age,agessh,armor: unleash public API 💥🦑

armor/armor.go

@@ -0,0 +1,143 @@
+// Copyright 2019 Google LLC
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd
+
+// Package armor provides a strict, streaming implementation of the ASCII
+// armoring format for age files.
+//
+// It's PEM with type "AGE ENCRYPTED FILE", 64 character columns, no headers,
+// and strict base64 decoding.
+package armor
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/base64"
+	"errors"
+	"io"
+
+	"filippo.io/age/internal/format"
+)
+
+const (
+	Header = "-----BEGIN AGE ENCRYPTED FILE-----"
+	Footer = "-----END AGE ENCRYPTED FILE-----"
+)
+
+type armoredWriter struct {
+	started, closed bool
+	encoder         io.WriteCloser
+	dst             io.Writer
+}
+
+func (a *armoredWriter) Write(p []byte) (int, error) {
+	if !a.started {
+		if _, err := io.WriteString(a.dst, Header+"\n"); err != nil {
+			return 0, err
+		}
+	}
+	a.started = true
+	return a.encoder.Write(p)
+}
+
+func (a *armoredWriter) Close() error {
+	if a.closed {
+		return errors.New("ArmoredWriter already closed")
+	}
+	a.closed = true
+	if err := a.encoder.Close(); err != nil {
+		return err
+	}
+	_, err := io.WriteString(a.dst, "\n"+Footer+"\n")
+	return err
+}
+
+func NewWriter(dst io.Writer) io.WriteCloser {
+	// TODO: write a test with aligned and misaligned sizes, and 8 and 10 steps.
+	return &armoredWriter{dst: dst,
+		encoder: base64.NewEncoder(base64.StdEncoding.Strict(),
+			format.NewlineWriter(dst))}
+}
+
+type armoredReader struct {
+	r       *bufio.Reader
+	started bool
+	unread  []byte // backed by buf
+	buf     [format.BytesPerLine]byte
+	err     error
+}
+
+func NewReader(r io.Reader) io.Reader {
+	return &armoredReader{r: bufio.NewReader(r)}
+}
+
+func (r *armoredReader) Read(p []byte) (int, error) {
+	if len(r.unread) > 0 {
+		n := copy(p, r.unread)
+		r.unread = r.unread[n:]
+		return n, nil
+	}
+	if r.err != nil {
+		return 0, r.err
+	}
+
+	getLine := func() ([]byte, error) {
+		line, err := r.r.ReadBytes('\n')
+		if err != nil && len(line) == 0 {
+			if err == io.EOF {
+				err = errors.New("invalid armor: unexpected EOF")
+			}
+			return nil, err
+		}
+		return bytes.TrimSpace(line), nil
+	}
+
+	if !r.started {
+		line, err := getLine()
+		if err != nil {
+			return 0, r.setErr(err)
+		}
+		if string(line) != Header {
+			return 0, r.setErr(errors.New("invalid armor first line: " + string(line)))
+		}
+		r.started = true
+	}
+	line, err := getLine()
+	if err != nil {
+		return 0, r.setErr(err)
+	}
+	if string(line) == Footer {
+		return 0, r.setErr(io.EOF)
+	}
+	if len(line) > format.ColumnsPerLine {
+		return 0, r.setErr(errors.New("invalid armor: column limit exceeded"))
+	}
+	r.unread = r.buf[:]
+	n, err := base64.StdEncoding.Strict().Decode(r.unread, line)
+	if err != nil {
+		return 0, r.setErr(errors.New("invalid armor: " + err.Error()))
+	}
+	r.unread = r.unread[:n]
+
+	if n < format.BytesPerLine {
+		line, err := getLine()
+		if err != nil {
+			return 0, r.setErr(err)
+		}
+		if string(line) != Footer {
+			return 0, r.setErr(errors.New("invalid armor closing line: " + string(line)))
+		}
+		r.err = io.EOF
+	}
+
+	nn := copy(p, r.unread)
+	r.unread = r.unread[nn:]
+	return nn, nil
+}
+
+func (r *armoredReader) setErr(err error) error {
+	r.err = err
+	return err
+}

armor/armor_test.go

@@ -0,0 +1,116 @@
+// Copyright 2019 Google LLC
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd
+
+package armor_test
+
+import (
+	"bytes"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"log"
+	"strings"
+	"testing"
+
+	"filippo.io/age/age"
+	"filippo.io/age/armor"
+)
+
+func ExampleNewWriter() {
+	publicKey := "age1cy0su9fwf3gf9mw868g5yut09p6nytfmmnktexz2ya5uqg9vl9sss4euqm"
+	recipient, err := age.ParseX25519Recipient(publicKey)
+	if err != nil {
+		log.Fatalf("Failed to parse public key %q: %v", publicKey, err)
+	}
+
+	buf := &bytes.Buffer{}
+	armorWriter := armor.NewWriter(buf)
+
+	w, err := age.Encrypt(armorWriter, recipient)
+	if err != nil {
+		log.Fatalf("Failed to create encrypted file: %v", err)
+	}
+	if _, err := io.WriteString(w, "Black lives matter."); err != nil {
+		log.Fatalf("Failed to write to encrypted file: %v", err)
+	}
+	if err := w.Close(); err != nil {
+		log.Fatalf("Failed to close encrypted file: %v", err)
+	}
+
+	if err := armorWriter.Close(); err != nil {
+		log.Fatalf("Failed to close armor: %v", err)
+	}
+
+	fmt.Printf("%s[...]", buf.Bytes()[:35])
+	// Output:
+	// -----BEGIN AGE ENCRYPTED FILE-----
+	// [...]
+}
+
+var privateKey = "AGE-SECRET-KEY-184JMZMVQH3E6U0PSL869004Y3U2NYV7R30EU99CSEDNPH02YUVFSZW44VU"
+
+func ExampleNewReader() {
+	fileContents := `-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4YWdhZHZ0WG1PZldDT1hD
+K3RPRzFkUlJnWlFBQlUwemtjeXFRMFp6V1VFCnRzZFV3a3Vkd1dSUWw2eEtrRkVv
+SHcvZnp6Q3lqLy9HMkM4ZjUyUGdDZjQKLS0tIDlpVUpuVUQ5YUJyUENFZ0lNSTB2
+ekUvS3E5WjVUN0F5ZWR1ejhpeU5rZUUKsvPGYt7vf0o1kyJ1eVFMz1e4JnYYk1y1
+kB/RRusYjn+KVJ+KTioxj0THtzZPXcjFKuQ1
+-----END AGE ENCRYPTED FILE-----`
+
+	// DO NOT hardcode the private key. Store it in a secret storage solution,
+	// on disk if the local machine is trusted, or have the user provide it.
+	identity, err := age.ParseX25519Identity(privateKey)
+	if err != nil {
+		log.Fatalf("Failed to parse private key %q: %v", privateKey, err)
+	}
+
+	out := &bytes.Buffer{}
+	f := strings.NewReader(fileContents)
+	armorReader := armor.NewReader(f)
+
+	r, err := age.Decrypt(armorReader, identity)
+	if err != nil {
+		log.Fatalf("Failed to open encrypted file: %v", err)
+	}
+	if _, err := io.Copy(out, r); err != nil {
+		log.Fatalf("Failed to read encrypted file: %v", err)
+	}
+
+	fmt.Printf("File contents: %q\n", out.Bytes())
+	// Output:
+	// File contents: "Black lives matter."
+}
+
+func TestArmor(t *testing.T) {
+	buf := &bytes.Buffer{}
+	w := armor.NewWriter(buf)
+	plain := make([]byte, 611)
+	if _, err := w.Write(plain); err != nil {
+		t.Fatal(err)
+	}
+	if err := w.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	block, _ := pem.Decode(buf.Bytes())
+	if block == nil {
+		t.Fatal("PEM decoding failed")
+	}
+	if !bytes.Equal(block.Bytes, plain) {
+		t.Error("PEM decoded value doesn't match")
+	}
+
+	r := armor.NewReader(buf)
+	out, err := ioutil.ReadAll(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(out, plain) {
+		t.Error("decoded value doesn't match")
+	}
+}