go-eyaml

Pure-Go (CGO_ENABLED=0) implementation of hiera-eyaml's encryption schemes — the ENC[PKCS7,<base64>] and ENC[GPG,<base64>] token formats that carry an encrypted value inside otherwise-plaintext YAML.

• PKCS7 — built exclusively on the Go standard library's crypto packages (crypto/rsa, crypto/x509, crypto/aes, crypto/cipher, crypto/rand, encoding/pem, encoding/asn1); the PKCS#7 / CMS EnvelopedData structure (RFC 5652) is hand-assembled on those primitives.
• GPG — adds the maintained pure-Go OpenPGP implementation github.com/ProtonMail/go-crypto; still CGO_ENABLED=0 and built from source, so the whole module needs no cgo, just one additional (pure-Go) dependency for this scheme.

Both schemes cross-compile to the six 64-bit Go targets (amd64, arm64, riscv64, loong64, ppc64le, s390x) and to WebAssembly, and hold 100% test coverage, including error branches, as a CI gate.

Install

go get github.com/go-eyaml/eyaml

Usage

import "github.com/go-eyaml/eyaml"

// PKCS7
kp, _ := eyaml.CreateKeys(nil) // *KeyPair: PrivateKeyPEM, PublicKeyPEM
enc, _ := eyaml.NewPKCS7(kp.PublicKeyPEM, kp.PrivateKeyPEM)
token, _ := eyaml.Encrypt(enc, []byte("s3cret")) // ENC[PKCS7,...]

if eyaml.IsToken(token) {
	plain, _ := eyaml.Decrypt(enc, token) // "s3cret"
	_ = plain
}

// GPG — pubKeyRing/privKeyRing accept armored or binary OpenPGP keyrings.
enc, _ := eyaml.NewGPG(pubKeyRing, privKeyRing, passphrase)
token, _ := eyaml.Encrypt(enc, []byte("s3cret")) // ENC[GPG,...]
plain, _ := eyaml.Decrypt(enc, token)

See the API docs and go doc github.com/go-eyaml/eyaml for the full surface (Encryptor, KeyOptions, token helpers IsToken / ParseToken / FormatToken, LoadPrivateKey / LoadCertificate / LoadGPGKeyRing).

Performance

See BENCHMARKS.md for measured PKCS7/GPG figures against openssl cms and gpg on real hardware (IBM z15 / s390x).

License

BSD-3-Clause. See LICENSE.