Tosone 867a26a23c feat(crypt): add authenticated AES-GCM seal/open helpers ...

Encrypt/Decrypt are AES-CTR without a MAC, so a stored ciphertext can be
altered without detection. The only current caller derives a per-build key
from the builder and runner IDs, which is fine for the short-lived build
environment but cannot be used for values that outlive a process.

Add Seal/Open on top of AES-256-GCM (base64(nonce|ciphertext|tag)) next to
the existing helpers instead of changing them: the builder image still
decrypts the CTR format with crypt.Decrypt. The key is derived with
sha256 like Encrypt, so operators only deal with one key convention.

Verification:
- go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/utils/crypt/...

2026-10-27 21:07:15 +08:00

..

crypt_test.go

feat(crypt): add authenticated AES-GCM seal/open helpers

2026-10-27 21:07:15 +08:00

crypt.go

feat(crypt): add authenticated AES-GCM seal/open helpers

2026-10-27 21:07:15 +08:00