Cryptography Decrypt
CertifiedDecrypt and optionally verify OpenPGP files
Cryptography Decrypt
Decrypt and optionally verify OpenPGP files
Streams an ASCII-armored PGP message from Kestra storage, decrypts it with the provided secret key and optional passphrase, and returns the cleartext URI. When signer public keys are supplied, verifies a one-pass signature and can enforce specific signer user IDs. The integrity of the encrypted message is always checked (MDC for SEIP, authentication tag for AEAD) and the task fails if the message was modified; legacy messages without integrity protection (SED packets) are rejected.
type: io.kestra.plugin.crypto.openpgp.DecryptExamples
Decrypt a file
id: crypto_decrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: decrypt
type: io.kestra.plugin.crypto.openpgp.Decrypt
from: "{{ inputs.file }}"
privateKey: "{{ secret('PGP_PRIVATE_KEY') }}"
privateKeyPassphrase: "{{ secret('PGP_PRIVATE_KEY_PASSPHRASE') }}"
Decrypt a file and verify signature
id: crypto_decrypt
namespace: company.team
inputs:
- id: file
type: FILE
tasks:
- id: decrypt
type: io.kestra.plugin.crypto.openpgp.Decrypt
from: "{{ inputs.file }}"
privateKey: "{{ secret('PGP_PRIVATE_KEY') }}"
privateKeyPassphrase: "{{ secret('PGP_PRIVATE_KEY_PASSPHRASE') }}"
signUsersKey:
- |
-----BEGIN PGP PUBLIC KEY BLOCK-----
requiredSignerUsers:
- signer@kestra.io
Properties
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150from string
Source file to decrypt
Kestra internal storage URI or templated path to the encrypted message.
Pebble expression referencing an Internal Storage URI e.g. {{ outputs.mytask.uri }}.
privateKey string
Private key for decryption
ASCII-armored secret key export such as gpg --export-secret-key -a; the first key ring found is used.
privateKeyPassphrase string
Passphrase for private key
Leave empty for unprotected keys; required for most secret keys.
requiredSignerUsers array
Required signer user IDs
Optional list of allowed signer identities, e.g. signer@kestra.io. Requires signUsersKey to also be set, since the signer's identity is read from the matching public key. When set, decryption fails unless the message is signed and one of these values exactly matches the signer key's OpenPGP user ID or the email address it contains.
signUsersKey array
Allowed signer public keys
Optional list of ASCII-armored public keys used to verify the message's one-pass signature. When set, decryption fails if the message is unsigned, if the signature was not produced by one of these keys, or if the signature itself does not verify.
Outputs
uri string
uriURI of decrypted file
