// Decrypt reads an ejson stream from 'in' and writes the decrypted data to 'out'.
// The private key is expected to be under 'keydir'.
// Returns error upon failure, or nil on success.
func Decrypt(in io.Reader, out io.Writer, keydir string) error {
data, err := ioutil.ReadAll(in)
if err != nil {
return err
}
pubkey, err := json.ExtractPublicKey(data)
if err != nil {
return err
}
privkey, err := findPrivateKey(pubkey, keydir)
if err != nil {
return err
}
myKP := crypto.Keypair{
Public: pubkey,
Private: privkey,
}
decrypter := myKP.Decrypter()
walker := json.Walker{
Action: decrypter.Decrypt,
}
newdata, err := walker.Walk(data)
if err != nil {
return err
}
_, err = out.Write(newdata)
return err
}
// DecryptFile takes a path to an encrypted EJSON file and decrypts it to
// STDOUT. If any keys in the file are encryptable but currently-unencrypted,
// ejson will print an error and exit non-zero, as this condition probably
// indicates that a plaintext secret was committed to source control, and
// requires manual intervention to rotate.
//
// The public key used to encrypt the values is embedded in the referenced
// document, and the matching private key is searched for in keydir. There must
// exist a file in keydir whose name is the public key from the EJSON document,
// and whose contents are the corresponding private key. See README.md for more
// details on this.
func DecryptFile(filePath, keydir string) (string, error) {
data, err := readFile(filePath)
if err != nil {
return "", err
}
pubkey, err := json.ExtractPublicKey(data)
if err != nil {
return "", err
}
privkey, err := findPrivateKey(pubkey, keydir)
if err != nil {
return "", err
}
myKP := crypto.Keypair{
Public: pubkey,
Private: privkey,
}
decrypter := myKP.Decrypter()
walker := json.Walker{
Action: decrypter.Decrypt,
}
newdata, err := walker.Walk(data)
if err != nil {
return "", err
}
return string(newdata), nil
}
func (c *ctx) decrypt(value string) (string, error) {
kp := crypto.Keypair{
Public: c.publicKeyBytes,
Private: c.privateKeyBytes,
}
decrypter := kp.Decrypter()
v, err := decrypter.Decrypt([]byte(value))
if err != nil {
return "", err
}
return string(v), nil
}
