sniptt-official / ots Goto Github PK

Add some basic test coverage starting with the encrypt package.

https://ots.sniptt.com/view/Ndz6zTFFW4OBweYK?region=eu-central-1&ref=web#Hk3OwhtnymqcPkZL5CCn2w

An interesting optional feature would be to protect the encryption key using a password. The recipient would have to enter the password on the web page, the decryption still fully client-side.

It could be done using derivation directly, stretching the password to derive the encryption key. But that would undermine the encryption security, making the cyphertext as weak/strong as the password. Another approach is to derive a KEK from the password, wrapping the fully random encryption key. This way the cyphertext is not impacted, and the security level of the password is kept client-side.

Ideally, we'd somehow use the current tag when building the binary to embed the version. I am assuming this can be done via ldflags.

npx cdk bootstrap 'aws://123456789012/us-east-1' --profile dev

⏳  Bootstrapping environment aws://123456789012/us-east-1...
 ❌  Environment aws://123456789012/us-east-1 failed bootstrapping: Error: Need to perform AWS calls for account 123456789012, but no credentials have been configured
    at SdkProvider.forEnvironment (/www/ots/node_modules/aws-cdk/lib/index.js:284:44976)
    at async BootstrapStack.lookup (/www/ots/node_modules/aws-cdk/lib/index.js:371:19012)
    at async Bootstrapper.modernBootstrap (/www/ots/node_modules/aws-cdk/lib/index.js:372:1084)
    at async /www/ots/node_modules/aws-cdk/lib/index.js:376:2104
    at async Promise.all (index 0)
    at async CdkToolkit.bootstrap (/www/ots/node_modules/aws-cdk/lib/index.js:376:1949)
    at async exec4 (/www/ots/node_modules/aws-cdk/lib/index.js:429:51795)

Need to perform AWS calls for account 123456789012, but no credentials have been configured

Ideally, this would be configurable, I assume should be possible via ENV var and/or flag during build.

Might also make sense to make this configurable by the user, however that would be a separate issue.

As in title

Thanks for the interesting tool!

I want to store yaml and json data exactly as they are without changes to their indentation:

{
  "foo": "bar"
}

Indentation in json is not very important, but can become ugly when the json data is larger.

version: v1alpha1
metadata:
  name: secret-data
spec:
  data:
    - hello world

Expected

The expected outcome is that I get the same data back, without change in indentations. Especially yaml should stay exactly the same because the syntax depends on indentation.

Actual result

{
"foo": "baar"
}

version: v1alpha1
metadata:
name: secret-data
spec:
data:
- hello world

It might be that the fault lies in the underlying encryption package.

The fragment part of the URI is not sent over the network to the server. That would ensure the key is never seen by your servers.

The following statement would then not be needed anymore by design, as the client code is auditable.

We do not log, track, share, or store the encryption key that protects your secret.