Function decrypt

scripts/dev-github-reconcile.cjs:52–61

(buf, secret)

  return Buffer.concat([salt, cipher.getAuthTag(), iv, enc]);
}
function decrypt(buf, secret) {
  const salt = buf.subarray(0, SALT);
  const tag = buf.subarray(SALT, SALT + TAG);
  const iv = buf.subarray(SALT + TAG, SALT + TAG + IV);
  const msg = buf.subarray(SALT + TAG + IV);
  const key = crypto.pbkdf2Sync(secret, salt, ITER, KEYLEN, DIGEST);
  const d = crypto.createDecipheriv('aes-256-gcm', key, iv, { authTagLength: TAG });
  d.setAuthTag(tag);
  return d.update(msg, undefined, 'utf-8') + d.final('utf-8');
}

function appJwt() {
  const appId = need('GITHUB_APP_ID');