diff --git a/wrappers/azurekeyvault/azurekeyvault.go b/wrappers/azurekeyvault/azurekeyvault.go index c18cb991..b8eb3f7d 100644 --- a/wrappers/azurekeyvault/azurekeyvault.go +++ b/wrappers/azurekeyvault/azurekeyvault.go @@ -19,10 +19,10 @@ import ( "golang.org/x/net/http2" - "github.com/Azure/azure-sdk-for-go/services/keyvault/v7.1/keyvault" - "github.com/Azure/go-autorest/autorest" + "github.com/Azure/azure-sdk-for-go/sdk/azcore" + "github.com/Azure/azure-sdk-for-go/sdk/azidentity" + "github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys" "github.com/Azure/go-autorest/autorest/azure" - "github.com/Azure/go-autorest/autorest/azure/auth" "github.com/Azure/go-autorest/autorest/to" "github.com/hashicorp/go-hclog" wrapping "github.com/hashicorp/go-kms-wrapping/v2" @@ -52,7 +52,7 @@ type Wrapper struct { environment azure.Environment resource string - client *keyvault.BaseClient + client *azkeys.Client logger hclog.Logger keyNotRequired bool baseURL string @@ -77,7 +77,7 @@ func NewWrapper() *Wrapper { // * Environment variable // * Passed in config map // * Managed Service Identity for instance -func (v *Wrapper) SetConfig(_ context.Context, opt ...wrapping.Option) (*wrapping.WrapperConfig, error) { +func (v *Wrapper) SetConfig(ctx context.Context, opt ...wrapping.Option) (*wrapping.WrapperConfig, error) { opts, err := getOpts(opt...) if err != nil { return nil, err @@ -173,14 +173,14 @@ func (v *Wrapper) SetConfig(_ context.Context, opt ...wrapping.Option) (*wrappin if !v.keyNotRequired { // Test the client connection using provided key ID - keyInfo, err := client.GetKey(context.Background(), v.baseURL, v.keyName, "") + keyInfo, err := client.GetKey(ctx, v.keyName, "", nil) if err != nil { return nil, fmt.Errorf("error fetching Azure Key Vault wrapper key information: %w", err) } if keyInfo.Key == nil { return nil, errors.New("no key information returned") } - v.currentKeyId.Store(ParseKeyVersion(to.String(keyInfo.Key.Kid))) + v.currentKeyId.Store(ParseKeyVersion(to.String((*string)(keyInfo.Key.KID)))) } v.client = client @@ -219,20 +219,20 @@ func (v *Wrapper) Encrypt(ctx context.Context, plaintext []byte, opt ...wrapping if err != nil { return nil, fmt.Errorf("error wrapping dat: %w", err) } - // Encrypt the DEK using Key Vault - params := keyvault.KeyOperationsParameters{ - Algorithm: keyvault.RSAOAEP256, - Value: to.StringPtr(base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(env.Key)), + algo := azkeys.JSONWebKeyEncryptionAlgorithmRSAOAEP256 + params := azkeys.KeyOperationsParameters{ + Algorithm: &algo, + Value: env.Key, } // Wrap key with the latest version for the key name - resp, err := v.client.WrapKey(ctx, v.buildBaseURL(), v.keyName, "", params) + resp, err := v.client.WrapKey(ctx, v.keyName, "", params, nil) if err != nil { return nil, err } // Store the current key version - keyVersion := ParseKeyVersion(to.String(resp.Kid)) + keyVersion := ParseKeyVersion(resp.KID.Version()) v.currentKeyId.Store(keyVersion) ret := &wrapping.BlobInfo{ @@ -240,7 +240,7 @@ func (v *Wrapper) Encrypt(ctx context.Context, plaintext []byte, opt ...wrapping Iv: env.Iv, KeyInfo: &wrapping.KeyInfo{ KeyId: keyVersion, - WrappedKey: []byte(to.String(resp.Result)), + WrappedKey: resp.Result, }, } @@ -258,40 +258,25 @@ func (v *Wrapper) Decrypt(ctx context.Context, in *wrapping.BlobInfo, opt ...wra } // Unwrap the key - params := keyvault.KeyOperationsParameters{ - Algorithm: keyvault.RSAOAEP256, - Value: to.StringPtr(string(in.KeyInfo.WrappedKey)), - } - resp, err := v.client.UnwrapKey(ctx, v.buildBaseURL(), v.keyName, in.KeyInfo.KeyId, params) + wrappedBytes, err := base64.RawURLEncoding.DecodeString(string(in.KeyInfo.WrappedKey)) if err != nil { - return nil, err + // legacy unwrap as the key used to be stored base64 encoded and this is now handled in the json marshalling + // if it fails, the key is not encoded and can be used directly + wrappedBytes = in.KeyInfo.WrappedKey + } + algo := azkeys.JSONWebKeyEncryptionAlgorithmRSAOAEP256 + params := azkeys.KeyOperationsParameters{ + Algorithm: &algo, + Value: wrappedBytes, } - keyBytes, err := base64.URLEncoding.WithPadding(base64.NoPadding).DecodeString(to.String(resp.Result)) + resp, err := v.client.UnwrapKey(ctx, v.keyName, in.KeyInfo.KeyId, params, nil) if err != nil { return nil, err } - // XXX: Workaround: Azure Managed HSM KeyVault's REST API request parser - // changes the encrypted key to include an extra NULL byte at the end. - // This looks like the base64 of the symmetric AES wrapping key above is - // changed from ...= to ...A. You'll get the error (when running Vault - // init / unseal operation): - // > failed to unseal barrier: failed to check for keyring: failed to create cipher: crypto/aes: invalid key size 33 - // until this is fixed. - // -> 16-byte / 128-bit AES key gets two padding characters, resulting - // in two null bytes. - // -> 24-byte / 196-bit AES key gets no padding and no null bytes. - // -> 32-byte / 256-bit AES key (default) gets one padding character, - // resulting in one null bytes. - if len(keyBytes) == 18 && keyBytes[16] == 0 && keyBytes[17] == 0 { - keyBytes = keyBytes[:16] - } else if len(keyBytes) == 33 && keyBytes[32] == 0 { - keyBytes = keyBytes[:32] - } - envInfo := &wrapping.EnvelopeInfo{ - Key: keyBytes, + Key: resp.Result, Iv: in.Iv, Ciphertext: in.Ciphertext, } @@ -302,29 +287,22 @@ func (v *Wrapper) buildBaseURL() string { return fmt.Sprintf("https://%s.%s/", v.vaultName, v.environment.KeyVaultDNSSuffix) } -func (v *Wrapper) getKeyVaultClient(withCertPool *x509.CertPool) (*keyvault.BaseClient, error) { - var authorizer autorest.Authorizer +func (v *Wrapper) getKeyVaultClient(withCertPool *x509.CertPool) (*azkeys.Client, error) { var err error + var cred azcore.TokenCredential switch { - case v.clientID != "" && v.clientSecret != "": - config := auth.NewClientCredentialsConfig(v.clientID, v.clientSecret, v.tenantID) - config.AADEndpoint = v.environment.ActiveDirectoryEndpoint - config.Resource = strings.TrimSuffix(v.resource, "/") - authorizer, err = config.Authorizer() + // Use client secret if provided + case v.tenantID != "" && v.clientID != "" && v.clientSecret != "": + cred, err = azidentity.NewClientSecretCredential(v.tenantID, v.clientID, v.clientSecret, nil) if err != nil { - return nil, err + return nil, fmt.Errorf("failed to get client secret credentials %w", err) } - // By default use MSI + // By default let Azure select existing credentials default: - config := auth.NewMSIConfig() - config.Resource = strings.TrimSuffix(v.resource, "/") - if v.clientID != "" { - config.ClientID = v.clientID - } - authorizer, err = config.Authorizer() + cred, err = azidentity.NewDefaultAzureCredential(nil) if err != nil { - return nil, err + return nil, fmt.Errorf("failed to acquire managed identity credentials %w", err) } } @@ -353,22 +331,20 @@ func (v *Wrapper) getKeyVaultClient(withCertPool *x509.CertPool) (*keyvault.Base http2Transport.PingTimeout = 2 * time.Second } - client := keyvault.New() - client.Authorizer = authorizer - client.SendDecorators = append(client.SendDecorators, func(s autorest.Sender) autorest.Sender { - if ar, ok := s.(autorest.Client); ok { - ar.Sender = &http.Client{ - Transport: customTransport, - } - return ar - } - return s - }) - return &client, nil + clientOpts := &azkeys.ClientOptions{ + ClientOptions: azcore.ClientOptions{Transport: &http.Client{Transport: customTransport}}, + } + + client, err := azkeys.NewClient(v.baseURL, cred, clientOpts) + if err != nil { + return nil, fmt.Errorf("failed to create keyvault client %w", err) + } + + return client, nil } // Client returns the AzureKeyVault client used by the wrapper. -func (v *Wrapper) Client() *keyvault.BaseClient { +func (v *Wrapper) Client() *azkeys.Client { return v.client } diff --git a/wrappers/azurekeyvault/azurekeyvault_acc_test.go b/wrappers/azurekeyvault/azurekeyvault_acc_test.go index 1ba45886..7a198f3d 100644 --- a/wrappers/azurekeyvault/azurekeyvault_acc_test.go +++ b/wrappers/azurekeyvault/azurekeyvault_acc_test.go @@ -5,20 +5,12 @@ package azurekeyvault import ( "context" - "crypto/tls" - "crypto/x509" - "fmt" - "net/http" - "net/http/httptest" "os" "reflect" "testing" - "github.com/Azure/azure-sdk-for-go/services/keyvault/v7.1/keyvault" - "github.com/Azure/go-autorest/autorest" "github.com/Azure/go-autorest/autorest/azure" wrapping "github.com/hashicorp/go-kms-wrapping/v2" - "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) @@ -46,9 +38,13 @@ func TestAzureKeyVault_SetConfig(t *testing.T) { } func TestAzureKeyVault_IgnoreEnv(t *testing.T) { + if os.Getenv("VAULT_ACC") == "" { + t.SkipNow() + } + + expectedErr := `error fetching Azure Key Vault wrapper key information: Get "https://a-vault-name.a-resource/keys/a-key-name/?api-version=7.3": dial tcp: lookup a-vault-name.a-resource: no such host` + s := NewWrapper() - client := keyvault.New() - s.client = &client // Setup environment values to ignore for the following values for _, envVar := range []string{ @@ -71,7 +67,7 @@ func TestAzureKeyVault_IgnoreEnv(t *testing.T) { "key_name": "a-key-name", } _, err := s.SetConfig(context.Background(), wrapping.WithConfigMap(config)) - assert.NoError(t, err) + require.Equal(t, expectedErr, err.Error()) require.Equal(t, config["tenant_id"], s.tenantID) require.Equal(t, config["client_id"], s.clientID) require.Equal(t, config["client_secret"], s.clientSecret) @@ -108,64 +104,3 @@ func TestAzureKeyVault_Lifecycle(t *testing.T) { t.Fatalf("expected %s, got %s", input, pt) } } - -func Test_getKeyVaultClient(t *testing.T) { - t.Parallel() - config := map[string]string{ - "disallow_env_vars": "true", - "tenant_id": "a-tenant-id", - "client_id": "a-client-id", - "client_secret": "a-client-secret", - "environment": azure.PublicCloud.Name, - "resource": "a-resource", - "vault_name": "a-vault-name", - "key_name": "a-key-name", - } - s := NewWrapper() - _, err := s.SetConfig( - context.Background(), - wrapping.WithConfigMap(config), - WithKeyNotRequired(true), - ) - require.NoError(t, err) - t.Run("send-decorators-set", func(t *testing.T) { - // let's at least ensure that the custom SendDecorator is being properly - // set. - t.Parallel() - got, err := s.getKeyVaultClient(nil) - require.NoError(t, err) - assert.NotEmpty(t, got.SendDecorators) - }) - t.Run("force-tls-error", func(t *testing.T) { - // not great, but this test will at least ensure that the client's - // custom TLS transport is being used - t.Parallel() - ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Write([]byte(fmt.Sprintf("version: %s", tls.VersionName(r.TLS.Version)))) - })) - ts.TLS = &tls.Config{ - MinVersion: tls.VersionTLS10, - MaxVersion: tls.VersionTLS10, - } - ts.StartTLS() - defer ts.Close() - - certPool := x509.NewCertPool() - certPool.AddCert(ts.Certificate()) - - assert.NoError(t, err) - client, err := s.getKeyVaultClient(certPool) - require.NoError(t, err) - assert.NotEmpty(t, client.SendDecorators) - client.Authorizer = &authorizer{} - _, err = client.GetKey(context.Background(), ts.URL, "global", "1") - require.Error(t, err) - assert.ErrorContains(t, err, "tls: protocol version not supported") - }) -} - -type authorizer struct{} - -func (*authorizer) WithAuthorization() autorest.PrepareDecorator { - return autorest.WithNothing() -} diff --git a/wrappers/azurekeyvault/go.mod b/wrappers/azurekeyvault/go.mod index f456bd8c..f6bcdf11 100644 --- a/wrappers/azurekeyvault/go.mod +++ b/wrappers/azurekeyvault/go.mod @@ -3,9 +3,10 @@ module github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 go 1.20 require ( - github.com/Azure/azure-sdk-for-go v68.0.0+incompatible + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0-beta.1 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0-beta.3 + github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0 github.com/Azure/go-autorest/autorest v0.11.28 - github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 github.com/Azure/go-autorest/autorest/to v0.4.0 github.com/hashicorp/go-hclog v1.4.0 github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230228100945-740d2999c798 @@ -14,22 +15,24 @@ require ( ) require ( + github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2 // indirect + github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0 // indirect github.com/Azure/go-autorest v14.2.0+incompatible // indirect github.com/Azure/go-autorest/autorest/adal v0.9.22 // indirect - github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect - github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect github.com/Azure/go-autorest/logger v0.2.1 // indirect github.com/Azure/go-autorest/tracing v0.6.0 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v0.8.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/dimchansky/utfbom v1.1.1 // indirect github.com/fatih/color v1.14.1 // indirect github.com/golang-jwt/jwt/v4 v4.5.0 // indirect + github.com/google/uuid v1.1.1 // indirect github.com/hashicorp/go-uuid v1.0.3 // indirect github.com/kr/text v0.2.0 // indirect + github.com/kylelemons/godebug v1.1.0 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-isatty v0.0.17 // indirect - github.com/mitchellh/go-homedir v1.1.0 // indirect + github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/rogpeppe/go-internal v1.6.1 // indirect golang.org/x/crypto v0.6.0 // indirect diff --git a/wrappers/azurekeyvault/go.sum b/wrappers/azurekeyvault/go.sum index 89dcc9c6..8484bbcd 100644 --- a/wrappers/azurekeyvault/go.sum +++ b/wrappers/azurekeyvault/go.sum @@ -1,18 +1,20 @@ -github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU= -github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0-beta.1 h1:gwgeyp9Xp0tqcSa1vLyMlem4UK5WGEHLAEi34dUVI+Q= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0-beta.1/go.mod h1:DffdKW9RFqa5VgmsjUOsS7UE7eiA5iAvYUs63bhKQ0M= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0-beta.3 h1:ao8gkCj08UzREJSO0rOVQVKRtFVfd0+eKBWf/mDEppc= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0-beta.3/go.mod h1:OIH9iLHznJV3eNkGz/b2CxtY1nOYNak8YzdkBsRVP3Y= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2 h1:+5VZ72z0Qan5Bog5C+ZkgSqUbeVUd9wgtHOrIKuc5b8= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w= +github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0 h1:TOFrNxfjslms5nLLIMjW7N0+zSALX4KiGsptmpb16AA= +github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0/go.mod h1:EAyXOW1F6BTJPiK2pDvmnvxOHPxoTYWoqBeIlql+QhI= +github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0 h1:Lg6BW0VPmCwcMlvOviL3ruHFO+H9tZNqscK0AeuFjGM= +github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0/go.mod h1:9V2j0jn9jDEkCkv8w/bKTNppX/d0FVA1ud77xCIP4KA= github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs= github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24= -github.com/Azure/go-autorest/autorest v0.11.24/go.mod h1:G6kyRlFnTuSbEYkQGawPfsCswgme4iYf6rfSKUDzbCc= github.com/Azure/go-autorest/autorest v0.11.28 h1:ndAExarwr5Y+GaHE6VCaY1kyS/HwwGGyuimVhWsHOEM= github.com/Azure/go-autorest/autorest v0.11.28/go.mod h1:MrkzG3Y3AH668QyF9KRk5neJnGgmhQ6krbhR8Q5eMvA= github.com/Azure/go-autorest/autorest/adal v0.9.18/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ= github.com/Azure/go-autorest/autorest/adal v0.9.22 h1:/GblQdIudfEM3AWWZ0mrYJQSd7JS4S/Mbzh6F0ov0Xc= github.com/Azure/go-autorest/autorest/adal v0.9.22/go.mod h1:XuAbAEUv2Tta//+voMI038TrJBqjKam0me7qR+L8Cmk= -github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 h1:wkAZRgT/pn8HhFyzfe9UnqOjJYqlembgCTi72Bm/xKk= -github.com/Azure/go-autorest/autorest/azure/auth v0.5.12/go.mod h1:84w/uV8E37feW2NCJ08uT9VBfjfUHpgLVnG2InYD6cg= -github.com/Azure/go-autorest/autorest/azure/cli v0.4.5/go.mod h1:ADQAXrkgm7acgWVUNamOgh8YNrv4p27l3Wc55oVfpzg= -github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 h1:w77/uPk80ZET2F+AfQExZyEWtn+0Rk/uw17m9fv5Ajc= -github.com/Azure/go-autorest/autorest/azure/cli v0.4.6/go.mod h1:piCfgPho7BiIDdEQ1+g4VmKyD5y+p/XtSNqE6Hc4QD0= github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw= github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74= github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k= @@ -20,18 +22,17 @@ github.com/Azure/go-autorest/autorest/mocks v0.4.2 h1:PGN4EDXnuQbojHbU0UWoNvmu9A github.com/Azure/go-autorest/autorest/mocks v0.4.2/go.mod h1:Vy7OitM9Kei0i1Oj+LvyAWMXJHeKH1MVlzFugfVrmyU= github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk= github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE= -github.com/Azure/go-autorest/autorest/validation v0.3.1 h1:AgyqjAd94fwNAoTjl/WQXg4VvFeRFpO+UhNyRXqF1ac= -github.com/Azure/go-autorest/autorest/validation v0.3.1/go.mod h1:yhLgjC0Wda5DYXl6JAsWyUe4KVNffhoDhG0zVzUMo3E= github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg= github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8= github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo= github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU= +github.com/AzureAD/microsoft-authentication-library-for-go v0.8.1 h1:oPdPEZFSbl7oSPEAIPMPBMUmiL+mqgzBJwM/9qYcwNg= +github.com/AzureAD/microsoft-authentication-library-for-go v0.8.1/go.mod h1:4qFor3D/HDsvBME35Xy9rwW9DecL+M2sNw1ybjPtwA0= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U= -github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE= +github.com/dnaeon/go-vcr v1.1.0 h1:ReYa/UBrRyQdant9B4fNHGoCNKw6qh6P0fsdGmZpR7c= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w= github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg= @@ -42,6 +43,8 @@ github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o= +github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY= +github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/hashicorp/go-hclog v1.4.0 h1:ctuWFGrhFha8BnnzxqeRGidlEcQkDyL5u8J8t5eA11I= github.com/hashicorp/go-hclog v1.4.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230228100945-740d2999c798 h1:22yjMhn+kJ7u8RaP5qcYEn02zHWnIg1/JxE4BL8JLtQ= @@ -54,6 +57,8 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= +github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= @@ -63,8 +68,8 @@ github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27k github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng= github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= -github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= -github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= +github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4 h1:Qj1ukM4GlMWXNdMBuXcXfz/Kw9s1qm0CLY32QxuSImI= +github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4/go.mod h1:N6UoU20jOqggOuDwUaBQpluzLNDqif3kq9z2wpdYEfQ= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k= @@ -72,14 +77,12 @@ github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTE github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= -github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc= golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= @@ -113,6 +116,7 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=