crypt/step-ca-cli
1
0
Fork 0
mirror of https://github.com/smallstep/cli.git synced 2026-10-24 11:19:19 +03:00
Code Activity

jwe encrypt: add --password-file flag for PBES2

Browse Source 
step crypto jwe decrypt already accepts --password-file, but the matching
encrypt command did not, so encrypting with a PBES2 (password-based) algorithm
could only read the password interactively from the TTY. This made automation
impossible.

Mirror decrypt: add the --password-file flag and seed the password prompt from
the file via ui.WithValue when it is set, falling back to the interactive
prompt otherwise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Carl Tashian
2026-06-22 11:16:15 -05:00
parent abd06dc51b
commit 3aeb42c352
1 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
command/crypto/jwe/encrypt.go
View File

@@ -22,7 +22,8 @@ func encryptCommand() cli.Command {
Usage: "encrypt a payload using JSON Web Encryption (JWE)",
UsageText: `**step crypto jwe encrypt**
[**--alg**=<key-enc-algorithm>] [**--enc**=<content-enc-algorithm>]
[**--key**=<file>] [**--jwks**=<jwks>] [**--kid**=<kid>]`,
[**--key**=<file>] [**--jwks**=<jwks>] [**--kid**=<kid>]
[**--password-file**=<file>]`,
Description: `**step crypto jwe encrypt** encrypts a payload using JSON Web Encryption
(JWE). By default, the payload to encrypt is read from STDIN and the JWE data
structure will be written to STDOUT.
@@ -150,6 +151,10 @@ applications where more than one JWE payload type may be present. This
parameter is ignored by JWE implementations, but may be processed by
applications that use JWE.`,
},
cli.StringFlag{
Name: "password-file",
Usage: `The path to the <file> containing the password to encrypt the keys.`,
},
flags.SubtleHidden,
},
}
@@ -187,6 +192,7 @@ func encryptAction(ctx *cli.Context) error {
kid := ctx.String("kid")
typ := ctx.String("typ")
cty := ctx.String("cty")
passwordFile := ctx.String("password-file")
isSubtle := ctx.Bool("subtle")
switch {
@@ -224,7 +230,17 @@ func encryptAction(ctx *cli.Context) error {
case jwks != "":
jwk, err = jose.ReadKeySet(jwks, options...)
case isPBES2:
pbes2Key, err = ui.PromptPassword("Please enter the password to encrypt the content encryption key")
var password string
if passwordFile != "" {
password, err = utils.ReadStringPasswordFromFile(passwordFile)
if err != nil {
return err
}
}
pbes2Key, err =
ui.PromptPassword(
"Please enter the password to encrypt the content encryption key",
ui.WithValue(password))
default:
return errs.RequiredOrFlag(ctx, "key", "jwks")
}