egbt/secrets
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions

fix: init second-machine guard, store .gitignore self-heal, rekey dotfile loss

Browse source 
Three fixes, found from a real Ubuntu second-machine setup failure:

1. cmd_init: if key.txt exists but the store has no .git, die BEFORE
   git init with directed guidance to clone the existing secrets repo
   instead. Previously init ran git init, then age-keygen died on the
   existing key, leaving a half-initialized store (.git but no
   .gitignore or hook).

2. ensure_store_protections: push/pull/rekey now restore a missing
   store .gitignore (and pre-commit hook) before any `git add -A`.
   Without the .gitignore, add -A would commit key.txt to the remote.

3. cmd_rekey: the re-encrypt loop used a bare "$dir"* glob, which never
   matches dotfiles — .env blobs were decrypted to the tmpdir but never
   re-encrypted, leaving them on the OLD key (undecryptable) while the
   new key overwrote key.txt. Glob now matches the decrypt loop
   ("$dir"* "$dir".*). Exposed by the self-heal test: with nothing
   staged, the empty commit failed mid-rekey.

Tests: 5 new bats tests (118 total) — init guard, .gitignore self-heal
on push/pull/rekey, and a rekey round-trip that survives key rotation.
This commit is contained in:
Brian Majewski 2026-06-05 09:38:16 -07:00
parent e947cfde19
commit 25cd1feb43
3 changed files with 144 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

2
CLAUDE.md
View file

@ -37,7 +37,7 @@ Single bash script (`secrets`) with subcommands: init, push, pull, list, rm, rek
secrets # CLI script (~600 lines bash)
hooks/pre-commit # Pre-commit hook template
test/
secrets.bats # bats-core test suite (113 tests)
secrets.bats # bats-core test suite (118 tests)
test_helper.bash # Shared setup/teardown
README.md # User-facing documentation
CLAUDE.md # This file