@voxgig/sdkgen 4.29.0 → 4.30.1

package/project/.sdk/tm/go/feature/secrets/plugins/minivault/minivault.go

@@ -1,26 +1,6 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/minivault/minivault.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/minivault/minivault.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// A mini vault: every secret a project owns, encrypted, in ONE FILE.
-//
-// The store to reach for before there is a vault server. There is
-// nothing to run and nothing to reach over a socket - the whole store is
-// a single binary file - and the same chain that reads it in development
-// reads HashiCorp or AWS in production by changing config, which is the
-// reason sekreto exists.
-//
-// It is a plugin rather than a built-in kind because it needs crypto,
-// which is the line the four built-ins stay behind.
-//
-// THE KEY DECIDES WHAT THE VAULT HOLDS. A master key reads and writes
-// every name and mints restricted keys. A restricted key reads the names
-// it was granted and CANNOT DERIVE ANY OTHER - the restriction is the
-// cryptography rather than a check this code performs, so a copy of the
-// file plus a restricted passphrase yields exactly what was granted and
-// nothing else. What that does and does not protect is set out in
-// DOCS.md under "What the mini vault protects".
-//
-// A port of typescript/plugins/minivault.ts, which is canonical.
 package minivault
 
 import (
@@ -38,17 +18,6 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// THE WRITE LOCK IS PER FILE, NOT PER HANDLE.
-//
-// Each Vault has its own mutex, and two handles on the same file have
-// two of them, so they did not coordinate: both read a snapshot, both
-// wrote, and the second rename discarded the first one's change while
-// reporting success. Keyed by the absolute path, so two handles spelled
-// differently still meet.
-//
-// This is a guarantee WITHIN one process. Two processes still race, and
-// the format's answer to that is the exclusive create and the atomic
-// rename: a reader sees one whole vault or the other, never half of one.
 var (
 	locksmu sync.Mutex
 	locks   = map[string]*sync.Mutex{}
@@ -81,9 +50,7 @@ type KeyInfo struct {
 	Grants []string `json:"grants"`
 }
 
-// GrantSpec mints a restricted key.
 type GrantSpec struct {
-	// Key is the id the new key answers to.
 	Key string
 	// Passphrase is what unwraps it. Nothing else does, and no master can
 	// recover it - a lost restricted passphrase is re-granted, never read
@@ -91,51 +58,21 @@ type GrantSpec struct {
 	Passphrase string
 	// Names the key may read. A name that does not exist yet is allowed
 	// and means what it says: the key reads it once a master writes it.
-	Names []string
-	// Write says whether it may overwrite the values it can read.
-	Write bool
-	// Iterations for this key's PBKDF2, defaulting to the opening
-	// handle's.
+	Names      []string
+	Write      bool
 	Iterations int
 }
 
-// Options open one vault file as one key.
 type Options struct {
-	// File is the vault file.
-	File string
-	// Key is which key to open with. Default MasterKey.
-	Key string
-	// Passphrase unwraps that key.
+	File       string
+	Key        string
 	Passphrase string
 	// Iterations is the PBKDF2 round count used when this handle CREATES
 	// a key. Reading uses what the file records for the key being opened.
 	Iterations int
-	// Create makes the file, with this key as its master, if it is not
-	// there.
-	//
-	// Off by default. A missing vault is far more often a broken
-	// deployment than a new one, and a store that invents itself where a
-	// real vault was meant to be answers every read with a miss.
-	Create bool
+	Create     bool
 }
 
-// ring is what a key holds, as it is stored: EITHER a root key (master)
-// OR a fixed set of derived per-secret keys (restricted).
-//
-// GRANTS IS A POINTER, AND THAT IS THE WHOLE OF A FORMAT BUG THIS ONCE
-// HAD. The asymmetry is the format: a master's ring carries `root` and no
-// `grants`, and a restricted key's carries `grants` - POSSIBLY EMPTY - and
-// no `root`. A plain map with `omitempty` gets the first half right and
-// the second half wrong, because `omitempty` drops an empty map as
-// readily as a nil one: a key granted nothing wrote
-// `{"v":1,"write":false}` where the canonical writes
-// `{"v":1,"write":false,"grants":{}}`, a vault 12 bytes shorter than
-// every other port's for the same input.
-//
-// It read back identically everywhere, because an absent `grants` parses
-// as empty - which is why no round trip saw it and why the fixtures could
-// not: none of them has a key granted nothing. The bytes are the
-// contract, so the pointer makes the empty map survive while nil omits.
 type ring struct {
 	V      int                `json:"v"`
 	Write  bool               `json:"write"`
@@ -164,13 +101,6 @@ type meta struct {
 	Grants []string `json:"grants"`
 }
 
-// Vault is a handle on one vault file, opened as ONE key.
-//
-// Every method answers as that key: List shows the names it may read,
-// Get answers for those and misses on the rest, and the master-only
-// methods refuse for any other key. Nothing is read or derived until the
-// first call that needs the file, so putting a vault in a chain costs no
-// key derivation until a secret is actually wanted.
 type Vault struct {
 	file       string
 	key        string
@@ -211,11 +141,6 @@ func sameseal(left *sealed, right *sealed) bool {
 	return bytes.Equal(left.IV, right.IV) && bytes.Equal(left.Blob, right.Blob)
 }
 
-// Open a vault file as one key.
-//
-// The handle is lazy. Nothing is read, and no passphrase is stretched,
-// until a method needs the file - so a chain of ten providers costs ten
-// objects rather than ten PBKDF2 runs.
 func Open(options *Options) (*Vault, error) {
 	if nil == options || "" == options.File {
 		return nil, fail("a vault needs a file")
@@ -259,9 +184,6 @@ func Create(options *Options) (*Vault, error) {
 		return nil, err
 	}
 
-	// No os.Stat first: the check and the write would be two steps, and
-	// putnew refuses an existing file in ONE, which is what makes two
-	// processes racing to create a vault leave one vault.
 	fresh, err := newvault(vault.key, vault.passphrase, vault.iterations)
 	if nil != err {
 		return nil, err
@@ -274,18 +196,10 @@ func Create(options *Options) (*Vault, error) {
 	return vault, nil
 }
 
-// File is the vault file this handle reads.
 func (vault *Vault) File() string { return vault.file }
 
-// Key is the key id this handle opens with.
 func (vault *Vault) Key() string { return vault.key }
 
-// Info derives the key and reads the file NOW rather than at first use.
-//
-// A COPY. Set asks Info.Write whether this key may write, so handing the
-// caller the value that answer lives in let it flip its own permission:
-// `info, _ := v.Info(); info.Write = true` turned a read-only key into a
-// writing one. Authorization state does not leave this struct.
 func (vault *Vault) Info() (*KeyInfo, error) {
 	vault.mu.Lock()
 	defer vault.mu.Unlock()
@@ -298,7 +212,6 @@ func (vault *Vault) Info() (*KeyInfo, error) {
 	return copyinfo(info), nil
 }
 
-// Close forgets the derived keys. The next call opens again.
 func (vault *Vault) Close() {
 	vault.mu.Lock()
 	defer vault.mu.Unlock()
@@ -309,19 +222,12 @@ func (vault *Vault) Close() {
 	vault.ring = nil
 }
 
-// --- reading the file ------------------------------------------------
-
 func (vault *Vault) bytes() ([]byte, error) {
 	raw, err := os.ReadFile(vault.file)
 	if nil == err {
 		return raw, nil
 	}
 
-	// A vault is configured deliberately, with a key. Its absence is a
-	// broken deployment and never "no secrets here": answering a miss
-	// would send the chain on to a weaker store, which is the failure
-	// mode this library most has to avoid. Create is the caller saying
-	// the opposite, in writing.
 	if os.IsNotExist(err) {
 		if !vault.create {
 			return nil, fail("no vault file: " + vault.file)
@@ -415,7 +321,6 @@ func (vault *Vault) load() (*vaultFile, *KeyInfo, error) {
 	return file, vault.info, nil
 }
 
-// rootof is the root key, or a refusal naming what needed it.
 func (vault *Vault) rootof(what string) ([]byte, error) {
 	if nil == vault.root {
 		return nil, fail(what + " needs a master key, and " + vault.key + " is restricted")
@@ -431,16 +336,6 @@ func (vault *Vault) keyfor(name string) []byte {
 	return vault.grants[name]
 }
 
-// save replaces the file rather than editing it in place. The rename is
-// what makes a concurrent reader see either the old file or the new one,
-// so a write interrupted halfway leaves a vault rather than wreckage.
-//
-// THE TEMPORARY IS RANDOM AND EXCLUSIVE. `<vault>.<pid>.tmp` is a name
-// anyone can predict, and os.WriteFile FOLLOWS a symlink, so anyone who
-// could write the vault's directory could point that name at another
-// file and have the next save truncate it. O_EXCL refuses an existing
-// path and will not follow a symlink to create one, and the random
-// suffix stops two writers colliding on the name.
 func (vault *Vault) save(file *vaultFile) error {
 	suffix, err := random(8)
 	if nil != err {
@@ -477,7 +372,6 @@ func (vault *Vault) save(file *vaultFile) error {
 
 // --- reading secrets -------------------------------------------------
 
-// List is the names this key can read, sorted.
 func (vault *Vault) List() ([]string, error) {
 	vault.mu.Lock()
 	defer vault.mu.Unlock()
@@ -530,11 +424,6 @@ func (vault *Vault) Get(name string) (string, bool, error) {
 
 	key := vault.keyfor(name)
 	if nil == key {
-		// OUTSIDE THE GRANT IS A MISS, deliberately. The vault answers as
-		// the key that opened it, so a name this key cannot read is a
-		// name this store does not hold for this caller - the same answer
-		// a stranger's vault gives, and the one that makes a restricted
-		// key in front of a broader store a workable chain.
 		return "", false, nil
 	}
 
@@ -551,7 +440,6 @@ func (vault *Vault) Get(name string) (string, bool, error) {
 	return string(plain), true, nil
 }
 
-// Has says whether this key can read that name.
 func (vault *Vault) Has(name string) (bool, error) {
 	_, has, err := vault.Get(name)
 	return has, err
@@ -617,7 +505,6 @@ func (vault *Vault) Set(name string, value string) error {
 	return vault.save(file)
 }
 
-// Remove drops a name. Master only.
 func (vault *Vault) Remove(name string) error {
 	if err := sekreto.CheckName(name); nil != err {
 		return err
@@ -664,7 +551,6 @@ func (vault *Vault) Remove(name string) error {
 
 // --- keys ------------------------------------------------------------
 
-// Keys is every key in the file, with what it may do. Master only.
 func (vault *Vault) Keys() ([]*KeyInfo, error) {
 	vault.mu.Lock()
 	defer vault.mu.Unlock()
@@ -707,7 +593,6 @@ func (vault *Vault) Keys() ([]*KeyInfo, error) {
 	return out, nil
 }
 
-// Grant mints a restricted key. Master only.
 func (vault *Vault) Grant(spec *GrantSpec) error {
 	// Every write on this file, from any handle in this process,
 	// serializes here; see lockfor.
@@ -810,12 +695,6 @@ func (vault *Vault) Revoke(key string) error {
 	return vault.save(file)
 }
 
-// Rotate takes a new root key, re-encrypts every value under it, and
-// DROPS EVERY OTHER KEY. Master only.
-//
-// The other keys go because they must: their rings are sealed under
-// passphrases this process does not have, so there is no way to hand
-// them keys they can unwrap. Re-grant afterwards.
 func (vault *Vault) Rotate() error {
 	// Every write on this file, from any handle in this process,
 	// serializes here; see lockfor.
@@ -837,8 +716,6 @@ func (vault *Vault) Rotate() error {
 
 	iters := file.key(vault.key).Iters
 
-	// Read everything out under the old root before anything changes:
-	// once the root is replaced the old derived keys are unreachable.
 	oldnamekey := mac(oldroot, labelNames)
 	held := [][2]string{}
 
@@ -890,9 +767,6 @@ func (vault *Vault) Rotate() error {
 		return err
 	}
 
-	// SAVE FIRST, adopt second. A handle holding the new root over a file
-	// that still holds the old one reads nothing and says the vault is
-	// damaged, which is the wrong story about a failed write.
 	if err := vault.save(&vaultFile{Keys: []*keyRecord{fresh}, Entries: entries}); nil != err {
 		return err
 	}
@@ -927,7 +801,6 @@ func sealkey(
 	return &keyRecord{ID: id, Salt: salt, Iters: iters, Ring: sealedring, Meta: sealedmeta}, nil
 }
 
-// newvault is a new vault: one master key, no secrets.
 func newvault(keyid string, passphrase string, iterations int) (*vaultFile, error) {
 	root, err := random(keyLen)
 	if nil != err {
@@ -944,15 +817,6 @@ func newvault(keyid string, passphrase string, iterations int) (*vaultFile, erro
 	return &vaultFile{Keys: []*keyRecord{record}, Entries: []*entryRecord{}}, nil
 }
 
-// putnew writes a vault file that is not there yet, and REFUSES one that
-// is.
-//
-// Straight to the target under O_EXCL rather than through a temporary
-// and a rename. Rename REPLACES its destination, so two processes
-// creating the same vault both succeeded and the second discarded the
-// first one's secrets; an os.Stat beforehand only narrows that window.
-// There is nothing to lose by writing the target directly here, because
-// there is no file to damage: either this call creates it or it fails.
 func putnew(file string, vault *vaultFile) error {
 	handle, err := os.OpenFile(file, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
 	if nil != err {
@@ -989,10 +853,6 @@ func unb64(text string, what string) ([]byte, error) {
 	return raw, nil
 }
 
-// tojson is json.Marshal, and deliberately not WriteJSON: these bytes
-// are sealed and then parsed again inside this process, so the HTML
-// escaping WriteJSON turns off is unobservable here. WriteJSON is for
-// what LEAVES the process.
 func tojson(value any) []byte {
 	raw, err := json.Marshal(value)
 	if nil != err {
@@ -1003,12 +863,6 @@ func tojson(value any) []byte {
 
 // --- the provider ----------------------------------------------------
 
-// Provider reads a vault as one store in a chain.
-//
-// The provider is the READ half and nothing more: a chain resolves
-// secrets, and writing one is a deliberate act with an API of its own.
-// That API is the same handle, reached with VaultOf off a chain or built
-// directly with Open.
 type Provider struct {
 	Vault *Vault
 }
@@ -1025,19 +879,6 @@ func (provider *Provider) Describe() string {
 // the `provider` key every kind publishes.
 const VaultExport = "vault"
 
-// Plugin is the `minivault` provider kind, as a voxgig/plugin definition.
-//
-// Written out rather than built by sekreto.ProviderPlugin, because this
-// definition publishes TWO exports: `provider`, the read half every kind
-// publishes, and `vault`, the programmatic API. voxgig/plugin's exports
-// are how a definition offers an application more than the host's own
-// vocabulary, and a store that can only be read is half a vault.
-//
-// The SekretoError wrapping is what ProviderPlugin would have done:
-// plugin wraps a code-less error returned from Define as
-// `plugin_define_failed`, and keeps one that already carries a code, so a
-// refusal of this provider's own configuration travels under
-// `sekreto_error` and comes back out of the host as itself.
 var Plugin = plugin.Definition{
 	Name: "minivault",
 	Define: func(inst *plugin.Inst) error {
@@ -1077,17 +918,6 @@ func wrap(inst *plugin.Inst, err error) error {
 		map[string]any{"ref": inst.Ref(), "cause": serr.Message})
 }
 
-// VaultOf is the vault behind a store in a chain, as its programmatic
-// API.
-//
-// Host() is the voxgig/plugin host the chain is made of, and a
-// definition's exports are readable off it by ref. This is the one call
-// that turns a store into an API, and it lives here rather than on
-// Sekreto because the core knows no plugin.
-//
-// With no store named, the unqualified alias answers: one vault in the
-// chain resolves whatever it is called, and two raise rather than
-// picking one.
 func VaultOf(sek *sekreto.Sekreto, store string) (*Vault, error) {
 	if "" == store {
 		found, err := sek.Host().Exports("minivault/" + VaultExport)
@@ -1101,13 +931,6 @@ func VaultOf(sek *sekreto.Sekreto, store string) (*Vault, error) {
 		return vault, nil
 	}
 
-	// A NAMED STORE MUST EXIST, and the alias must not stand in for it.
-	// Host().Exports falls back to the alias when the exact ref misses,
-	// so asking for `minivault` in a chain whose only vault is named
-	// `app` used to hand back the `app` vault - and then write to it.
-	// Naming a store that is not there raises, which is the rule the
-	// whole library follows: Try already means "may not have it", so it
-	// cannot also mean "may not exist".
 	ref := "minivault"
 	if "minivault" != store {
 		ref = "minivault$" + store

package/project/.sdk/tm/go/feature/secrets/plugins/onepassword/onepassword.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/onepassword/onepassword.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/onepassword/onepassword.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The onepassword plugin: 1Password, through a Connect server. Needs
 // HTTPS. A port of typescript/plugins/onepassword.ts.
@@ -15,12 +15,6 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// Provider reads 1Password, through a Connect server.
-//
-// The item titled api.token (titles keep their dots), in the named vault.
-// The value is the field with purpose PASSWORD, or the field labelled
-// `value`. A vault that cannot be found is an error - config names it, so
-// its absence is a broken store, not a missing secret.
 type Provider struct {
 	Addr  string
 	Token string

package/project/.sdk/tm/go/feature/secrets/plugins/secretspec/secretspec.go

@@ -1,5 +1,5 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/plugins/secretspec/secretspec.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/plugins/secretspec/secretspec.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
 // The secretspec plugin: SecretSpec, through its CLI. Needs a child
 // process. A port of typescript/plugins/secretspec.ts.
@@ -15,27 +15,6 @@ import (
 	"GOMODULE/feature/secrets/sekreto"
 )
 
-// Provider reads SecretSpec (https://secretspec.dev).
-//
-// SecretSpec is a declaration - a secretspec.toml naming the secrets a
-// project needs - plus a chain of its own backends to satisfy them from.
-// That makes it the same shape as sekreto one level down, and the reason to
-// support it is the same reason sekreto exists: a project that has already
-// declared its secrets there should not have to declare them again here.
-//
-// Read through its CLI, as boru is, because that is the interface it offers
-// a program in another language: `secretspec get API_TOKEN` prints the value
-// on stdout and nothing else. A sekreto name maps to a SecretSpec key
-// exactly as it maps to an environment variable - api.token is API_TOKEN -
-// which is the convention SecretSpec's own examples use.
-//
-// Backend selects one of SecretSpec's backends (--provider, e.g. `keyring`
-// or `dotenv://.env`) and is called Backend here only because Provider
-// already means something else in this library.
-//
-// A reason is required, not optional: SecretSpec records every read in an
-// audit log and refuses to read at all without one. sekreto sends `sekreto`
-// unless told otherwise, so the audit trail says which tool asked.
 type Provider struct {
 	Command string
 	File    string
@@ -113,19 +92,6 @@ func (provider *Provider) Describe() string {
 	return "secretspec"
 }
 
-// secretspecmiss reports whether a SecretSpec failure means "no such secret"
-// rather than "I could not answer".
-//
-// SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does not
-// declare and one declared with no value, and both are misses: this store
-// does not hold it, so the chain carries on.
-//
-// MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
-// `Provider backend 'keyring' not found`, which is a store that could not
-// answer at all - and reading that as a miss is the worst failure this
-// library has, because the chain then falls through to a weaker store
-// without saying so. The key is required to appear, so the two cannot be
-// confused.
 func secretspecmiss(why string, key string) bool {
 	return strings.Contains(why, "Secret '"+key+"' not found")
 }

package/project/.sdk/tm/go/feature/secrets/sekreto/addr.go

@@ -1,27 +1,10 @@
-// VENDORED: @voxgig/sekreto sdk-20260917-1242-0 (go/sekreto/addr.go)
-// Source: https://github.com/voxgig/sekreto @ 108c4a914bee7b6534c30d1c68c25cd1b9377696  [tag: sdk-20260917-1242-0]
+// VENDORED: @voxgig/sekreto sdk-20260925-1316-0 (go/sekreto/addr.go)
+// Source: https://github.com/voxgig/sekreto @ 163f537960de6813cc393b89843949ca3afa8cfc  [tag: sdk-20260925-1316-0]
 // License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
-// The plaintext-address guard, in the core because it is pure - a
-// handful of string steps, no socket - and because it is on the spec:
-// every port answers the same for every address in spec/def/store.aon.
-// The plugins that dial an address call CheckAddr before they do.
-//
-// A port of typescript/src/provider/addr.ts.
-
 package sekreto
 
 import "strings"
 
-// SafeAddr returns the address with any userinfo replaced by [redacted],
-// for messages.
-//
-// Every refusal in CheckAddr names the address it refused, and one of them fires
-// precisely because the address carries a credential - so printing it
-// verbatim wrote the password to stderr and into the logs. It cannot be
-// cleaned up afterwards either: that password was never resolved as a
-// secret, so Redact has never seen it and never will. The host is what a
-// reader needs to identify which chain entry is at fault; the userinfo is
-// not.
 func SafeAddr(addr string) string {
 	mark := strings.Index(addr, "://")
 	if -1 == mark {
@@ -42,27 +25,6 @@ func SafeAddr(addr string) string {
 	return addr[:mark+3] + "[redacted]" + addr[mark+3+at:]
 }
 
-// CheckAddr refuses to send a Vault token in the clear.
-//
-// Vault's API is HTTPS in any real deployment; plaintext is a dev-mode
-// convenience. Sending X-Vault-Token over http to anything but the local
-// machine puts both the token and the secret it fetches on the wire for
-// anyone on the path, so sekreto will not do it. Loopback stays allowed:
-// that is `vault server -dev` and this repo's own test harness.
-//
-// The address is read by hand, in the same handful of steps in every port,
-// rather than by each platform's URL parser. That is deliberate. Twelve
-// parsers disagree about malformed input - where userinfo ends, whether
-// 0177.0.0.1 is loopback, what an unclosed bracket means - and a check that
-// answers differently in different ports is not a check.
-//
-// The rule this parse obeys, and the reason it can be trusted: it is never
-// more permissive than the HTTP client that will dial the address. It ends
-// the authority at '/', '?' or '#' only, so a client that also breaks on
-// '\' (WHATWG does) can only ever see a SHORTER host than this does. It
-// refuses userinfo outright rather than locating its end. It compares the
-// host literally, so a numeric form no parser here agrees on is refused
-// rather than guessed at.
 func CheckAddr(addr string) error {
 	scheme := ""
 	if strings.HasPrefix(addr, "https://") {
@@ -80,13 +42,6 @@ func CheckAddr(addr string) error {
 		authority = rest[:end]
 	}
 
-	// Userinfo is refused outright rather than parsed around, and on https as
-	// well as http. No store this library speaks authenticates by userinfo -
-	// they take a token or a signature - so an address carrying one is a
-	// mistake at best. At worst it is the attack this whole function exists
-	// to stop: http://localhost:8200@evil.example.com/ is a request to
-	// evil.example.com that reads, to anything that splits the authority on
-	// ':', as loopback.
 	if strings.Contains(authority, "@") {
 		return Fail("sekreto: refusing an address with embedded credentials: " + SafeAddr(addr))
 	}