Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider migrating pass-driver to GPG library #2330

Open
udf2457 opened this issue Feb 22, 2025 · 0 comments
Open

Consider migrating pass-driver to GPG library #2330

udf2457 opened this issue Feb 22, 2025 · 0 comments

Comments

@udf2457
Copy link

udf2457 commented Feb 22, 2025

At present containers/common/blob/pkg/secrets/passdriver/passdriver.go shells out to gpg.

However, it may not always be reasonable to assume that gpg is available. This is perhaps the case with immutable operating systems such as Fedora CoreOS, OpenSuSe MicroOS and others.

Availability of gpg aside, shelling out is also risky from a security perspective, leaving you open to all sorts of side-channel and other attacks.

Meanwhile there are readily available, widely deployed, Go gpg libraries such as ProtonMail/gopenpgp

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant