7b041af68b
Ships in the repo (clone already done). Checks age + jq + git, then PRINTS the PATH line, onboarding next-steps, upgrade one-liner, and key-transfer hint. Never edits shell rc, never runs sudo (prints the command). Exits non-zero with an install hint when a dependency is missing.
113 lines
3.6 KiB
Bash
Executable file
113 lines
3.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
#
|
|
# secrets — thin onboarding bootstrap (EGB-671).
|
|
#
|
|
# This script ships INSIDE the repo: you already cloned the repo to get it, so
|
|
# its only jobs are (1) verify the dependencies the tool needs and (2) print the
|
|
# exact commands to finish setup. It deliberately does NOT:
|
|
# - edit your shell rc files (it prints the PATH line for you to paste)
|
|
# - invoke sudo or install packages behind your back (it prints the command)
|
|
# - re-implement any of the tool's security logic
|
|
#
|
|
# This is a security tool whose whole pitch is "verify, don't trust" — so the
|
|
# installer holds itself to a higher bar than convenience, not a lower one.
|
|
#
|
|
# Usage:
|
|
# ./install.sh # check deps, print setup + next steps
|
|
# ./install.sh --help
|
|
|
|
set -euo pipefail
|
|
|
|
# Resolve the directory this script lives in (the cloned tool repo). Uses bash
|
|
# builtins only so it works under a minimal PATH.
|
|
_src="${BASH_SOURCE[0]}"
|
|
TOOL_DIR="$(cd "${_src%/*}" 2>/dev/null && pwd)"
|
|
|
|
usage() {
|
|
cat <<EOF
|
|
install.sh — finish setting up the 'secrets' tool.
|
|
|
|
Run this once after cloning the repo. It verifies dependencies (age, jq, git)
|
|
and prints the commands to put 'secrets' on your PATH and onboard a machine.
|
|
|
|
Usage:
|
|
./install.sh Check dependencies and print setup + next steps
|
|
./install.sh --help Show this help
|
|
|
|
It never edits your shell config and never runs sudo — it prints the exact
|
|
commands so you stay in control (this is a secrets tool, after all).
|
|
|
|
Onboarding after setup:
|
|
First machine: secrets init --remote <your-private-repo-url>
|
|
Other machine: secrets join --remote <your-private-repo-url> --key <key.txt>
|
|
EOF
|
|
}
|
|
|
|
# Print the install command for a package, using whatever package manager is
|
|
# present. For sudo-requiring managers we PRINT the line for you to run — the
|
|
# installer never escalates on its own.
|
|
install_hint() {
|
|
local pkg="$1"
|
|
if command -v brew >/dev/null 2>&1; then
|
|
echo "brew install $pkg"
|
|
elif command -v apt-get >/dev/null 2>&1; then
|
|
echo "sudo apt-get install -y $pkg"
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
echo "sudo dnf install -y $pkg"
|
|
else
|
|
echo "install '$pkg' with your system package manager"
|
|
fi
|
|
}
|
|
|
|
case "${1:-}" in
|
|
--help|-h) usage; exit 0 ;;
|
|
"") ;;
|
|
*) echo "Unknown option: $1" >&2; usage >&2; exit 2 ;;
|
|
esac
|
|
|
|
echo "secrets — bootstrap check (tool dir: $TOOL_DIR)"
|
|
echo ""
|
|
|
|
# Dependency check. age + jq + git are all load-bearing on the cold-start path:
|
|
# jq became required once .secrets.json (manifest) is JSON, so it must be present
|
|
# BEFORE the first manifest read.
|
|
missing=0
|
|
for dep in git age jq; do
|
|
if command -v "$dep" >/dev/null 2>&1; then
|
|
echo " ok $dep"
|
|
else
|
|
echo " MISSING $dep — install it with:"
|
|
echo " $(install_hint "$dep")"
|
|
missing=1
|
|
fi
|
|
done
|
|
echo ""
|
|
|
|
if [ "$missing" -ne 0 ]; then
|
|
echo "Install the missing dependencies above, then re-run ./install.sh." >&2
|
|
exit 1
|
|
fi
|
|
|
|
cat <<EOF
|
|
All dependencies present. Two steps to finish:
|
|
|
|
1) Put 'secrets' on your PATH. Add this line to your shell config
|
|
(~/.zshrc or ~/.bashrc), then restart your terminal:
|
|
|
|
export PATH="$TOOL_DIR:\$PATH"
|
|
|
|
2) Onboard this machine:
|
|
|
|
First machine (new vault):
|
|
secrets init --remote <your-private-repo-url>
|
|
# then transfer key.txt to your other machines (AirDrop / scp / USB):
|
|
# scp <this-host>:$HOME/.secrets/key.txt ~/.secrets/key.txt
|
|
|
|
Other machine (join an existing vault):
|
|
secrets join --remote <your-private-repo-url> --key <path-to-key.txt>
|
|
# 'join' clones the vault, installs the key, and VERIFIES it decrypts
|
|
# before declaring success — a mis-copied key fails loudly, not silently.
|
|
|
|
To update the tool later:
|
|
git -C "$TOOL_DIR" pull
|
|
EOF
|