func decryptFile(store sops.Store, fileBytes []byte, ignoreMac bool) (sops.Tree, error) {
var tree sops.Tree
metadata, err := store.UnmarshalMetadata(fileBytes)
if err != nil {
return tree, cli.NewExitError(fmt.Sprintf("Error loading file: %s", err), exitCouldNotReadInputFile)
}
key, err := metadata.GetDataKey()
if err != nil {
return tree, cli.NewExitError(err.Error(), exitCouldNotRetrieveKey)
}
branch, err := store.Unmarshal(fileBytes)
if err != nil {
return tree, cli.NewExitError(fmt.Sprintf("Error loading file: %s", err), exitCouldNotReadInputFile)
}
tree = sops.Tree{Branch: branch, Metadata: metadata}
cipher := aes.Cipher{}
mac, err := tree.Decrypt(key, cipher)
if err != nil {
return tree, cli.NewExitError(fmt.Sprintf("Error decrypting tree: %s", err), exitErrorDecryptingTree)
}
originalMac, err := cipher.Decrypt(metadata.MessageAuthenticationCode, key, []byte(metadata.LastModified.Format(time.RFC3339)))
if originalMac != mac && !ignoreMac {
return tree, cli.NewExitError(fmt.Sprintf("MAC mismatch. File has %s, computed %s", originalMac, mac), 9)
}
return tree, nil
}
func loadEncryptedFile(c *cli.Context, store sops.Store, fileBytes []byte) (tree sops.Tree, err error) {
metadata, err := store.UnmarshalMetadata(fileBytes)
if err != nil {
return tree, cli.NewExitError(fmt.Sprintf("Error loading file metadata: %s", err), exitCouldNotReadInputFile)
}
branch, err := store.Unmarshal(fileBytes)
if err != nil {
return tree, cli.NewExitError(fmt.Sprintf("Error loading file: %s", err), exitCouldNotReadInputFile)
}
return sops.Tree{
Branch: branch,
Metadata: metadata,
}, nil
}