Token format ready
IsToken / ParseToken / FormatToken for the ENC[PKCS7,<base64>] tokens hiera-eyaml embeds in YAML, tolerant of whitespace-wrapped values.
go-eyaml is a pure-Go (CGO_ENABLED=0) implementation of the two encryption schemes used by Puppet's hiera-eyaml: the ENC[PKCS7,<base64>] and ENC[GPG,<base64>] token formats that carry an encrypted value inside otherwise-plaintext YAML. For PKCS7, a random 256-bit AES content key encrypts the plaintext with AES-256-CBC, the content key is wrapped for the recipient with RSA PKCS#1 v1.5 under an X.509 certificate, and the whole thing is serialised as a CMS EnvelopedData (RFC 5652) token, built exclusively on the standard library's crypto packages. For GPG, a session key is public-key-encrypted to recipient OpenPGP keys exactly as gpg --encrypt does, using the pure-Go ProtonMail/go-crypto/openpgp implementation. Both stay CGO_ENABLED=0. 100% coverage, six arches and WebAssembly.
PKCS7 encryptor ready
A random AES-256 content key (AES-256-CBC, PKCS#7 padding) wrapped with RSA PKCS#1 v1.5 under an X.509 certificate, serialised as a CMS EnvelopedData ContentInfo — mirroring hiera-eyaml’s pkcs7 encryptor.
Key management ready
CreateKeys generates the RSA keypair and self-signed certificate that eyaml createkeys produces; LoadPrivateKey / LoadCertificate read PEM / PKCS8 material; LoadGPGKeyRing reads OpenPGP keyring material.
PKCS7 crypto ready
Built on crypto/rsa, crypto/x509, crypto/aes, crypto/cipher, crypto/rand, encoding/pem and encoding/asn1; the PKCS#7 / CMS structure is hand-assembled — no third-party crypto, no cgo.
GPG encryptor ready
NewGPG mirrors hiera-eyaml’s gpg (GPGME) encryptor on the pure-Go, CGO-free ProtonMail/go-crypto/openpgp, producing ENC[GPG,<base64>] tokens byte-for-byte interoperable with real gpg --encrypt / --decrypt.
- ready capability complete (exit criteria met, nothing material left)
- active in progress (substantial work shipped, not yet finished)
- planned not started yet (or documented deferral)
The hiera-eyaml encryption engine of the go-eyaml org: token format, PKCS7 and GPG encryptors, and key generation — CGO-free, PKCS7 on the Go standard library's crypto primitives alone, GPG adding one pure-Go OpenPGP dependency. Part of the pure-Go Puppet stack alongside go-facter, go-hiera, go-pcore and go-puppet.