diff options
| -rw-r--r-- | man/pass.1 | 12 | ||||
| -rwxr-xr-x | src/password-store.sh | 41 |
2 files changed, 37 insertions, 16 deletions
@@ -126,19 +126,19 @@ alternatively named \fBremove\fP or \fBdelete\fP. If \fI--recursive\fP or \fI-r\ is specified, delete pass-name recursively if it is a directory. If \fI--force\fP or \fI-f\fP is specified, do not interactively prompt before removal. .TP -\fBmv\fP [ \fI--force\fP, \fI-f\fP ] \fIold-path\fP \fInew-path\fP +\fBmv\fP [ \fI--reencrypt\fP, \fI-e\fP ] [ \fI--force\fP, \fI-f\fP ] \fIold-path\fP \fInew-path\fP Renames the password or directory named \fIold-path\fP to \fInew-path\fP. This command is alternatively named \fBrename\fP. If \fI--force\fP is specified, silently overwrite \fInew-path\fP if it exists. If \fInew-path\fP ends in a -trailing \fI/\fP, it is always treated as a directory. Passwords will be reencrypted -to the corresponding keys of their new destination. +trailing \fI/\fP, it is always treated as a directory. Passwords may be optionally +reencrypted to the corresponding keys of their new destination. .TP -\fBcp\fP [ \fI--force\fP, \fI-f\fP ] \fIold-path\fP \fInew-path\fP +\fBcp\fP [ \fI--reencrypt\fP, \fI-e\fP ] [ \fI--force\fP, \fI-f\fP ] \fIold-path\fP \fInew-path\fP Copies the password or directory named \fIold-path\fP to \fInew-path\fP. This command is alternatively named \fBcopy\fP. If \fI--force\fP is specified, silently overwrite \fInew-path\fP if it exists. If \fInew-path\fP ends in a -trailing \fI/\fP, it is always treated as a directory. Passwords will be reencrypted -to the corresponding keys of their new destination. +trailing \fI/\fP, it is always treated as a directory. Passwords may be optionally +reencrypted to the corresponding keys of their new destination. .TP \fBgit\fP \fIgit-command-args\fP... If the password store is a git repository, pass \fIgit-command-args\fP as arguments to diff --git a/src/password-store.sh b/src/password-store.sh index e791ece..0828a32 100755 --- a/src/password-store.sh +++ b/src/password-store.sh @@ -41,11 +41,13 @@ yesno() { } set_gpg_recipients() { GPG_RECIPIENT_ARGS=( ) + GPG_RECIPIENTS=( ) local gpg_id if [[ -n $PASSWORD_STORE_KEY ]]; then for gpg_id in $PASSWORD_STORE_KEY; do GPG_RECIPIENT_ARGS+=( "-r" "$gpg_id" ) + GPG_RECIPIENTS+=( "$gpg_id" ) done return fi @@ -69,6 +71,7 @@ set_gpg_recipients() { while read -r gpg_id; do GPG_RECIPIENT_ARGS+=( "-r" "$gpg_id" ) + GPG_RECIPIENTS+=( "$gpg_id" ) done < "$current" } agent_check() { @@ -84,15 +87,31 @@ agent_check() { reencrypt_path() { local passfile local passfile_dir + local passfile_display local fake_uniqueness_safety + local prev_gpg_recipients + local gpg_keys + local current_keys find "$1" -iname '*.gpg' | while read -r passfile; do fake_uniqueness_safety="$RANDOM" passfile_dir="${passfile%/*}" passfile_dir="${passfile_dir#$PREFIX}" passfile_dir="${passfile_dir#/}" + passfile_display="${passfile#$PREFIX/}" + passfile_display="${passfile_display%.gpg}" + set_gpg_recipients "$passfile_dir" - $GPG -d $GPG_OPTS "$passfile" | $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile.new.$fake_uniqueness_safety" $GPG_OPTS && - mv -v "$passfile.new.$fake_uniqueness_safety" "$passfile" + [[ $prev_gpg_recipients != "${GPG_RECIPIENTS[@]}" ]] && \ + gpg_keys="$(gpg --list-keys --keyid-format long "${GPG_RECIPIENTS[@]}" | sed -n 's/sub *.*\/\([A-F0-9]\{16\}\) .*/\1/p' | sort | uniq)" + current_keys="$($GPG -v --list-only --keyid-format long "$passfile" 2>&1 | cut -d ' ' -f 5 | sort | uniq)" + + if [[ $gpg_keys != "$current_keys" ]]; then + echo "$passfile_display: reencrypting to ${gpg_keys//$'\n'/ }" + $GPG -d $GPG_OPTS "$passfile" | $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile.new.$fake_uniqueness_safety" $GPG_OPTS && + mv "$passfile.new.$fake_uniqueness_safety" "$passfile" + fi + + prev_gpg_recipients="${GPG_RECIPIENTS[@]}" done } @@ -205,10 +224,10 @@ cmd_usage() { Prompt before overwriting existing password unless forced. $PROGRAM rm [--recursive,-r] [--force,-f] pass-name Remove existing password or directory, optionally forcefully. - $PROGRAM mv [--force,-f] old-path new-path - Renames or moves old-path to new-path, optionally forcefully. - $PROGRAM cp [--force,-f] old-path new-path - Copies old-path to new-path, optionally forcefully. + $PROGRAM mv [--reencrypt,-e] [--force,-f] old-path new-path + Renames or moves old-path to new-path, optionally forcefully, optionally reencrypting. + $PROGRAM cp [--reencrypt,-e] [--force,-f] old-path new-path + Copies old-path to new-path, optionally forcefully, optionally reencrypting. $PROGRAM git git-command-args... If the password store is a git repository, execute a git command specified by git-command-args. @@ -256,7 +275,7 @@ cmd_init() { if [[ $reencrypt -eq 1 ]]; then agent_check reencrypt_path "$PREFIX/$id_path" - git_add_file "$PREFIX/$id_path" "Reencrypted password store using new GPG id ${id_print}." + git_add_file "$PREFIX/$id_path" "Reencrypted password store using new GPG id ${id_print%, }." fi } @@ -517,16 +536,18 @@ cmd_copy_move() { shift local force=0 + local reencrypt=0 local opts opts="$($GETOPT -o f -l force -n "$PROGRAM" -- "$@")" local err=$? eval set -- "$opts" while true; do case $1 in -f|--force) force=1; shift ;; + -e|--reencrypt) reencrypt=1; shift ;; --) shift; break ;; esac done if [[ $# -ne 2 ]]; then - echo "Usage: $PROGRAM $COMMAND [--force,-f] old-path new-path" + echo "Usage: $PROGRAM $COMMAND [--reencrypt,-e] [--force,-f] old-path new-path" exit 1 fi local old_path="$PREFIX/${1%/}" @@ -550,7 +571,7 @@ cmd_copy_move() { if [[ $move -eq 1 ]]; then mv $interactive -v "$old_path" "$new_path" || exit 1 - [[ -e "$new_path" ]] && reencrypt_path "$new_path" + [[ $reencrypt -eq 1 && -e "$new_path" ]] && reencrypt_path "$new_path" if [[ -d $GIT_DIR && ! -e $old_path ]]; then git rm -qr "$old_path" @@ -562,7 +583,7 @@ cmd_copy_move() { done else cp $interactive -r -v "$old_path" "$new_path" || exit 1 - [[ -e "$new_path" ]] && reencrypt_path "$new_path" + [[ $reencrypt -eq 1 && -e "$new_path" ]] && reencrypt_path "$new_path" git_add_file "$new_path" "Copied ${1} to ${2}." fi } |