Segmentation violation while encrypting an export

[olorin37]

Wile using option -e with or without --public-key command just fails with runtime error:

❯ ./medusa export -e --public-key ~/.ssh/id_rsa.pub secrets                                                                                                                                                                                          09:30:41
2025/06/11 09:30:51 ERROR: fail get idrsapub, invalid key
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x63e702]

goroutine 1 [running]:
crypto/rsa.checkPub(...)
	/opt/hostedtoolcache/go/1.21.13/x64/src/crypto/rsa/rsa.go:96
crypto/rsa.EncryptOAEP({0xa83328?, 0xc000244280?}, {0xa7f4c0?, 0xc00007a020?}, 0x7e19a2?, {0xc00028ca00?, 0x5ac4?, 0x6000?}, {0x0, 0x0, ...})
	/opt/hostedtoolcache/go/1.21.13/x64/src/crypto/rsa/rsa.go:523 +0x42
github.com/jonasvinther/medusa/pkg/encrypt.RsaEncrypt(0xc0002fa2e8, 0x5ac4?)
	/home/runner/work/medusa/medusa/pkg/encrypt/rsa.go:79 +0x9d
github.com/jonasvinther/medusa/pkg/encrypt.Encrypt({0x7ffff16c3fde?, 0x9ac3dc?}, {0x1?, 0xc00002818b?}, {0xc0003ee000, 0x5ac4, 0x5f?})
	/home/runner/work/medusa/medusa/pkg/encrypt/encrypt.go:21 +0xa9
github.com/jonasvinther/medusa/cmd.glob..func5(0xc00016ee00?, {0xc000040d80?, 0x4?, 0x9aa4a1?})
	/home/runner/work/medusa/medusa/cmd/export.go:85 +0x7a8
github.com/spf13/cobra.(*Command).execute(0xdce940, {0xc000040d40, 0x4, 0x4})
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:985 +0xabc
github.com/spf13/cobra.(*Command).ExecuteC(0xdcddc0)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1117 +0x3ff
github.com/spf13/cobra.(*Command).Execute(...)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1041
github.com/jonasvinther/medusa/cmd.Execute(...)
	/home/runner/work/medusa/medusa/cmd/cmd.go:77
main.main()
	/home/runner/work/medusa/medusa/main.go:10 +0x1b

Used file as public key also doesn't matter (I tried with ed25519 or even fake key - which was just text file with some garbage).

In case when --public-key is not provided the error output is little different:

❯ ./medusa export -e secrets                                                                                                                                                                                                                         09:28:49
2025/06/11 09:29:04 ERROR: fail get idrsapub, open : no such file or directory
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x63e702]

goroutine 1 [running]:
crypto/rsa.checkPub(...)
	/opt/hostedtoolcache/go/1.21.13/x64/src/crypto/rsa/rsa.go:96
crypto/rsa.EncryptOAEP({0xa83328?, 0xc00003bf00?}, {0xa7f4c0?, 0xc000080020?}, 0x7e19a2?, {0xc00034a140?, 0x5ac4?, 0x6000?}, {0x0, 0x0, ...})
	/opt/hostedtoolcache/go/1.21.13/x64/src/crypto/rsa/rsa.go:523 +0x42
github.com/jonasvinther/medusa/pkg/encrypt.RsaEncrypt(0xc0002ac528, 0x5ac4?)
	/home/runner/work/medusa/medusa/pkg/encrypt/rsa.go:79 +0x9d
github.com/jonasvinther/medusa/pkg/encrypt.Encrypt({0x0?, 0x9ac3dc?}, {0x1?, 0xc00002818b?}, {0xc000514000, 0x5ac4, 0x5f?})
	/home/runner/work/medusa/medusa/pkg/encrypt/encrypt.go:21 +0xa9
github.com/jonasvinther/medusa/cmd.glob..func5(0xc000186e00?, {0xc000081340?, 0x4?, 0x9aa4a1?})
	/home/runner/work/medusa/medusa/cmd/export.go:85 +0x7a8
github.com/spf13/cobra.(*Command).execute(0xdce940, {0xc000081320, 0x2, 0x2})
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:985 +0xabc
github.com/spf13/cobra.(*Command).ExecuteC(0xdcddc0)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1117 +0x3ff
github.com/spf13/cobra.(*Command).Execute(...)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1041
github.com/jonasvinther/medusa/cmd.Execute(...)
	/home/runner/work/medusa/medusa/cmd/cmd.go:77
main.main()
	/home/runner/work/medusa/medusa/main.go:10 +0x1b

[slapcat]

I ran into the same issue. The problem is that it requires an x509 public key certificate, not an SSH public key. Checkout the example here: https://github.com/jonasvinther/medusa?tab=readme-ov-file#secure-secret-management-outside-vault