Skip to content

Commit 3c4157c

Browse files
kanywstkanywst
committed
chore: major upgrade to v3.1 architecture (Go 1.25, Zero-Knowledge, TUI)
1 parent b7a8ecb commit 3c4157c

21 files changed

Lines changed: 2209 additions & 532 deletions

File tree

‎.github/workflows/quality.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Quality & Security
2+
3+
on:
4+
push:
5+
branches: [ "master", "main" ]
6+
pull_request:
7+
branches: [ "master", "main" ]
8+
9+
jobs:
10+
quality:
11+
name: Code Quality
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v4
15+
- uses: actions/setup-go@v4
16+
with:
17+
go-version: '1.25'
18+
19+
- name: Install dependencies
20+
run: sudo apt-get update && sudo apt-get install -y libsqlite3-dev
21+
22+
- name: Format Check
23+
run: |
24+
if [ -n "$(gofmt -l .)" ]; then
25+
echo "Go code is not formatted:"
26+
gofmt -d .
27+
exit 1
28+
fi
29+
30+
- name: Vet
31+
run: go vet ./...
32+
33+
- name: Staticcheck
34+
uses: dominikh/staticcheck-action@v1.3.0
35+
with:
36+
version: "latest"
37+
install-go: false
38+
39+
security:
40+
name: Security Scan
41+
runs-on: ubuntu-latest
42+
steps:
43+
- uses: actions/checkout@v4
44+
- uses: actions/setup-go@v4
45+
with:
46+
go-version: '1.25'
47+
48+
- name: Install govulncheck
49+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
50+
51+
- name: Run Vulnerability Check
52+
run: govulncheck ./...
53+
54+
- name: Run Gosec Security Scanner
55+
uses: securego/gosec@master
56+
with:
57+
args: ./...

‎.github/workflows/test.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Test and Build
2+
3+
on:
4+
push:
5+
branches: [ "master", "main" ]
6+
pull_request:
7+
branches: [ "master", "main" ]
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- name: Set up Go
16+
uses: actions/setup-go@v4
17+
with:
18+
go-version: '1.25'
19+
20+
- name: Install dependencies
21+
run: |
22+
sudo apt-get update
23+
sudo apt-get install -y libsqlite3-dev
24+
25+
- name: Build
26+
run: go build -v ./cmd/rapg/...
27+
28+
- name: Test
29+
run: go test -v -race ./...

‎.gitignore‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Binaries
2+
/rapg
3+
*.exe
4+
*.dll
5+
*.so
6+
*.dylib
7+
*.test
8+
9+
# Output & Build
10+
/dist/
11+
coverage.out
12+
13+
# OS Specific
14+
.DS_Store
15+
.DS_Store?
16+
._*
17+
.Spotlight-V100
18+
.Trashes
19+
ehthumbs.db
20+
Thumbs.db
21+
22+
# Editors / IDEs
23+
.vscode/
24+
.idea/
25+
*.swp
26+
*.swo
27+
28+
# Go
29+
go.work
30+
go.work.sum
31+
vendor/
32+
33+
# Project Specific
34+
# Local database (SQLite)
35+
*.db
36+
*.db-journal
37+
*.db-wal
38+
39+
# Generated env files
40+
.env
41+
42+
# User config directory (if created locally during dev)
43+
.rapg/

‎.goreleaser.yaml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# This is an example .goreleaser.yml file with some sensible defaults.
2+
# Make sure to check the documentation at https://goreleaser.com
3+
version: 2
4+
5+
before:
6+
hooks:
7+
- go mod tidy
8+
9+
builds:
10+
- env:
11+
- CGO_ENABLED=1
12+
goos:
13+
- linux
14+
- windows
15+
- darwin
16+
goarch:
17+
- amd64
18+
- arm64
19+
main: ./cmd/rapg/main.go
20+
ldflags:
21+
- -s -w
22+
23+
archives:
24+
- format: tar.gz
25+
# this name template makes the OS and Arch compatible with the results of uname.
26+
name_template: >-
27+
{{ .ProjectName }}_
28+
{{- title .Os }}_
29+
{{- if eq .Arch "amd64" }}x86_64
30+
{{- else if eq .Arch "386" }}i386
31+
{{- else }}{{ .Arch }}{{ end }}
32+
{{- if .Arm }}v{{ .Arm }}{{ end }}
33+
# use zip for windows archives
34+
format_overrides:
35+
- goos: windows
36+
format: zip
37+
38+
checksum:
39+
name_template: 'checksums.txt'
40+
41+
snapshot:
42+
name_template: "{{ incpatch .Version }}-next"
43+
44+
changelog:
45+
sort: asc
46+
filters:
47+
exclude:
48+
- '^docs:'
49+
- '^test:'
50+
51+
brews:
52+
-
53+
name: rapg
54+
55+
# GitHub/GitLab repository to push the formula to
56+
repository:
57+
owner: kanywst
58+
name: homebrew-tap
59+
token: "{{ .Env.TAP_GITHUB_TOKEN }}"
60+
61+
# Template for the url which is determined by the given Token (github, gitlab or gitea)
62+
url_template: "https://github.com/kanywst/rapg/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
63+
64+
# Git author used to commit to the repository.
65+
# Defaults are shown.
66+
commit_author:
67+
name: goreleaserbot
68+
email: goreleaser@carlosbecker.com
69+
70+
# The project name and current git tag are used in the format string.
71+
commit_msg_template: "Brew formula update for {{ .ProjectName }} version {{ .Tag }}"
72+
73+
# Folder inside the repository to put the formula.
74+
# Default is the root folder.
75+
directory: Formula
76+
77+
# Your app's homepage.
78+
# Default is empty.
79+
homepage: "https://github.com/kanywst/rapg"
80+
81+
# Template of your app's description.
82+
# Default is empty.
83+
description: "The Developer-First Secret Manager."
84+
85+
# SPDX identifier of your app's license.
86+
# Default is empty.
87+
license: "MIT"
88+
89+
# Setting this will prevent goreleaser to actually try to commit the updated
90+
# formula - instead, the formula file will be stored on the dist folder only,
91+
# leaving the responsibility of publishing it to the user.
92+
# If set to auto, the release will not be published to the homebrew tap if
93+
# one of and Linux and macOS (darwin) builds are missing.
94+
skip_upload: auto # Upload requires a real TAP repo, skipping for this demo context.
95+
96+
# So you can `brew test` your formula.
97+
# Default is empty.
98+
test: |
99+
system "#{bin}/rapg gen --help"
100+
101+
# Custom install script for brew.
102+
# Default is 'bin.install "program"'.
103+
install: |
104+
bin.install "rapg"

‎GEMINI.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# GEMINI.md
2+
3+
## Project Overview
4+
5+
**Rapg** is a secure, developer-focused, TUI-based secret manager written in Go.
6+
It allows developers to manage secrets securely, inject them into processes without writing `.env` files to disk, and share encrypted secrets.
7+
8+
## Architecture
9+
10+
The project follows a standard Go project layout:
11+
12+
- **`cmd/rapg/`**: Entry point. Contains `main.go` which uses `cobra` for CLI command handling and `bubble tea` for the TUI.
13+
- **`internal/`**: Private application code.
14+
- **`core/`**: Business logic. Orchestrates interactions between the UI, storage, and crypto packages. Handles CSV import, auditing, and secret injection logic.
15+
- **`crypto/`**: Cryptographic primitives.
16+
- **AES-256-GCM** for data encryption.
17+
- **Argon2id** for Key Derivation Function (KDF) from the master password.
18+
- **SHA256** for key verification hashing.
19+
- **TOTP** implementation via library.
20+
- **`storage/`**: Persistence layer.
21+
- Uses **SQLite** via **GORM**.
22+
- Stores encrypted data (blob) and metadata (salt, validation hash).
23+
- Local database location: `~/.rapg/rapg.db`.
24+
- **`ui/`**: TUI implementation using **Bubble Tea** and **Lip Gloss**.
25+
26+
## Key Concepts
27+
28+
1. **Zero-Knowledge Architecture:** The master password is never stored. A derived key (SessionKey) is kept in memory only while the application is running.
29+
2. **Environment Injection:** `rapg run` decrypts secrets in memory and passes them directly to the child process environment, avoiding disk I/O for sensitive data.
30+
3. **Local-First:** All data is stored locally in an SQLite database.
31+
32+
## Development Workflow
33+
34+
1. **Build:** `go build -v ./cmd/rapg/...`
35+
2. **Test:** `go test -v ./...`
36+
3. **Run:** `go run cmd/rapg/main.go`
37+
38+
## Security Details
39+
40+
See `TECH.md` for detailed security specifications, including encryption modes and standards compliance.

‎Makefile‎

Lines changed: 8 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,12 @@
1-
.DEFAULT_GOAL := help
1+
.PHONY: build run clean
22

3-
ifeq ($(GOPATH),)
4-
GOPATH := $(shell pwd)
5-
endif
3+
build:
4+
go build -o rapg cmd/rapg/main.go
65

7-
export GOPATH
6+
run:
7+
go run cmd/rapg/main.go
88

9-
BIN_NAME := ra
10-
11-
.PHONY: help
12-
help:
13-
@echo "Usage: make [target]"
14-
@echo ""
15-
@echo "Targets:"
16-
@echo " build-mac Build for macOS"
17-
@echo " build-linux Build for Linux"
18-
@echo " clean Clean build artifacts"
19-
@echo " help Show this help message"
20-
21-
.PHONY: build-mac
22-
build-mac:
23-
@echo "Building for macOS..."
24-
GOOS=darwin GOARCH=amd64 go build -o ${GOPATH}/$(BIN_NAME) cmd/rapg/main.go
25-
26-
.PHONY: build-linux
27-
build-linux:
28-
@echo "Building for Linux..."
29-
GOOS=linux GOARCH=amd64 go build -o $(GOPATH)/$(BIN_NAME).linux cmd/rapg/main.go
30-
31-
.PHONY: clean
329
clean:
33-
@echo "Cleaning build artifacts..."
34-
rm -rf $(GOPATH)
10+
rm -f rapg
11+
rm -rf dist/
12+
rm -f coverage.out

0 commit comments

Comments
 (0)