feat: secrets join + init --remote + verified onboarding (EGB-671)
Add second-machine onboarding as a first-class verb rather than a manual clone + key-copy sequence: - secrets join --remote <url> --key <path>: clone the vault, install the key at mode 600, then decrypt-test it before declaring success. An empty vault reports "nothing to verify yet" (never a false VERIFIED); a wrong key fails loudly. Reuses the audited core (resolve_store, get_pubkey, _verify_all) — no security logic re-implemented. - secrets init --remote <url>: wire the remote and push the initial store so the upstream branch exists (fixes the commit_and_push_secrets pull --ff-only die against a brand-new empty remote). init also offers an interactive first-add of a project (default No; skipped under --yes / non-interactive). - cmd_push first-manifest scaffold writes an explicit committed options.autoAdd value, asked once when interactive (EGB-677 contract #2). - secrets pull now dies loudly when a blob fails to decrypt (all three decrypt paths) instead of warning and exiting 0 — a wrong key can't pass silently. - Interactive prompts gate on stdin AND stdout being ttys, so bats/CI never hang. - Dispatcher routes init/join args correctly; second-machine trap points at join. Tests: 20 new (join, autoAdd, pty-no-hang regression); 2 trap tests updated.
This commit is contained in:
Brian Majewski
parent
ec538d7ef0
commit
6319313ee4
4 changed files with 380 additions and 28 deletions
239
secrets
239
secrets
|
|
@ -1235,6 +1235,25 @@ ensure_store_protections() {
|
|||
cmd_init() {
|
||||
check_cmd age
|
||||
check_cmd git
|
||||
|
||||
# EGB-671: flag parsing. --remote wires the encrypted-vault git remote and
|
||||
# establishes an upstream branch (so the first project push won't hit the
|
||||
# commit_and_push_secrets `pull --ff-only` die on a brand-new empty remote).
|
||||
# --yes / non-interactive means init-only: skip the interactive first-add.
|
||||
local remote="" assume_yes=false
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--remote) [ $# -ge 2 ] || die "--remote requires a URL"
|
||||
case "$2" in --|-*) die "--remote value looks like a flag: $2" ;; esac
|
||||
remote="$2"; shift 2 ;;
|
||||
--remote=*) remote="${1#--remote=}"
|
||||
[ -n "$remote" ] || die "--remote= requires a value"; shift ;;
|
||||
--yes|-y) assume_yes=true; shift ;;
|
||||
-*) die "Unknown init flag: $1. Usage: secrets init [--remote <url>] [--yes]" ;;
|
||||
*) die "Unexpected argument to init: $1" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
resolve_store
|
||||
|
||||
if [ -d "$SECRETS_DIR/.git" ]; then
|
||||
|
|
@ -1242,17 +1261,15 @@ cmd_init() {
|
|||
fi
|
||||
|
||||
# Second-machine trap: a copied key.txt without a repo means the user
|
||||
# should clone their existing secrets repo, not init a fresh one.
|
||||
# Catch it BEFORE git init so we don't leave a half-initialized store.
|
||||
# should join their existing vault, not init a fresh one. Catch it BEFORE
|
||||
# git init so we don't leave a half-initialized store.
|
||||
if [ -f "$KEY_FILE" ]; then
|
||||
# Render a runnable clone command when .secrets-store carried a remote
|
||||
# URL (already sanitized by resolve_store), mirroring check_initialized.
|
||||
local clone_src="<your-secrets-remote>"
|
||||
[ -n "${_REMOTE_URL:-}" ] && clone_src="$_REMOTE_URL"
|
||||
die "Found an existing key at $KEY_FILE but no repo at $SECRETS_DIR.
|
||||
If this is a second machine, don't run 'secrets init' — clone your existing secrets repo instead:
|
||||
If this is a second machine, don't run 'secrets init' — join your existing vault:
|
||||
|
||||
git clone $clone_src $SECRETS_DIR
|
||||
secrets join --remote $clone_src --key $KEY_FILE
|
||||
|
||||
Your key file has been left untouched."
|
||||
fi
|
||||
|
|
@ -1268,9 +1285,7 @@ Your key file has been left untouched."
|
|||
# Write .gitignore
|
||||
write_store_gitignore
|
||||
|
||||
# Stamp the store format (EGB-703): a fresh store is born v2 — it has no
|
||||
# v1 blobs, so it is already in v2 shape. The marker is a committed,
|
||||
# non-secret metadata file (NOT gitignored); the first push stages it.
|
||||
# Stamp the store format (EGB-703): a fresh store is born v2.
|
||||
printf '2\n' > "$SECRETS_DIR/$STORE_FORMAT_FILE_NAME"
|
||||
|
||||
# Install pre-commit hook
|
||||
|
|
@ -1282,11 +1297,159 @@ Your key file has been left untouched."
|
|||
|
||||
info "Done! Your public key is:"
|
||||
echo " $pubkey"
|
||||
|
||||
if [ -n "$remote" ]; then
|
||||
_init_wire_remote "$remote"
|
||||
else
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo " 1. Add a remote: secrets init --remote <url> (or: git -C $SECRETS_DIR remote add origin <url>)"
|
||||
echo " 2. Copy $KEY_FILE to your other machine (AirDrop, scp, USB)"
|
||||
echo " 3. On the other machine: secrets join --remote <url> --key <path-to-key.txt>"
|
||||
fi
|
||||
|
||||
# Interactive first-add (EGB-671): only when truly interactive AND not --yes.
|
||||
# Require BOTH stdin and stdout to be ttys — bats/CI capture a command's
|
||||
# stdout (so `[ -t 1 ]` is false under automation even when stdin is still
|
||||
# the terminal), which is the reliable "don't prompt" signal. Default is No.
|
||||
if [ "$assume_yes" != true ] && [ -t 0 ] && [ -t 1 ] && [ -e /dev/tty ]; then
|
||||
_init_first_add
|
||||
fi
|
||||
}
|
||||
|
||||
# EGB-671: wire the encrypted-vault remote and establish an upstream branch.
|
||||
# Commits the born-v2 store (so .secrets-format etc. exist on the remote) and
|
||||
# push -u, so a later `secrets push` pulls --ff-only against a real upstream
|
||||
# instead of dying on a non-existent branch.
|
||||
_init_wire_remote() {
|
||||
local remote="$1"
|
||||
git -C "$SECRETS_DIR" remote add origin "$remote"
|
||||
ensure_store_protections
|
||||
_stamp_writer_version
|
||||
git -C "$SECRETS_DIR" add -A
|
||||
git -C "$SECRETS_DIR" commit -m "Initialize secrets store (format v2)" >/dev/null 2>&1 || true
|
||||
local br
|
||||
br=$(git -C "$SECRETS_DIR" symbolic-ref --short HEAD 2>/dev/null || echo main)
|
||||
if git -C "$SECRETS_DIR" push -u origin "$br" >/dev/null 2>&1; then
|
||||
info "Wired remote origin=$remote and pushed the initial store (upstream: origin/$br)."
|
||||
else
|
||||
info "Added remote origin=$remote, but the initial push failed."
|
||||
echo " Create the PRIVATE repo first, then: git -C $SECRETS_DIR push -u origin $br" >&2
|
||||
fi
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo " 1. Add a remote: cd $SECRETS_DIR && git remote add origin <url>"
|
||||
echo " 2. Copy $KEY_FILE to your other machine (AirDrop, scp, USB)"
|
||||
echo " 3. Run 'secrets push <project>' from a project directory"
|
||||
echo "Next: copy $KEY_FILE to your other machine, then run there:"
|
||||
echo " secrets join --remote $remote --key <path-to-key.txt>"
|
||||
}
|
||||
|
||||
# EGB-671: interactive "add your first project" post-step. Reads from /dev/tty
|
||||
# so it never collides with a piped stdin. Default No. Drives the existing
|
||||
# push path (cmd_push is $PWD-bound) by cd'ing into the chosen project dir.
|
||||
_init_first_add() {
|
||||
printf "Add a project's secrets to the vault now? [y/N] " > /dev/tty 2>/dev/null || return 0
|
||||
local ans=""
|
||||
read -r ans < /dev/tty 2>/dev/null || return 0
|
||||
case "$ans" in [Yy]*) ;; *) return 0 ;; esac
|
||||
printf "Path to the project directory: " > /dev/tty 2>/dev/null || return 0
|
||||
local dir=""
|
||||
read -r dir < /dev/tty 2>/dev/null || return 0
|
||||
[ -n "$dir" ] || return 0
|
||||
case "$dir" in
|
||||
"~") dir="$HOME" ;;
|
||||
"~/"*) dir="$HOME/${dir#\~/}" ;;
|
||||
esac
|
||||
if [ ! -d "$dir" ]; then
|
||||
echo "Not a directory: $dir — skipping first-add. Run 'secrets push' from a project later." > /dev/tty 2>/dev/null || true
|
||||
return 0
|
||||
fi
|
||||
( cd "$dir" && cmd_push ) || true
|
||||
return 0
|
||||
}
|
||||
|
||||
# EGB-671: second-machine onboarding. Clone the vault, install the key, and
|
||||
# decrypt-test it BEFORE declaring success — the one thing a hand-copied
|
||||
# README sequence never did (a mis-copied key fails silently at first pull).
|
||||
# Security logic (path rails on --key/--store, URL sanitization) lives in the
|
||||
# audited core, reused — never re-implemented in a standalone install script.
|
||||
cmd_join() {
|
||||
check_cmd age
|
||||
check_cmd git
|
||||
|
||||
local remote="" keyfile=""
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--remote) [ $# -ge 2 ] || die "--remote requires a URL"
|
||||
case "$2" in --|-*) die "--remote value looks like a flag: $2" ;; esac
|
||||
remote="$2"; shift 2 ;;
|
||||
--remote=*) remote="${1#--remote=}"
|
||||
[ -n "$remote" ] || die "--remote= requires a value"; shift ;;
|
||||
--key) [ $# -ge 2 ] || die "--key requires a path"
|
||||
case "$2" in --|-*) die "--key value looks like a flag: $2" ;; esac
|
||||
keyfile="$2"; shift 2 ;;
|
||||
--key=*) keyfile="${1#--key=}"
|
||||
[ -n "$keyfile" ] || die "--key= requires a value"; shift ;;
|
||||
-*) die "Unknown join flag: $1. Usage: secrets join --remote <url> --key <path>" ;;
|
||||
*) die "Unexpected argument to join: $1" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
resolve_store
|
||||
|
||||
[ -n "$remote" ] || die "secrets join requires --remote <url>
|
||||
Usage: secrets join --remote <url> --key <path-to-key.txt>"
|
||||
[ -n "$keyfile" ] || die "secrets join requires --key <path>
|
||||
This is the age key (key.txt) from your first machine.
|
||||
Usage: secrets join --remote <url> --key <path-to-key.txt>"
|
||||
if [ -d "$keyfile" ]; then
|
||||
die "--key must point to the key FILE, not a directory: $keyfile
|
||||
Did you mean: --key $keyfile/key.txt ?"
|
||||
fi
|
||||
[ -e "$keyfile" ] || die "Key file not found: $keyfile
|
||||
Copy key.txt from your first machine (AirDrop/scp/USB) and pass its path."
|
||||
[ -r "$keyfile" ] || die "Key file not readable: $keyfile"
|
||||
|
||||
if [ -e "$SECRETS_DIR" ]; then
|
||||
die "A store already exists at $SECRETS_DIR.
|
||||
'secrets join' clones a fresh vault — it won't clobber an existing one.
|
||||
If you meant to refresh it, run 'secrets pull' instead, or remove $SECRETS_DIR first."
|
||||
fi
|
||||
|
||||
info "Joining vault: cloning $remote → $SECRETS_DIR"
|
||||
if ! git clone "$remote" "$SECRETS_DIR" >/dev/null 2>&1; then
|
||||
rm -rf "$SECRETS_DIR"
|
||||
die "Failed to clone $remote
|
||||
Check the URL and that you have access to the repo."
|
||||
fi
|
||||
|
||||
# Install the key BEFORE anything that decrypts, at mode 600.
|
||||
cp "$keyfile" "$SECRETS_DIR/key.txt"
|
||||
chmod 600 "$SECRETS_DIR/key.txt"
|
||||
KEY_FILE="$SECRETS_DIR/key.txt"
|
||||
ensure_store_protections
|
||||
|
||||
if ! get_pubkey >/dev/null 2>&1; then
|
||||
die "The file you passed to --key is not a valid age identity: $keyfile
|
||||
Your store was cloned to $SECRETS_DIR; replace key.txt with a valid key and run 'secrets pull'."
|
||||
fi
|
||||
|
||||
# Verify gate: decrypt-test every blob. An EMPTY store returns 0 from
|
||||
# _verify_all ("nothing to check") — that proves nothing about the key, so
|
||||
# join must NOT report VERIFIED in that case (EGB-671 / E-S1b).
|
||||
local blob_count
|
||||
blob_count=$(find "$SECRETS_DIR" -type f -name '*.age' 2>/dev/null | wc -l | tr -d ' ')
|
||||
if [ "$blob_count" -eq 0 ]; then
|
||||
info "Joined $SECRETS_DIR — the vault is empty, so there's nothing to verify yet."
|
||||
echo "Next: run 'secrets pull' in a project once secrets have been pushed from another machine."
|
||||
return 0
|
||||
fi
|
||||
if _verify_all >/dev/null 2>&1; then
|
||||
info "VERIFIED — your key decrypts all $blob_count blob(s). You've joined the vault."
|
||||
echo "Next: run 'secrets pull' in any project to restore its secrets."
|
||||
return 0
|
||||
fi
|
||||
die "Your key does NOT decrypt this vault ($blob_count blob(s) failed).
|
||||
This is almost always the wrong key.txt. The store is at $SECRETS_DIR;
|
||||
replace key.txt with the correct key and run 'secrets pull', or remove
|
||||
$SECRETS_DIR and re-run 'secrets join' with the right --key."
|
||||
}
|
||||
|
||||
# Encrypt env files from a source dir into a project path in the secrets repo.
|
||||
|
|
@ -1498,8 +1661,22 @@ cmd_push() {
|
|||
'.dotenv = ((.dotenv // []) + $add) | .external = ((.external // []) + $ext)' "$manifest" \
|
||||
| _write_manifest_canonical "$manifest" || die "Failed to update $manifest"
|
||||
else
|
||||
jq -n --argjson add "$add_json" --argjson ext "$absorbed_json" \
|
||||
'{version: '"$MANIFEST_VERSION"', dotenv: $add} | if ($ext | length) > 0 then .external = $ext else . end' \
|
||||
# EGB-671 / EGB-677 contract #2: scaffolding the project's FIRST manifest.
|
||||
# Record an explicit, committed options.autoAdd value. Ask once when
|
||||
# interactive (read from /dev/tty so a piped stdin never collides);
|
||||
# otherwise write the tool default (ON) explicitly so the value is
|
||||
# committed and team-shared rather than left implicit.
|
||||
local autoadd_commit="true"
|
||||
# Require BOTH stdin and stdout to be ttys (bats/CI capture stdout, so
|
||||
# `[ -t 1 ]` is false under automation — never block a scripted push).
|
||||
if [ -t 0 ] && [ -t 1 ] && [ -e /dev/tty ]; then
|
||||
printf "Auto-track new env files in this project as you add them? [Y/n] " > /dev/tty 2>/dev/null || true
|
||||
local _aa=""
|
||||
read -r _aa < /dev/tty 2>/dev/null || _aa=""
|
||||
case "$_aa" in [Nn]*) autoadd_commit="false" ;; *) autoadd_commit="true" ;; esac
|
||||
fi
|
||||
jq -n --argjson add "$add_json" --argjson ext "$absorbed_json" --argjson autoadd "$autoadd_commit" \
|
||||
'{version: '"$MANIFEST_VERSION"', dotenv: $add, options: {autoAdd: $autoadd}} | if ($ext | length) > 0 then .external = $ext else . end' \
|
||||
| _write_manifest_canonical "$manifest" || die "Failed to write $manifest"
|
||||
fi
|
||||
if [ "$write_adds" = true ]; then
|
||||
|
|
@ -1616,9 +1793,14 @@ cmd_pull() {
|
|||
continue
|
||||
fi
|
||||
case "$rel" in */*) mkdir -p "$target_dir/$(dirname "$rel")" ;; esac
|
||||
age -d -i "$KEY_FILE" -o "$target_dir/$rel" "$blob"
|
||||
# EGB-671 (DX-3): a wrong-but-structurally-valid key must NOT fail
|
||||
# silently. Die loudly on decrypt failure instead of leaving a partial.
|
||||
if ! age -d -i "$KEY_FILE" -o "$target_dir/$rel" "$blob"; then
|
||||
die "Failed to decrypt '$rel' with the current key ($KEY_FILE).
|
||||
Wrong key for this vault? Run 'secrets verify --all' to check the key."
|
||||
fi
|
||||
if [ ! -s "$target_dir/$rel" ]; then
|
||||
echo "WARNING: Decrypted file '$rel' is empty (possibly truncated .age blob)"
|
||||
echo "WARNING: Decrypted file '$rel' is empty (an empty source file, or a truncated .age blob)"
|
||||
fi
|
||||
count=$((count + 1))
|
||||
done <<< "$declared"
|
||||
|
|
@ -1642,10 +1824,14 @@ cmd_pull() {
|
|||
local name
|
||||
name=$(basename "$f" .age)
|
||||
local outfile="$target_dir/$name"
|
||||
age -d -i "$KEY_FILE" -o "$outfile" "$f"
|
||||
# EGB-671 (DX-3): die loudly on decrypt failure (wrong key) — never silent.
|
||||
if ! age -d -i "$KEY_FILE" -o "$outfile" "$f"; then
|
||||
die "Failed to decrypt '$name' with the current key ($KEY_FILE).
|
||||
Wrong key for this vault? Run 'secrets verify --all' to check the key."
|
||||
fi
|
||||
# Integrity check: verify non-empty
|
||||
if [ ! -s "$outfile" ]; then
|
||||
echo "WARNING: Decrypted file '$name' is empty (possibly truncated .age blob)"
|
||||
echo "WARNING: Decrypted file '$name' is empty (an empty source file, or a truncated .age blob)"
|
||||
fi
|
||||
count=$((count + 1))
|
||||
done
|
||||
|
|
@ -1674,9 +1860,13 @@ pull_project_to_dir() {
|
|||
local name
|
||||
name=$(basename "$f" .age)
|
||||
local outfile="$target_dir/$name"
|
||||
age -d -i "$KEY_FILE" -o "$outfile" "$f"
|
||||
# EGB-671 (DX-3): die loudly on decrypt failure (wrong key) — never silent.
|
||||
if ! age -d -i "$KEY_FILE" -o "$outfile" "$f"; then
|
||||
die "Failed to decrypt '$name' with the current key ($KEY_FILE).
|
||||
Wrong key for this vault? Run 'secrets verify --all' to check the key."
|
||||
fi
|
||||
if [ ! -s "$outfile" ]; then
|
||||
echo "WARNING: Decrypted file '$name' is empty (possibly truncated .age blob)"
|
||||
echo "WARNING: Decrypted file '$name' is empty (an empty source file, or a truncated .age blob)"
|
||||
fi
|
||||
count=$((count + 1))
|
||||
done
|
||||
|
|
@ -2523,6 +2713,10 @@ secrets — encrypted secret file sync between machines
|
|||
|
||||
Usage:
|
||||
secrets init Initialize the secrets repo and generate an age key
|
||||
secrets init --remote <url> Init, wire the remote, and push the initial store
|
||||
secrets join --remote <url> --key <path>
|
||||
Join an existing vault on a new machine: clone,
|
||||
install the key, and verify it decrypts the store
|
||||
secrets push [project] Encrypt secret files and push to the secrets repo
|
||||
secrets push --frozen Sync only manifest-declared files (skip auto-add)
|
||||
secrets push --dry-run Show what would be added/synced; change nothing
|
||||
|
|
@ -2679,7 +2873,8 @@ else
|
|||
fi
|
||||
|
||||
case "${1:-help}" in
|
||||
init) cmd_init ;;
|
||||
init) shift; cmd_init "$@" ;;
|
||||
join) shift; cmd_join "$@" ;;
|
||||
push)
|
||||
if [ "${2:-}" = "-w" ] || [ "${2:-}" = "--workspaces" ]; then
|
||||
cmd_push_workspaces
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue