Cryptography Decrypt
CertifiedDecrypt and optionally verify OpenPGP files
Cryptography Decrypt
Decrypt and optionally verify OpenPGP files
Streams an ASCII-armored PGP message from Kestra storage, decrypts it with the provided secret key and optional passphrase, and returns the cleartext URI. When signer public keys are supplied, verifies a one-pass signature and can enforce specific signer user IDs.
type: io.kestra.plugin.crypto.openpgp.DecryptExamples
Decrypt a file
id: crypto_decrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: decrypt
type: io.kestra.plugin.crypto.openpgp.Decrypt
from: "{{ inputs.file }}"
privateKey: "{{ secret('PGP_PRIVATE_KEY') }}"
privateKeyPassphrase: "{{ secret('PGP_PRIVATE_KEY_PASSPHRASE') }}"
Decrypt a file and verify signature
id: crypto_decrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: decrypt
type: io.kestra.plugin.crypto.openpgp.Decrypt
from: "{{ inputs.file }}"
privateKey: "{{ secret('PGP_PRIVATE_KEY') }}"
privateKeyPassphrase: "{{ secret('PGP_PRIVATE_KEY_PASSPHRASE') }}"
signUsersKey:
- |
-----BEGIN PGP PUBLIC KEY BLOCK-----
requiredSignerUsers:
- signer@kestra.io
Properties
from string
Source file to decrypt
Kestra internal storage URI or templated path to the encrypted message.
Pebble expression referencing an Internal Storage URI e.g. {{ outputs.mytask.uri }}.
pluginDefaultsRef Non-dynamicstring
Reference (ref) of the pluginDefaults to apply to this task.
privateKey string
Private key for decryption
ASCII-armored secret key export such as gpg --export-secret-key -a; the first key ring found is used.
privateKeyPassphrase string
Passphrase for private key
Leave empty for unprotected keys; required for most secret keys.
requiredSignerUsers array
Required signer user IDs
If set, verification fails unless the signature user ID matches one of these values; ignored when no signature is present.
signUsersKey array
Allowed signer public keys
Optional list of ASCII-armored public keys used to verify one-pass signatures.
Outputs
uri string
uriURI of decrypted file
