dimahkiin/cryptopro-extract repository overview

⁠dimahkiin/cryptopro-extract

Command-line tool that opens a CryptoPro CSP key container (a directory with header.key, masks.key, primary.key, name.key) and extracts the GOST R 34.10-2012 private key, printing its curve OID, fingerprint and hex value, and optionally writing it to disk. Pure Go - no CryptoPro CSP installation and no OpenSSL required. It is the CLI counterpart of dimahkiin/cryptopro-extract-service.

Source code: https://github.com/LdDl/esia-potato⁠

⁠Configuration

No config file and no environment variables. Everything is passed as arguments after the image name: [options] <container_path>, where <container_path> is a directory inside the container (not an archive, not a single file).

Minimal working example - mount the container directory and pass its in-container path:

docker run --rm -v "$(pwd)/container:/data:ro" \
  dimahkiin/cryptopro-extract:latest -p 12345 /data

Output is structured JSON on stdout, including private_key in hex:

{"level":"INFO","msg":"container opened","path":"/data","curve_oid":"1.2.643.2.2.35.1"}
{"level":"INFO","msg":"primary key extracted","curve_oid":"1.2.643.2.2.35.1","fingerprint":"b52a...","private_key":"a1b2c3d4..."}

If -p is omitted and stdin is a terminal, the tool prompts for the PIN - that requires docker run -it. Without a TTY and without -p it proceeds with an empty PIN and fails with a fingerprint mismatch.

⁠Usage

Save the key to files next to the container. The mount must be writable (drop :ro), and the output prefix must be an absolute path inside the mount - a relative prefix writes into /app, which disappears with --rm:

docker run --rm -v "$(pwd)/container:/data" \
  dimahkiin/cryptopro-extract:latest -p 12345 -o /data/mykey /data

This produces ./container/mykey_primary.bin (raw 32-byte key) and ./container/mykey_primary.hex. The container runs as root, so those files will be root-owned on the host.

Show usage and all flags:

docker run --rm dimahkiin/cryptopro-extract:latest

⁠Ports

None. The image exposes no ports and makes no network connections.

⁠Paths inside the container

⁠Image

Multi-stage build: docker.io/golang:alpine compiles a fully static binary (CGO_ENABLED=0, -ldflags "-s -w"), the final stage is FROM scratch and contains nothing but that binary - no shell, no package manager, no CA certificates. Platform: linux/amd64 only. Size: ~2.5 MB.

⁠License

POTATO LICENSE, Version 2 - the code is released into the public domain. https://github.com/LdDl/esia-potato/blob/master/LICENSE⁠