Lockr

Contribution

What I built

1. 01Designed the vault: one encrypted file at ~/.lockr/vault.enc (mode 0600) — no server, account, sync or network dependency anywhere in the tool.
2. 02Built the crypto layer: Argon2id key derivation (one pass, 64 MiB, four threads, 32-byte key) over a fresh 16-byte salt, and AES-256-GCM sealing the whole vault under a new nonce on every write.
3. 03Made it fast to use: the master password is cached in the native keychain on macOS, Linux and Windows, typed once and flushed with `lockr lock` (or wiped by `lockr destroy`).
4. 04Shaped the CLI around real work: group namespacing (work/stripe_key), `list` that masks values and flags secrets older than 90 days, `get --copy` straight to the clipboard, and `export` that prints shell assignments.
5. 05Shipped it properly: a `v*` tag drives GoReleaser on GitHub Actions to build CGO-free static binaries for five OS/arch targets and update the Homebrew tap in the same run.

How it works

How the data moves

The core paths through the system — a dot travels each hop, and the caption says what happens there.

From the code

A few lines that matter

// DeriveKey derives a 32-byte encryption key from a
// master password and salt. It uses Argon2id, which is
// resistant to both GPU and side-channel attacks.
func DeriveKey(password string, salt []byte) []byte {
	// time=1, memory=64MB, threads=4, keyLen=32 bytes
	return argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
}

func Encrypt(key, plaintext []byte) ([]byte, []byte, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, nil, err
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, nil, err
	}
	// Generate a random nonce
	nonce := make([]byte, gcm.NonceSize())
	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
		return nil, nil, err
	}
	// Seal encrypts and authenticates the plaintext
	ciphertext := gcm.Seal(nil, nonce, plaintext, nil)
	return ciphertext, nonce, nil
}

Decisions

Calls that shaped it