpgp.service_and_user(),
(
OPENPGP_PASSPHRASE_SERVICE,
"0123456789ABCDEF0123456789ABCDEF01234567".to_owned()
)
);
assert_eq!(
git.service_and_user(),
(HTTPS_GIT_SERVICE, "server/application".to_owned())
);
assert!(OPENPGP_PASSPHRASE_SERVICE.starts_with("de.rfc1437.ironstorage."));
assert!(HTTPS_GIT_SERVICE.starts_with("de.rfc1437.ironstorage."));
}
}