hugo-encrypt.go

package main

import (
	"bytes"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/sha1"
	"crypto/sha256"
	"encoding/hex"
	"flag"
	"fmt"
	"io/ioutil"
	"os"
	"path/filepath"
	"strings"

	"github.com/PuerkitoBio/goquery"
	"golang.org/x/crypto/pbkdf2"
)

func deriveKey(passphrase string, salt []byte) ([]byte, []byte) {
	if salt == nil {
		salt = make([]byte, 8)
		// http://www.ietf.org/rfc/rfc2898.txt
		// Salt.
		_, err := rand.Read(salt)
		if err != nil {
			fmt.Println("Error in reading random number.")
		}
	}
	return pbkdf2.Key([]byte(passphrase), salt, 1000, 32, sha256.New), salt
}

func encrypt(passphrase, plaintext string) string {
	key, salt := deriveKey(passphrase, nil)
	iv := make([]byte, 12)
	// http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
	// Section 8.2
	_, err := rand.Read(iv)
	if err != nil {
		fmt.Println("Error in reading random number.")
	}
	b, _ := aes.NewCipher(key)
	aesgcm, _ := cipher.NewGCM(b)
	data := aesgcm.Seal(nil, iv, []byte(plaintext), nil)
	return hex.EncodeToString(salt) + "-" + hex.EncodeToString(iv) + "-" + hex.EncodeToString(data)
}

func encryptPage(path string) {
	content, err := ioutil.ReadFile(path)
	if err != nil {
		panic(err)
	}
	doc, err := goquery.NewDocumentFromReader(bytes.NewBuffer(content))
	if err != nil {
		panic(err)
	}
	doc.Find("cipher-text").Each(func(i int, block *goquery.Selection) {
		fmt.Printf("Processing %s, %d\n", path, i)

		password, _ := block.Attr("data-password")
		blockHtml, _ := block.Html()
		data := []byte(blockHtml)
		sha1ByteArray := sha1.Sum(data)
		fmt.Printf("SHA1: % x\n\n", sha1ByteArray)
		sha1String := hex.EncodeToString(sha1ByteArray[:])
		encryptThis := blockHtml + "\n<div id='hugo-encrypt-sha1sum'>" + sha1String + "</div>"
		encryptedHtml := encrypt(password, encryptThis)
		block.RemoveAttr("data-password")
		block.SetHtml(encryptedHtml)
	})
	wholeHtml, _ := doc.Html()
	err = ioutil.WriteFile(path, []byte(wholeHtml), 0644)
	if err != nil {
		panic(err)
	}
}

func main() {
	sitePathPtr := flag.String("sitePath", "./public", "Relative or absolute path of the public directory generated by hugo")

	flag.Parse()

	err := filepath.Walk(*sitePathPtr, func(path string, f os.FileInfo, err error) error {
		if f == nil {
			return err
		}
		if f.IsDir() {
			return nil
		}
		ok := strings.HasSuffix(f.Name(), ".html")
		if ok {
			encryptPage(path)
		}
		return nil
	})
	if err != nil {
		fmt.Printf("filepath.Walk() returned %v\n", err)
		panic(err)
	}
}