Cryptography Decrypt

Cryptography Decrypt
Certified
Decrypt and optionally verify OpenPGP files

Streams an ASCII-armored PGP message from Kestra storage, decrypts it with the provided secret key and optional passphrase, and returns the cleartext URI. When signer public keys are supplied, verifies a one-pass signature and can enforce specific signer user IDs.

yaml
type: io.kestra.plugin.crypto.openpgp.Decrypt

Examples

Decrypt a file

yaml
id: crypto_decrypt
namespace: company.team

inputs:
  - id: file
    type: FILE

tasks:
  - id: decrypt
    type: io.kestra.plugin.crypto.openpgp.Decrypt
    from: "{{ inputs.file }}"
    privateKey: "{{ secret('PGP_PRIVATE_KEY') }}"
    privateKeyPassphrase: "{{ secret('PGP_PRIVATE_KEY_PASSPHRASE') }}"

Decrypt a file and verify signature

yaml
id: crypto_decrypt
namespace: company.team

inputs:
  - id: file
    type: FILE

tasks:
  - id: decrypt
    type: io.kestra.plugin.crypto.openpgp.Decrypt
    from: "{{ inputs.file }}"
    privateKey: "{{ secret('PGP_PRIVATE_KEY') }}"
    privateKeyPassphrase: "{{ secret('PGP_PRIVATE_KEY_PASSPHRASE') }}"
    signUsersKey:
      - |
        -----BEGIN PGP PUBLIC KEY BLOCK-----
    requiredSignerUsers:
      - signer@kestra.io

Properties

from string

Source file to decrypt

Kestra internal storage URI or templated path to the encrypted message.

Pebble expression referencing an Internal Storage URI e.g. {{ outputs.mytask.uri }}.

pluginDefaultsRef string

Reference (ref) of the pluginDefaults to apply to this task.

privateKey string

Private key for decryption

ASCII-armored secret key export such as gpg --export-secret-key -a; the first key ring found is used.

privateKeyPassphrase string

Passphrase for private key

Leave empty for unprotected keys; required for most secret keys.

requiredSignerUsers array

SubTypestring

Required signer user IDs

Optional list of allowed signer identities, e.g. signer@kestra.io. Requires signUsersKey to also be set, since the signer's identity is read from the matching public key. When set, decryption fails unless the message is signed and one of these values exactly matches the signer key's OpenPGP user ID or the email address it contains.

signUsersKey array

SubTypestring

Allowed signer public keys

Optional list of ASCII-armored public keys used to verify the message's one-pass signature. When set, decryption fails if the message is unsigned, if the signature was not produced by one of these keys, or if the signature itself does not verify.

Outputs

uri string

Formaturi

URI of decrypted file