Skip to content

Use `sled` for persistent secret storage, `linux-keyutils` for caching

Jacob Bentley requested to merge KMS into main

It turns out Linux keys cannot (or should not) be used for long-term, persistent secret storage. This will introduce a sled database for storing secrets on disk in the stash directory. Linux keys have been repurposed for secret caching to avoid disk I/O whenever possible.

  • Introduces Secret struct and associated methods for generating or storing encryption secrets
  • Adds the db field to the Stash struct
  • Stores sled database in stash directory at .db
  • Adds a hidden file .secret to store key and nonce for .db (not encrypting it, though, for now)
  • Preferentially checks for and uses Linux keys over db entries
  • Adds error checking for existing files to prevent data corruption on bad encrypts/decrypts

Merge request reports

Loading