Function encryptSecret

example/auditlogstream/main.go:46–62

encryptSecret encrypts a plain-text secret using libsodium's sealed box (crypto_box_seal), which is what GitHub's API expects for encrypted credentials.

(publicKeyB64, secret string)

// encryptSecret encrypts a plain-text secret using libsodium's sealed box
// (crypto_box_seal), which is what GitHub's API expects for encrypted credentials.
func encryptSecret(publicKeyB64, secret string) (string, error) {
	publicKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
	if err != nil {
		return "", fmt.Errorf("decoding public key: %w", err)
	}
	if len(publicKeyBytes) != 32 {
		return "", fmt.Errorf("public key must be 32 bytes, got %v", len(publicKeyBytes))
	}
	publicKey := [32]byte(publicKeyBytes)

	encrypted, err := box.SealAnonymous(nil, []byte(secret), &publicKey, rand.Reader)
	if err != nil {
		return "", fmt.Errorf("encrypting secret: %w", err)
	}

	return base64.StdEncoding.EncodeToString(encrypted), nil
}

func main() {
	if len(os.Args) < 2 {