phase 4

src/parsing.rs

@@ -1,4 +1,5 @@
 use std::ffi::OsString;
+use std::io::Write;
 use std::path::{Path, PathBuf};
 use flate2::Compression;
 use flate2::write::GzEncoder;
@@ -119,7 +120,26 @@ impl DrawerOperation {
             gz.finish()
                 .map_err(|_| DrawerError::TarFailed)?;
         }
-        std::fs::write(&self.drawer_file, &buf)
+
+        let key_path = self.key_path()?;
+        let file = std::fs::File::open(&key_path)
+            .map_err(|_| DrawerError::KeyInvalid(key_path.clone()))?;
+        let reader = std::io::BufReader::new(file);
+        let identity = age::ssh::Identity::from_buffer(reader, None)
+            .map_err(|_| DrawerError::EncryptFailed)?;
+        let recipient = age::ssh::Recipient::try_from(identity)
+            .map_err(|_| DrawerError::EncryptFailed)?;
+
+        let mut encrypted: Vec<u8> = Vec::new();
+        let encryptor = age::Encryptor::with_recipients(
+            std::iter::once(&recipient as &dyn age::Recipient)
+        ).map_err(|_| DrawerError::EncryptFailed)?;
+        let mut writer = encryptor.wrap_output(&mut encrypted)
+            .map_err(|_| DrawerError::EncryptFailed)?;
+        writer.write_all(&buf).map_err(|_| DrawerError::EncryptFailed)?;
+        writer.finish().map_err(|_| DrawerError::EncryptFailed)?;
+
+        std::fs::write(&self.drawer_file, &encrypted)
             .map_err(|_| DrawerError::WriteFailed(self.drawer_file.clone()))
     }
 
@@ -134,20 +154,28 @@ impl DrawerOperation {
         }
     }
 
-    fn validate_key(&self) -> Result<(), DrawerError> {
-        let key_path = match &self.key {
+    fn key_path(&self) -> Result<PathBuf, DrawerError> {
+        match &self.key {
             EnvVar => {
                 let val = std::env::var("DRAWER_KEY").map_err(|_| DrawerError::NoKeyPath)?;
-                PathBuf::from(val)
+                Ok(PathBuf::from(val))
             }
-            Path(p) => p.clone(),
-        };
-        match std::fs::File::open(&key_path) {
-            Ok(_) => Ok(()),
-            Err(_) => Err(DrawerError::KeyInvalid(key_path)),
+            Path(p) => Ok(p.clone()),
         }
     }
 
+    fn validate_key(&self) -> Result<(), DrawerError> {
+        let key_path = self.key_path()?;
+        let file = std::fs::File::open(&key_path)
+            .map_err(|_| DrawerError::KeyInvalid(key_path.clone()))?;
+        let reader = std::io::BufReader::new(file);
+        let identity = age::ssh::Identity::from_buffer(reader, None)
+            .map_err(|_| DrawerError::KeyNotValidSsh)?;
+        age::ssh::Recipient::try_from(identity)
+            .map_err(|_| DrawerError::KeyNotValidSsh)?;
+        Ok(())
+    }
+
     fn validate_open(&self) -> Result<(), DrawerError> {
         if !self.drawer_file.exists() {
             return Err(DrawerError::DrawerFileNotFound(self.drawer_file.clone()));