egbt/secrets
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions

docs: fix stale manifest-dependency comments in migrate (EGB-710)

Browse source
This commit is contained in:
Brian Majewski 2026-06-08 08:26:16 -07:00
parent 5729d84e75
commit 3ac2a86a94
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
secrets
View file

@ -2127,11 +2127,11 @@ cmd_verify() {
# secrets migrate --dry-run # per project: report old→new, write nothing # secrets migrate --dry-run # per project: report old→new, write nothing
# secrets migrate # per project: write v2 twins beside v1 blobs # secrets migrate # per project: write v2 twins beside v1 blobs
# secrets migrate --finalize # store-wide: verify, drop v1, stamp v2 # secrets migrate --finalize # store-wide: verify, drop v1, stamp v2
# Per-project (needs the project manifest to know which externals are # Per-project copy-forward is manifest-free (enumerates the store's blobs);
# `properties`); finalize is store-wide. Mirrors verify's project/--all split. # finalize is store-wide. Mirrors verify's project/--all split.
# Copy-forward (or dry-run preview) for the current project. Reads # Copy-forward (or dry-run preview) for the current project. Manifest-free:
# $PWD/.secrets.json; only `properties` external blobs rename in v2. # enumerates the store's `*.gradle-properties.age` blobs; only those rename in v2.
_migrate_project() { _migrate_project() {
local dry_run="$1" local dry_run="$1"
if [ "$(_store_format)" = "2" ]; then if [ "$(_store_format)" = "2" ]; then
@ -2183,9 +2183,6 @@ _migrate_project() {
info "Copy-forward for '$project': $moved new v2 twin(s), $already already present. v1 blobs kept (non-destructive). Run 'secrets migrate --finalize' once every project is migrated and every machine is upgraded." info "Copy-forward for '$project': $moved new v2 twin(s), $already already present. v1 blobs kept (non-destructive). Run 'secrets migrate --finalize' once every project is migrated and every machine is upgraded."
} }
# Store-wide finalize: the only destructive step. Refuses unless verify --all
# is green and every v1 properties blob has a v2 twin. Cuts a recovery tag,
# stamps the marker, then drops v1 blobs.
# Read-only survey: walk every project dir in the store and report each one's # Read-only survey: walk every project dir in the store and report each one's
# v2-readiness from the blobs on disk (no manifest, no decryption). Exits # v2-readiness from the blobs on disk (no manifest, no decryption). Exits
# non-zero when any v1 properties blob lacks a v2 twin (i.e. the store is not # non-zero when any v1 properties blob lacks a v2 twin (i.e. the store is not
@ -2226,6 +2223,9 @@ _migrate_status() {
return 0 return 0
} }
# Store-wide finalize: the only destructive step. Refuses unless verify --all
# is green and every v1 properties blob has a v2 twin. Cuts a recovery tag,
# stamps the marker, then drops v1 blobs.
_migrate_finalize() { _migrate_finalize() {
local force="$1" local force="$1"
check_key check_key