feat: add age plugin support

[brianmcgee]

Another attempt at #1465 without bringing in so much code from age.

Instead, I created FiloSottile/age#591 upstream to expose PluginTerminalUI.

TODO

• update go.mod once feat: move tui code to tui package FiloSottile/age#591 is merged

[felixfontein]

Thank you very much for this! I've marked it as a draft (we can put it back to ready once the upstream change is merged).

[loa]

I guess this slipped in (or required to get the tests to pass), thanks for pushing this forward @brianmcgee !

[brianmcgee]

That's what the todo is about above. Once upstream merges, I can remove that.

[Ma27]

Using this, works fine for sops -d. However if I specify public keys for creation_rules in a .sops.yaml, sops will break when editing these files since parseRecipients doesn't know what to do with age-plugin-yubikey pubkeys.

I fixed this with the following patch on top:

From 64e77bd60f8ebc8a0a5c7f8602a6f5855c892fd3 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <[email protected]>
Date: Wed, 20 Nov 2024 22:44:49 +0100
Subject: [PATCH] age/keysource: parse recipients using plugin system

Otherwise I get

    failed to parse input as Bech32-encoded age public key: malformed recipient "age1yubikey1...": invalid type "age1yubikey"

for `sops secrets/.../secrets.sops.yaml` in a directory with a
`.sops.yaml` that has creation rules with age1yubikey1* keys in its
creation rules.
---
 age/keysource.go | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/age/keysource.go b/age/keysource.go
index f04e4aff8..a9051c926 100644
--- a/age/keysource.go
+++ b/age/keysource.go
@@ -304,12 +304,21 @@ func (key *MasterKey) loadIdentities() (ParsedIdentities, error) {
 
 // parseRecipient attempts to parse a string containing an encoded age public
 // key.
-func parseRecipient(recipient string) (*age.X25519Recipient, error) {
-	parsedRecipient, err := age.ParseX25519Recipient(recipient)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse input as Bech32-encoded age public key: %w", err)
+func parseRecipient(recipient string) (age.Recipient, error) {
+	switch {
+	case strings.HasPrefix(recipient, "age1") && strings.Count(recipient, "1") > 1:
+		parsedRecipient, err := plugin.NewRecipient(recipient, tui.PluginTerminalUI)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse input as age key from age plugin: %w", err)
+		}
+		return parsedRecipient, nil
+	default:
+		parsedRecipient, err := age.ParseX25519Recipient(recipient)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse input as Bech32-encoded age public key: %w", err)
+		}
+		return parsedRecipient, nil
 	}
-	return parsedRecipient, nil
 }
 
 // parseIdentities attempts to parse the string set of encoded age identities.
-- 
2.47.0

Feel free to pick this to your branch @brianmcgee :)

[brianmcgee]

@Ma27 applied the patch, thanks 👍

[visualphoenix]

+1 would be great to have this in sops