Merge pull request #1692 from haoqixu/age-ssh

Add SSH support for age

Author: felixfontein

README.rst

@@ -233,7 +233,13 @@ The contents of this key file should be a list of age X25519 identities, one
 per line. Lines beginning with ``#`` are considered comments and ignored. Each
 identity will be tried in sequence until one is able to decrypt the data.
 
-Encrypting with SSH keys via age is not yet supported by SOPS.
+Encrypting with SSH keys via age is also supported by SOPS. You can use SSH public keys
+("ssh-ed25519 AAAA...", "ssh-rsa AAAA...") as age recipients when encrypting a file.
+When decrypting a file, SOPS will look for ``~/.ssh/id_ed25519`` and falls back to
+``~/.ssh/id_rsa``. You can specify the location of the private key manually by setting
+the environment variableuse **SOPS_AGE_SSH_PRIVATE_KEY_FILE**.
+
+Note that only ``ssh-rsa`` and ``ssh-ed25519`` are supported.
 
 A list of age recipients can be added to the ``.sops.yaml``:
 

age/keysource.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"filippo.io/age"
+	"filippo.io/age/agessh"
 	"filippo.io/age/armor"
 	"github.com/sirupsen/logrus"
 
@@ -24,6 +25,9 @@ const (
 	// SopsAgeKeyFileEnv can be set as an environment variable pointing to an
 	// age keys file.
 	SopsAgeKeyFileEnv = "SOPS_AGE_KEY_FILE"
+	// SopsAgeSshPrivateKeyFileEnv can be set as an environment variable pointing to
+	// a private SSH key file.
+	SopsAgeSshPrivateKeyFileEnv = "SOPS_AGE_SSH_PRIVATE_KEY_FILE"
 	// SopsAgeKeyUserConfigPath is the default age keys file path in
 	// getUserConfigDir().
 	SopsAgeKeyUserConfigPath = "sops/age/keys.txt"
@@ -60,7 +64,7 @@ type MasterKey struct {
 	parsedIdentities []age.Identity
 	// parsedRecipient contains a parsed age public key.
 	// It is used to lazy-load the Recipient at-most once.
-	parsedRecipient *age.X25519Recipient
+	parsedRecipient age.Recipient
 }
 
 // MasterKeysFromRecipients takes a comma-separated list of Bech32-encoded
@@ -233,6 +237,35 @@ func (key *MasterKey) TypeToIdentifier() string {
 	return KeyTypeIdentifier
 }
 
+// loadAgeSSHIdentity attempts to load the age SSH identity based on an SSH
+// private key from the SopsAgeSshPrivateKeyFileEnv environment variable. If the
+// environment variable is not present, it will fall back to `~/.ssh/id_ed25519`
+// or `~/.ssh/id_rsa`. If no age SSH identity is found, it will return nil.
+func loadAgeSSHIdentity() (age.Identity, error) {
+	sshKeyFilePath, ok := os.LookupEnv(SopsAgeSshPrivateKeyFileEnv)
+	if ok {
+		return parseSSHIdentityFromPrivateKeyFile(sshKeyFilePath)
+	}
+
+	userHomeDir, err := os.UserHomeDir()
+	if err != nil || userHomeDir == "" {
+		log.Warnf("could not determine the user home directory: %v", err)
+		return nil, nil
+	}
+
+	sshEd25519PrivateKeyPath := filepath.Join(userHomeDir, ".ssh", "id_ed25519")
+	if _, err := os.Stat(sshEd25519PrivateKeyPath); err == nil {
+		return parseSSHIdentityFromPrivateKeyFile(sshEd25519PrivateKeyPath)
+	}
+
+	sshRsaPrivateKeyPath := filepath.Join(userHomeDir, ".ssh", "id_rsa")
+	if _, err := os.Stat(sshRsaPrivateKeyPath); err == nil {
+		return parseSSHIdentityFromPrivateKeyFile(sshRsaPrivateKeyPath)
+	}
+
+	return nil, nil
+}
+
 func getUserConfigDir() (string, error) {
 	if runtime.GOOS == "darwin" {
 		if userConfigDir, ok := os.LookupEnv(xdgConfigHome); ok && userConfigDir != "" {
@@ -244,9 +277,19 @@ func getUserConfigDir() (string, error) {
 
 // loadIdentities attempts to load the age identities based on runtime
 // environment configurations (e.g. SopsAgeKeyEnv, SopsAgeKeyFileEnv,
-// SopsAgeKeyUserConfigPath). It will load all found references, and expects
-// at least one configuration to be present.
+// SopsAgeSshPrivateKeyFileEnv, SopsAgeKeyUserConfigPath). It will load all
+// found references, and expects at least one configuration to be present.
 func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
+	var identities ParsedIdentities
+
+	sshIdentity, err := loadAgeSSHIdentity()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get SSH identity: %w", err)
+	}
+	if sshIdentity != nil {
+		identities = append(identities, sshIdentity)
+	}
+
 	var readers = make(map[string]io.Reader, 0)
 
 	if ageKey, ok := os.LookupEnv(SopsAgeKeyEnv); ok {
@@ -263,7 +306,7 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 	}
 
 	userConfigDir, err := getUserConfigDir()
-	if err != nil && len(readers) == 0 {
+	if err != nil && len(readers) == 0 && len(identities) == 0 {
 		return nil, fmt.Errorf("user config directory could not be determined: %w", err)
 	}
 	if userConfigDir != "" {
@@ -272,7 +315,7 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 		if err != nil && !errors.Is(err, os.ErrNotExist) {
 			return nil, fmt.Errorf("failed to open file: %w", err)
 		}
-		if errors.Is(err, os.ErrNotExist) && len(readers) == 0 {
+		if errors.Is(err, os.ErrNotExist) && len(readers) == 0 && len(identities) == 0 {
 			// If we have no other readers, presence of the file is required.
 			return nil, fmt.Errorf("failed to open file: %w", err)
 		}
@@ -282,7 +325,6 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 		}
 	}
 
-	var identities ParsedIdentities
 	for n, r := range readers {
 		ids, err := age.ParseIdentities(r)
 		if err != nil {
@@ -294,13 +336,25 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 }
 
 // parseRecipient attempts to parse a string containing an encoded age public
-// key.
-func parseRecipient(recipient string) (*age.X25519Recipient, error) {
-	parsedRecipient, err := age.ParseX25519Recipient(recipient)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse input as Bech32-encoded age public key: %w", err)
+// key or a public ssh key.
+func parseRecipient(recipient string) (age.Recipient, error) {
+	switch {
+	case strings.HasPrefix(recipient, "age1"):
+		parsedRecipient, err := age.ParseX25519Recipient(recipient)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse input as Bech32-encoded age public key: %w", err)
+		}
+
+		return parsedRecipient, nil
+	case strings.HasPrefix(recipient, "ssh-"):
+		parsedRecipient, err := agessh.ParseRecipient(recipient)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse input as age-ssh public key: %w", err)
+		}
+		return parsedRecipient, nil
 	}
-	return parsedRecipient, nil
+
+	return nil, fmt.Errorf("failed to parse input, unknown recipient type: %q", recipient)
 }
 
 // parseIdentities attempts to parse the string set of encoded age identities.

age/keysource_test.go

@@ -28,6 +28,23 @@ EylloI7MNGbadPGb
 -----END AGE ENCRYPTED FILE-----`
 	// mockEncryptedKeyPlain is the plain value of mockEncryptedKey.
 	mockEncryptedKeyPlain string = "data"
+	// mockSshRecipient is a mock age ssh recipient, it matches mockSshIdentity
+	mockSshRecipient string = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+Wi8WZw2bXfBpcs/WECttCzP39OkenS6pHWHWGFJvN Test"
+	// mockSshIdentity is a mock age identity based on an OpenSSH private key (ed25519)
+	mockSshIdentity string = `-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACA/lovFmcNm13waXLP1hArbQsz9/TpHp0uqR1h1hhSbzQAAAIgCXDMIAlwz
+CAAAAAtzc2gtZWQyNTUxOQAAACA/lovFmcNm13waXLP1hArbQsz9/TpHp0uqR1h1hhSbzQ
+AAAEBJdWTJ8dC0OnMcwy4gQ96sp6KG8GE9EiyhFGhKldKiST+Wi8WZw2bXfBpcs/WECttC
+zP39OkenS6pHWHWGFJvNAAAABFRlc3QB
+-----END OPENSSH PRIVATE KEY-----`
+	mockEncryptedSshKey string = `-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDJjd0R4dyB2R3Ns
+VUNHaXBiTEJaNU5BMFFQZUpCYWJqODFyTTZ4WWZoRVpUd2M2aTBFCkduUFJHb1U2
+K3RqWVQrLzE4anZKZ3h2T3c2MFpZTHlGaHprcElXenByWTAKLS0tIG56MHFSZERl
+em9PWmRMMTY4aytYTnVZN04yeER5Z2E3TWxWT3JTZWR2ekUKp/HZLy4MzQqoszGk
++P0hSPPNhOhvFwv4AqCw1+A+WyeHGQPq
+-----END AGE ENCRYPTED FILE-----`
 )
 
 func TestMasterKeysFromRecipients(t *testing.T) {
@@ -41,22 +58,32 @@ func TestMasterKeysFromRecipients(t *testing.T) {
 		assert.Equal(t, got[0].Recipient, mockRecipient)
 	})
 
+	t.Run("recipient-ssh", func(t *testing.T) {
+		got, err := MasterKeysFromRecipients(mockSshRecipient)
+		assert.NoError(t, err)
+
+		assert.Len(t, got, 1)
+		assert.Equal(t, got[0].Recipient, mockSshRecipient)
+	})
+
 	t.Run("recipients", func(t *testing.T) {
-		got, err := MasterKeysFromRecipients(mockRecipient + "," + otherRecipient)
+		got, err := MasterKeysFromRecipients(mockRecipient + "," + otherRecipient + "," + mockSshRecipient)
 		assert.NoError(t, err)
 
-		assert.Len(t, got, 2)
+		assert.Len(t, got, 3)
 		assert.Equal(t, got[0].Recipient, mockRecipient)
 		assert.Equal(t, got[1].Recipient, otherRecipient)
+		assert.Equal(t, got[2].Recipient, mockSshRecipient)
 	})
 
 	t.Run("leading and trailing spaces", func(t *testing.T) {
-		got, err := MasterKeysFromRecipients("   " + mockRecipient + "   ,   " + otherRecipient + "   ")
+		got, err := MasterKeysFromRecipients("   " + mockRecipient + "   ,   " + otherRecipient + " ,  " + mockSshRecipient + "     ")
 		assert.NoError(t, err)
 
-		assert.Len(t, got, 2)
+		assert.Len(t, got, 3)
 		assert.Equal(t, got[0].Recipient, mockRecipient)
 		assert.Equal(t, got[1].Recipient, otherRecipient)
+		assert.Equal(t, got[2].Recipient, mockSshRecipient)
 	})
 
 	t.Run("empty", func(t *testing.T) {
@@ -75,6 +102,14 @@ func TestMasterKeyFromRecipient(t *testing.T) {
 		assert.Nil(t, got.parsedIdentities)
 	})
 
+	t.Run("recipient-ssh", func(t *testing.T) {
+		got, err := MasterKeyFromRecipient(mockSshRecipient)
+		assert.NoError(t, err)
+		assert.EqualValues(t, mockSshRecipient, got.Recipient)
+		assert.NotNil(t, got.parsedRecipient)
+		assert.Nil(t, got.parsedIdentities)
+	})
+
 	t.Run("leading and trailing spaces", func(t *testing.T) {
 		got, err := MasterKeyFromRecipient("   " + mockRecipient + "   ")
 		assert.NoError(t, err)
@@ -83,6 +118,14 @@ func TestMasterKeyFromRecipient(t *testing.T) {
 		assert.Nil(t, got.parsedIdentities)
 	})
 
+	t.Run("leading and trailing spaces - ssh", func(t *testing.T) {
+		got, err := MasterKeyFromRecipient("   " + mockSshRecipient + "   ")
+		assert.NoError(t, err)
+		assert.EqualValues(t, mockSshRecipient, got.Recipient)
+		assert.NotNil(t, got.parsedRecipient)
+		assert.Nil(t, got.parsedIdentities)
+	})
+
 	t.Run("invalid recipient", func(t *testing.T) {
 		got, err := MasterKeyFromRecipient("invalid")
 		assert.Error(t, err)
@@ -111,6 +154,8 @@ func TestParsedIdentities_ApplyToMasterKey(t *testing.T) {
 func TestMasterKey_Encrypt(t *testing.T) {
 	mockParsedRecipient, err := parseRecipient(mockRecipient)
 	assert.NoError(t, err)
+	mockSshParsedRecipient, err := parseRecipient(mockSshRecipient)
+	assert.NoError(t, err)
 
 	t.Run("recipient", func(t *testing.T) {
 		key := &MasterKey{
@@ -120,6 +165,14 @@ func TestMasterKey_Encrypt(t *testing.T) {
 		assert.NotEmpty(t, key.EncryptedKey)
 	})
 
+	t.Run("recipient ssh", func(t *testing.T) {
+		key := &MasterKey{
+			Recipient: mockSshRecipient,
+		}
+		assert.NoError(t, key.Encrypt([]byte(mockEncryptedKeyPlain)))
+		assert.NotEmpty(t, key.EncryptedKey)
+	})
+
 	t.Run("parsed recipient", func(t *testing.T) {
 		key := &MasterKey{
 			parsedRecipient: mockParsedRecipient,
@@ -128,13 +181,21 @@ func TestMasterKey_Encrypt(t *testing.T) {
 		assert.NotEmpty(t, key.EncryptedKey)
 	})
 
+	t.Run("parsed recipient ssh", func(t *testing.T) {
+		key := &MasterKey{
+			parsedRecipient: mockSshParsedRecipient,
+		}
+		assert.NoError(t, key.Encrypt([]byte(mockEncryptedKeyPlain)))
+		assert.NotEmpty(t, key.EncryptedKey)
+	})
+
 	t.Run("invalid recipient", func(t *testing.T) {
 		key := &MasterKey{
 			Recipient: "invalid",
 		}
 		err := key.Encrypt([]byte(mockEncryptedKeyPlain))
 		assert.Error(t, err)
-		assert.ErrorContains(t, err, "failed to parse input as Bech32-encoded age public key")
+		assert.ErrorContains(t, err, "failed to parse input, unknown recipient type:")
 		assert.Empty(t, key.EncryptedKey)
 	})
 
@@ -188,6 +249,25 @@ func TestMasterKey_Decrypt(t *testing.T) {
 		assert.EqualValues(t, mockEncryptedKeyPlain, got)
 	})
 
+	t.Run("loaded identities ssh", func(t *testing.T) {
+		key := &MasterKey{EncryptedKey: mockEncryptedSshKey}
+		tmp := t.TempDir()
+		overwriteUserConfigDir(t, tmp)
+
+		homeDir, err := os.UserHomeDir()
+		assert.NoError(t, err)
+		keyPath := filepath.Join(homeDir, ".ssh/id_25519")
+		assert.True(t, strings.HasPrefix(keyPath, homeDir))
+
+		assert.NoError(t, os.MkdirAll(filepath.Dir(keyPath), 0o700))
+		assert.NoError(t, os.WriteFile(keyPath, []byte(mockSshIdentity), 0o644))
+		t.Setenv(SopsAgeSshPrivateKeyFileEnv, keyPath)
+
+		got, err := key.Decrypt()
+		assert.NoError(t, err)
+		assert.EqualValues(t, mockEncryptedKeyPlain, got)
+	})
+
 	t.Run("no identities", func(t *testing.T) {
 		tmpDir := t.TempDir()
 		overwriteUserConfigDir(t, tmpDir)
@@ -327,6 +407,25 @@ func TestMasterKey_loadIdentities(t *testing.T) {
 		assert.Len(t, got, 1)
 	})
 
+	t.Run(SopsAgeSshPrivateKeyFileEnv, func(t *testing.T) {
+		tmpDir := t.TempDir()
+		overwriteUserConfigDir(t, tmpDir)
+
+		homeDir, err := os.UserHomeDir()
+		assert.NoError(t, err)
+		keyPath := filepath.Join(homeDir, ".ssh/id_25519")
+		assert.True(t, strings.HasPrefix(keyPath, homeDir))
+
+		assert.NoError(t, os.MkdirAll(filepath.Dir(keyPath), 0o700))
+		assert.NoError(t, os.WriteFile(keyPath, []byte(mockSshIdentity), 0o644))
+		t.Setenv(SopsAgeSshPrivateKeyFileEnv, keyPath)
+
+		key := &MasterKey{}
+		got, err := key.loadIdentities()
+		assert.NoError(t, err)
+		assert.Len(t, got, 1)
+	})
+
 	t.Run("no identity", func(t *testing.T) {
 		tmpDir := t.TempDir()
 		overwriteUserConfigDir(t, tmpDir)
@@ -374,8 +473,8 @@ func TestMasterKey_loadIdentities(t *testing.T) {
 	})
 }
 
-// overwriteUserConfigDir sets the user config directory based on the
-// os.UserConfigDir logic.
+// overwriteUserConfigDir sets the user config directory and the user home directory
+// based on the os.UserConfigDir logic.
 func overwriteUserConfigDir(t *testing.T, path string) {
 	switch runtime.GOOS {
 	case "windows":
@@ -384,6 +483,7 @@ func overwriteUserConfigDir(t *testing.T, path string) {
 		t.Setenv("home", path)
 	default: // Unix
 		t.Setenv("XDG_CONFIG_HOME", path)
+		t.Setenv("HOME", path)
 	}
 }