feat: add ssh support for age

Signed-off-by: Marvin Strangfeld <marvin@strangfeld.io>

Author: mstrangfeld

age/keysource.go

@@ -11,10 +11,12 @@ import (
 	"strings"
 
 	"filippo.io/age"
+	"filippo.io/age/agessh"
 	"filippo.io/age/armor"
 	"github.com/sirupsen/logrus"
 
 	"github.com/getsops/sops/v3/logging"
+	"golang.org/x/crypto/ssh"
 )
 
 const (
@@ -24,6 +26,9 @@ const (
 	// SopsAgeKeyFileEnv can be set as an environment variable pointing to an
 	// age keys file.
 	SopsAgeKeyFileEnv = "SOPS_AGE_KEY_FILE"
+	// SopsAgeSshPrivateKeyEnv can be set as an environment variable pointing to
+	// a private SSH key file.
+	SopsAgeSshPrivateKeyEnv = "SOPS_AGE_SSH_PRIVATE_KEY"
 	// SopsAgeKeyUserConfigPath is the default age keys file path in
 	// getUserConfigDir().
 	SopsAgeKeyUserConfigPath = "sops/age/keys.txt"
@@ -60,7 +65,7 @@ type MasterKey struct {
 	parsedIdentities []age.Identity
 	// parsedRecipient contains a parsed age public key.
 	// It is used to lazy-load the Recipient at-most once.
-	parsedRecipient *age.X25519Recipient
+	parsedRecipient age.Recipient
 }
 
 // MasterKeysFromRecipients takes a comma-separated list of Bech32-encoded
@@ -233,6 +238,98 @@ func (key *MasterKey) TypeToIdentifier() string {
 	return KeyTypeIdentifier
 }
 
+// readPublicKeyFile attempts to read a public key based on the given private
+// key path. It assumes the public key is in the same directory, with the same
+// name, but with a ".pub" extension. If the public key cannot be read, an
+// error is returned.
+func readPublicKeyFile(privateKeyPath string) (ssh.PublicKey, error) {
+	publicKeyPath := privateKeyPath + ".pub"
+	f, err := os.Open(publicKeyPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to obtain public %q key for %q SSH key: %w", publicKeyPath, privateKeyPath, err)
+	}
+	defer f.Close()
+	contents, err := io.ReadAll(f)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read %q: %w", publicKeyPath, err)
+	}
+	pubKey, _, _, _, err := ssh.ParseAuthorizedKey(contents)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse %q: %w", publicKeyPath, err)
+	}
+	return pubKey, nil
+}
+
+// parseSSHIdentityFromPrivateKeyFile returns an age.Identity from the given
+// private key file. If the private key file is encrypted, it will configure
+// the identity to prompt for a passphrase.
+func parseSSHIdentityFromPrivateKeyFile(keyPath string) (age.Identity, error) {
+	keyFile, err := os.Open(keyPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open file: %w", err)
+	}
+	defer keyFile.Close()
+	contents, err := io.ReadAll(keyFile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read file: %w", err)
+	}
+	id, err := agessh.ParseIdentity(contents)
+	if sshErr, ok := err.(*ssh.PassphraseMissingError); ok {
+		pubKey := sshErr.PublicKey
+		if pubKey == nil {
+			pubKey, err = readPublicKeyFile(keyPath)
+			if err != nil {
+				return nil, err
+			}
+		}
+		passphrasePrompt := func() ([]byte, error) {
+			pass, err := readPassphrase(fmt.Sprintf("Enter passphrase for %q:", keyPath))
+			if err != nil {
+				return nil, fmt.Errorf("could not read passphrase for %q: %v", keyPath, err)
+			}
+			return pass, nil
+		}
+		i, err := agessh.NewEncryptedSSHIdentity(pubKey, contents, passphrasePrompt)
+		if err != nil {
+			return nil, fmt.Errorf("could not create encrypted SSH identity: %w", err)
+		}
+		return i, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("malformed SSH identity in %q: %w", keyPath, err)
+	}
+	return id, nil
+}
+
+// loadAgeSSHIdentity attempts to load the age SSH identity based on an SSH
+// private key from the SopsAgeSshPrivateKeyEnv environment variable. If the
+// environment variable is not present, it will fall back to `~/.ssh/id_ed25519`
+// or `~/.ssh/id_rsa`. If no age SSH identity is found, it will return nil.
+func loadAgeSSHIdentity() (age.Identity, error) {
+	sshKeyFilePath, ok := os.LookupEnv(SopsAgeSshPrivateKeyEnv)
+	if ok {
+		return parseSSHIdentityFromPrivateKeyFile(sshKeyFilePath)
+	}
+
+	userHomeDir, err := os.UserHomeDir()
+	if err != nil || userHomeDir == "" {
+		log.Warnf("could not determine the user home directory: %v", err)
+		return nil, nil
+	}
+
+	sshEd25519PrivateKeyPath := filepath.Join(userHomeDir, ".ssh", "id_ed25519")
+	if _, err := os.Stat(sshEd25519PrivateKeyPath); err == nil {
+		return parseSSHIdentityFromPrivateKeyFile(sshEd25519PrivateKeyPath)
+	}
+
+	sshRsaPrivateKeyPath := filepath.Join(userHomeDir, ".ssh", "id_rsa")
+	if _, err := os.Stat(sshRsaPrivateKeyPath); err == nil {
+		return parseSSHIdentityFromPrivateKeyFile(sshRsaPrivateKeyPath)
+	}
+
+	return nil, nil
+}
+
 func getUserConfigDir() (string, error) {
 	if runtime.GOOS == "darwin" {
 		if userConfigDir, ok := os.LookupEnv(xdgConfigHome); ok && userConfigDir != "" {
@@ -244,9 +341,19 @@ func getUserConfigDir() (string, error) {
 
 // loadIdentities attempts to load the age identities based on runtime
 // environment configurations (e.g. SopsAgeKeyEnv, SopsAgeKeyFileEnv,
-// SopsAgeKeyUserConfigPath). It will load all found references, and expects
-// at least one configuration to be present.
+// SopsAgeSshPrivateKeyEnv, SopsAgeKeyUserConfigPath). It will load all
+// found references, and expects at least one configuration to be present.
 func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
+	var identities ParsedIdentities
+
+	sshIdentity, err := loadAgeSSHIdentity()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get SSH identity: %w", err)
+	}
+	if sshIdentity != nil {
+		identities = append(identities, sshIdentity)
+	}
+
 	var readers = make(map[string]io.Reader, 0)
 
 	if ageKey, ok := os.LookupEnv(SopsAgeKeyEnv); ok {
@@ -263,7 +370,7 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 	}
 
 	userConfigDir, err := getUserConfigDir()
-	if err != nil && len(readers) == 0 {
+	if err != nil && len(readers) == 0 && len(identities) == 0 {
 		return nil, fmt.Errorf("user config directory could not be determined: %w", err)
 	}
 	if userConfigDir != "" {
@@ -272,7 +379,7 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 		if err != nil && !errors.Is(err, os.ErrNotExist) {
 			return nil, fmt.Errorf("failed to open file: %w", err)
 		}
-		if errors.Is(err, os.ErrNotExist) && len(readers) == 0 {
+		if errors.Is(err, os.ErrNotExist) && len(readers) == 0 && len(identities) == 0 {
 			// If we have no other readers, presence of the file is required.
 			return nil, fmt.Errorf("failed to open file: %w", err)
 		}
@@ -282,7 +389,6 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 		}
 	}
 
-	var identities ParsedIdentities
 	for n, r := range readers {
 		ids, err := age.ParseIdentities(r)
 		if err != nil {
@@ -294,13 +400,25 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 }
 
 // parseRecipient attempts to parse a string containing an encoded age public
-// key.
-func parseRecipient(recipient string) (*age.X25519Recipient, error) {
-	parsedRecipient, err := age.ParseX25519Recipient(recipient)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse input as Bech32-encoded age public key: %w", err)
+// key or a public ssh key.
+func parseRecipient(recipient string) (age.Recipient, error) {
+	switch {
+	case strings.HasPrefix(recipient, "age1"):
+		parsedRecipient, err := age.ParseX25519Recipient(recipient)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse input as Bech32-encoded age public key: %w", err)
+		}
+
+		return parsedRecipient, nil
+	case strings.HasPrefix(recipient, "ssh-"):
+		parsedRecipient, err := agessh.ParseRecipient(recipient)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse input as age-ssh public key: %w", err)
+		}
+		return parsedRecipient, nil
 	}
-	return parsedRecipient, nil
+
+	return nil, fmt.Errorf("failed to parse input, unknown recipient type: %q", recipient)
 }
 
 // parseIdentities attempts to parse the string set of encoded age identities.