summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ChangeLog6
-rw-r--r--[l---------]README.md6
-rw-r--r--index.md53
-rwxr-xr-xkeyringer4
-rwxr-xr-xlib/keyringer/actions/encrypt2
-rwxr-xr-xlib/keyringer/actions/xclip11
-rw-r--r--share/man/keyringer.1319
7 files changed, 187 insertions, 214 deletions
diff --git a/ChangeLog b/ChangeLog
index 0ce5aa6..7b6fae2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2022-06-07 - 0.5.7 - Silvio Rhatto <rhatto@riseup.net>
+
+ New upstream URLs
+
+ Fix BASEPATH evaluation when encrypting a folder
+
2021-07-03 - 0.5.6 - Silvio Rhatto <rhatto@riseup.net>
Fix Debian bug #990255: keyringer incorrectly tries to use vim settings from
diff --git a/README.md b/README.md
index dd0ea36..2b11b60 120000..100644
--- a/README.md
+++ b/README.md
@@ -1 +1,5 @@
-index.md \ No newline at end of file
+# Keyringer
+
+A secret sharing software.
+
+Se [docs](index.md) for details.
diff --git a/index.md b/index.md
index 8984ac1..645acdb 100644
--- a/index.md
+++ b/index.md
@@ -3,14 +3,17 @@
Keyringer lets you manage and share secrets using GnuPG and Git with custom
commands to encrypt, decrypt, recrypt, create key pairs, etc.
-- Project page: [https://keyringer.pw](https://keyringer.pw)
-- Manpage: [keyringer.1](share/man/keyringer.1)
-- License: [GPLv3+](LICENSE)
-- Current issue tracker: [see tasks](/tasks).
-- Archived issue tracker: [https://keyringer.pw/trac](https://keyringer.pw/trac)
-- Tor hidden service: [http://4qt45wbulqipigwa.onion](http://4qt45wbulqipigwa.onion)
-- Releases: [https://keyringer.pw/releases](releases)
-- Contact: rhatto at riseup.net
+* Project page: [https://keyringer.fluxo.info](https://keyringer.fluxo.info)
+* Repository and issue tracker: [https://0xacab.org/rhatto/keyringer](https://0xacab.org/rhatto/keyringer)
+* Repository mirror: [https://git.fluxo.info/keyringer](https://git.fluxo.info/keyringer)
+* Archived issue trackers:
+ * [Built-in Taskwarrior database](/tasks).
+ * [Trac](https://keyringer.fluxo.info/trac)
+* Manpage: [keyringer.1](share/man/keyringer.1)
+* License: [GPLv3+](LICENSE)
+* Tor Onion Service: [http://fpwwehb7ngvmxwl5ahtubh5gs5i4olmrubx73zlnzheubhjweik5irid.onion](http://fpwwehb7ngvmxwl5ahtubh5gs5i4olmrubx73zlnzheubhjweik5irid.onion)
+* Releases: [https://keyringer.fluxo.info/releases](releases)
+* Contact: rhatto at riseup.net
Index
-----
@@ -22,7 +25,7 @@ Installation
Just clone
- git clone https://git.fluxo.info/keyringer
+ git clone https://0xacab.org/rhatto/keyringer.git
You can also verify the latest commit's OpenPGP signature:
@@ -224,8 +227,8 @@ Keyringer's basic concepts are as follows:
one encrypted file that contains one line for each secret, e.g. a single file called
secrets with lines such as:
- emma : root : secret1
- emma - /dev/hda : : secret2
+ emma : root : secret1
+ emma - /dev/hda : : secret2
Or you may also have a different encrypted file for each secret, e.g. a file called
`emma.root` that contains the root passphrase for the server named `emma` and
@@ -257,24 +260,36 @@ and its the only VCS known to make easier repository history manipulation.
Limitations
-----------
- - See the [manpage](share/man/keyringer.1) for details.
+See the [manpage](share/man/keyringer.1) for details.
- - Check [this page](https://wiki.koumbit.net/PasswordManagementService/SoftwareComparison)
- a comparison on different password management tools.
+Alternatives
+------------
+
+There are many alternatives do collaborative secret management. Here are some:
+
+* [Pass: The Standard Unix Password Manager](https://www.passwordstore.org/)
+* [SOPS: Secret OPerationS: Simple and flexible tool for managing secrets](https://github.com/mozilla/sops)
+
+Also check
+
+* [This page](https://wiki.koumbit.net/PasswordManagementService/SoftwareComparison)
+ a comparison on different password management tools.
+* [This issue](https://gitlab.torproject.org/tpo/tpa/team/-/issues/29677) for an
+ additional discussion.
Requirements
------------
Keyringer needs:
- - [Bash](http://tiswww.case.edu/php/chet/bash/bashtop.html)
- - [Git](http://git-scm.com)
- - [GNU Privacy Guard](http://gnupg.org)
- - Grep, awk, tail, cut, sed and other GNU tools
+* [Bash](http://tiswww.case.edu/php/chet/bash/bashtop.html)
+* [Git](http://git-scm.com)
+* [GNU Privacy Guard](http://gnupg.org)
+* Grep, awk, tail, cut, sed and other GNU tools
Optional dependencies if you want to manage ssl keys:
- - [OpenSSL](http://www.openssl.org)
+* [OpenSSL](http://www.openssl.org)
Development guidelines
----------------------
diff --git a/keyringer b/keyringer
index 8c1faf2..f28c8f3 100755
--- a/keyringer
+++ b/keyringer
@@ -81,7 +81,7 @@ function keyringer_init {
touch "$OPTIONS"
# Setup README
- echo "Keyring repository powered by https://keyringer.pw" > "$BASEDIR/README"
+ echo "Keyring repository powered by https://keyringer.fluxo.info" > "$BASEDIR/README"
echo "" >> "$BASEDIR/README"
# Set config version
@@ -140,7 +140,7 @@ function keyringer_dispatch {
# Config
NAME="keyringer"
-KEYRINGER_VERSION="0.5.6"
+KEYRINGER_VERSION="0.5.7"
CONFIG_VERSION="0.1"
CONFIG_BASE="$HOME/.$NAME"
CONFIG="$CONFIG_BASE/config"
diff --git a/lib/keyringer/actions/encrypt b/lib/keyringer/actions/encrypt
index 1256374..f762f29 100755
--- a/lib/keyringer/actions/encrypt
+++ b/lib/keyringer/actions/encrypt
@@ -93,7 +93,7 @@ fi
# Encrypt
if [ "$UNENCRYPTED_FILE" != "-" ] && [ -d "$UNENCRYPTED_FILE" ]; then
# Time to go recursive
- BASEPATH="`basename $FILE .asc`"
+ BASEPATH="`echo $FILE | sed -e 's/.asc$//'`"
FILEPATH="`dirname "$UNENCRYPTED_FILE"`"
if [ "$FILEPATH" == "." ]; then
diff --git a/lib/keyringer/actions/xclip b/lib/keyringer/actions/xclip
index da86315..f63fdb5 100755
--- a/lib/keyringer/actions/xclip
+++ b/lib/keyringer/actions/xclip
@@ -4,8 +4,11 @@
#
# Copy contents to clipboard.
+#
# Function thanks to Password Store by Jason A. Donenfeld <Jason@zx2c4.com>
# distributed under GPLv2+: http://www.zx2c4.com/projects/password-store/
+#
+# Adapted by rhatto
clip() {
# This base64 business is a disgusting hack to deal with newline inconsistancies
# in shell. There must be a better way to deal with this, but because I'm a dolt,
@@ -14,7 +17,15 @@ clip() {
#local xclip="xclip -selection clipboard"
local xclip="xclip"
before="$($xclip -o | base64)"
+
+ # Avoid "Error: target STRING not available"
+ # https://github.com/astrand/xclip/issues/38
+ echo "$RANDOM" | $xclip
+
+ # Copy text into clipboard
echo -n "$1" | $xclip
+
+ # Cleanup procedure
(
sleep 45
now="$($xclip -o | base64)"
diff --git a/share/man/keyringer.1 b/share/man/keyringer.1
index def8c38..9e60ae0 100644
--- a/share/man/keyringer.1
+++ b/share/man/keyringer.1
@@ -1,20 +1,21 @@
-.\" Automatically generated by Pandoc 2.2.1
+.\" Automatically generated by Pandoc 2.9.2.1
.\"
.TH "KEYRINGER" "1" "Oct 25, 2013" "Keyringer User Manual" ""
.hy
.SH NAME
.PP
-keyringer \- encrypted and distributed secret sharing software
+keyringer - encrypted and distributed secret sharing software
.SH SYNOPSIS
.PP
-keyringer <\f[I]keyring\f[]> <\f[I]action\f[]> [\f[I]options\f[]]\&...
+keyringer <\f[I]keyring\f[R]> <\f[I]action\f[R]>
+[\f[I]options\f[R]]\&...
.SH DESCRIPTION
.PP
Keyringer lets you manage and share secrets using GnuPG and Git in a
distributed fashion.
.PP
-It has custom commands to create key\-pairs and to encrypt, decrypt and
-re\-encrypt secrets.
+It has custom commands to create key-pairs and to encrypt, decrypt and
+re-encrypt secrets.
It also supports encryption to multiple recipients and groups of
recipients, to allow a workgroup to share access to a single repository
while restricting some secrets to subsets of the group.
@@ -34,70 +35,54 @@ and other read/write operations on secrets.
Configuration actions, handling repository metadata.
.SH REPOSITORY LOOKUP AND MANIPULATION ACTIONS
.TP
-.B find <\f[I]expression\f[]>
+find <\f[I]expression\f[R]>
Find secrets in the repository.
-.RS
-.RE
.TP
-.B init <\f[I]path\f[]> [\f[I]remote\f[]]
+init <\f[I]path\f[R]> [\f[I]remote\f[R]]
Initialize a new keyringer repository.
-If a \f[I]remote\f[] URL is specified, keyringer will clone an existing
+If a \f[I]remote\f[R] URL is specified, keyringer will clone an existing
repository.
.RS
.PP
-After initialization, \f[I]path\f[] will contain a folder structure for
+After initialization, \f[I]path\f[R] will contain a folder structure for
storing secrets and metadata (user aka recipients, groups of recipients,
etc).
.PP
-Also, an entry will be added to \f[C]$HOME/.keyringer/config\f[]
+Also, an entry will be added to \f[C]$HOME/.keyringer/config\f[R]
allowing keyringer to find the keyring by its alias.
.RE
.TP
-.B destroy
-Alias for \f[I]teardown\f[] action.
-.RS
-.RE
+destroy
+Alias for \f[I]teardown\f[R] action.
.TP
-.B git <\f[I]action\f[]> <\f[I]options\f[]>
+git <\f[I]action\f[R]> <\f[I]options\f[R]>
Git wrapper that operates from the toplevel keyring repository.
-You can issue any \f[I]GIT(1)\f[] subcommand with this action to have it
-applied in the keyring repository.
-.RS
-.RE
+You can issue any \f[I]GIT(1)\f[R] subcommand with this action to have
+it applied in the keyring repository.
.TP
-.B commit [\f[I]arguments\f[]]
+commit [\f[I]arguments\f[R]]
Alias to \[lq]git commit\[rq].
-.RS
-.RE
.TP
-.B ls <\f[I]path\f[]>
-List contents from the toplevel repository \f[I]keys\f[] folder or from
-relative paths if \f[I]path\f[] is specified.
-Like the git wrapper, this is a wrapper around the \f[I]LS(1)\f[]
+ls <\f[I]path\f[R]>
+List contents from the toplevel repository \f[I]keys\f[R] folder or from
+relative paths if \f[I]path\f[R] is specified.
+Like the git wrapper, this is a wrapper around the \f[I]LS(1)\f[R]
command.
-.RS
-.RE
.TP
-.B mkdir <\f[I]path\f[]>
-Create a directory inside the repository \f[I]keys\f[] folder.
-.RS
-.RE
+mkdir <\f[I]path\f[R]>
+Create a directory inside the repository \f[I]keys\f[R] folder.
.TP
-.B rmdir <\f[I]path\f[]>
-Remove an empty folder inside the repository \f[I]keys\f[] folder.
-.RS
-.RE
+rmdir <\f[I]path\f[R]>
+Remove an empty folder inside the repository \f[I]keys\f[R] folder.
.TP
-.B tree <\f[I]path\f[]>
-List contents from the toplevel repository \f[I]keys\f[] folder or from
-relative paths if \f[I]path\f[] is specified using a tree\-like format.
-Like the ls wrapper, this is a wrapper around the \f[I]TREE(1)\f[]
+tree <\f[I]path\f[R]>
+List contents from the toplevel repository \f[I]keys\f[R] folder or from
+relative paths if \f[I]path\f[R] is specified using a tree-like format.
+Like the ls wrapper, this is a wrapper around the \f[I]TREE(1)\f[R]
command.
-.RS
-.RE
.TP
-.B shell
-Run keyringer on interactive mode from a built\-in command\-line prompt
+shell
+Run keyringer on interactive mode from a built-in command-line prompt
where all other actions can be called and are operated from the current
selected keyring.
.RS
@@ -105,28 +90,24 @@ selected keyring.
An additional \[lq]cd\[rq] internal command is available for directory
navigation.
.PP
-All <\f[I]secret\f[]> parameters from actions invoked from the shell are
-called relatively from the current selected directory.
+All <\f[I]secret\f[R]> parameters from actions invoked from the shell
+are called relatively from the current selected directory.
.RE
.TP
-.B teardown
+teardown
Remove permanently a local copy of a repository, very dangerous if you
have just a single copy.
-.RS
-.RE
.TP
-.B check
+check
Run maintenance checks in a keyring.
-.RS
-.RE
.SH SECRET MANIPULATION ACTIONS
.PP
-All secret manipulation actions operate upon a \f[I]secret\f[] which is
+All secret manipulation actions operate upon a \f[I]secret\f[R] which is
the pathname of an encrypted file relative to the keyring with optional
-\f[C]\&.asc\f[] extension.
+\f[C].asc\f[R] extension.
.PP
-If the \f[C]\&.asc\f[] extension is omitted, keyringer will add it at
-the end of the pathname.
+If the \f[C].asc\f[R] extension is omitted, keyringer will add it at the
+end of the pathname.
.PP
No spaces are allowed in the secret name.
.PP
@@ -135,93 +116,71 @@ repository.
Instead, the user has to manually commit the changes using the git
wrapper action.
.TP
-.B append <\f[I]secret\f[]>
+append <\f[I]secret\f[R]>
Append contents into a secret by decrypting the secret, appending lines
read from the standard input and encrypting again.
-.RS
-.RE
.TP
-.B append\-batch <\f[I]secret\f[]>
+append-batch <\f[I]secret\f[R]>
Append contents into a secret, batch mode.
-.RS
-.RE
.TP
-.B decrypt <\f[I]secret\f[]>
+decrypt <\f[I]secret\f[R]>
Decrypts a secret into standard output.
-.RS
-.RE
.TP
-.B del <\f[I]secret\f[]>
+del <\f[I]secret\f[R]>
Removes a secret using Git.
After deleting a secret a git commit and push is still needed to update
remote repositories.
.RS
.PP
Please note that this command \f[B]does not remove the secret from the
-Git history.\f[] To completely remove a file from a keyring, you should
+Git history.\f[R] To completely remove a file from a keyring, you should
also rewrite the Git history yourself.
.RE
.TP
-.B delete <\f[I]secret\f[]>
-Alias for \f[I]del\f[] action.
-.RS
-.RE
+delete <\f[I]secret\f[R]>
+Alias for \f[I]del\f[R] action.
.TP
-.B rm <\f[I]secret\f[]>
-Alias for \f[I]del\f[] action.
-.RS
-.RE
+rm <\f[I]secret\f[R]>
+Alias for \f[I]del\f[R] action.
.TP
-.B cp <\f[I]secret\f[]> <\f[I]dest\f[]>
+cp <\f[I]secret\f[R]> <\f[I]dest\f[R]>
Copy a secret.
-.RS
-.RE
.TP
-.B mv <\f[I]secret\f[]> <\f[I]dest\f[]>
+mv <\f[I]secret\f[R]> <\f[I]dest\f[R]>
Rename a secret.
-.RS
-.RE
.TP
-.B edit <\f[I]secret\f[]>
+edit <\f[I]secret\f[R]>
Edit a secret by temporarily decrypting it, opening the decrypted copy
-into the text editor defined by the \f[I]$EDITOR\f[] environment
-variable and then re\-encrypting it.
+into the text editor defined by the \f[I]$EDITOR\f[R] environment
+variable and then re-encrypting it.
.RS
.PP
Please make sure to use an
-\f[I]\f[]E\f[I]\f[]D\f[I]\f[]I\f[I]\f[]T\f[I]\f[]O\f[I]\f[]R\f[I] * \f[]w\f[I]\f[]h\f[I]\f[]i\f[I]\f[]c\f[I]\f[]h\f[I]\f[]d\f[I]\f[]o\f[I]\f[]e\f[I]\f[]s\f[I]\f[]n\f[I]\f[]o\f[I]\f[]t\f[I]\f[]l\f[I]\f[]e\f[I]\f[]a\f[I]\f[]k\f[I]\f[]d\f[I]\f[]a\f[I]\f[]t\f[I]\f[]a\f[I]\f[]l\f[I]\f[]i\f[I]\f[]k\f[I]\f[]e\f[I]\f[]h\f[I]\f[]i\f[I]\f[]s\f[I]\f[]t\f[I]\f[]o\f[I]\f[]r\f[I]\f[]y\f[I]\f[]b\f[I]\f[]u\f[I]\f[]f\f[I]\f[]f\f[I]\f[]e\f[I]\f[]r\f[I]\f[]s\f[I].\f[]K\f[I]\f[]e\f[I]\f[]y\f[I]\f[]r\f[I]\f[]i\f[I]\f[]n\f[I]\f[]g\f[I]\f[]e\f[I]\f[]r\f[I]\f[]t\f[I]\f[]r\f[I]\f[]i\f[I]\f[]e\f[I]\f[]s\f[I]\f[]t\f[I]\f[]o\f[I]\f[]d\f[I]\f[]e\f[I]\f[]t\f[I]\f[]e\f[I]\f[]c\f[I]\f[]t\f[I]\f[]i\f[I]\f[]f\f[I]*EDITOR\f[]
-is set to VIM and disables the \f[I].viminfo\f[] file.
+\f[I]\f[R]E\f[I]\f[R]D\f[I]\f[R]I\f[I]\f[R]T\f[I]\f[R]O\f[I]\f[R]R\f[I]\[u2005]*\[u2005]\f[R]w\f[I]\f[R]h\f[I]\f[R]i\f[I]\f[R]c\f[I]\f[R]h\f[I]\f[R]d\f[I]\f[R]o\f[I]\f[R]e\f[I]\f[R]s\f[I]\f[R]n\f[I]\f[R]o\f[I]\f[R]t\f[I]\f[R]l\f[I]\f[R]e\f[I]\f[R]a\f[I]\f[R]k\f[I]\f[R]d\f[I]\f[R]a\f[I]\f[R]t\f[I]\f[R]a\f[I]\f[R]l\f[I]\f[R]i\f[I]\f[R]k\f[I]\f[R]e\f[I]\f[R]h\f[I]\f[R]i\f[I]\f[R]s\f[I]\f[R]t\f[I]\f[R]o\f[I]\f[R]r\f[I]\f[R]y\f[I]\f[R]b\f[I]\f[R]u\f[I]\f[R]f\f[I]\f[R]f\f[I]\f[R]e\f[I]\f[R]r\f[I]\f[R]s\f[I].\f[R]K\f[I]\f[R]e\f[I]\f[R]y\f[I]\f[R]r\f[I]\f[R]i\f[I]\f[R]n\f[I]\f[R]g\f[I]\f[R]e\f[I]\f[R]r\f[I]\f[R]t\f[I]\f[R]r\f[I]\f[R]i\f[I]\f[R]e\f[I]\f[R]s\f[I]\f[R]t\f[I]\f[R]o\f[I]\f[R]d\f[I]\f[R]e\f[I]\f[R]t\f[I]\f[R]e\f[I]\f[R]c\f[I]\f[R]t\f[I]\f[R]i\f[I]\f[R]f\f[I]*EDITOR\f[R]
+is set to VIM and disables the \f[I].viminfo\f[R] file.
.RE
.TP
-.B encrypt <\f[I]secret\f[]> [\f[I]file\f[]]
-Encrypts content from standard input or \f[I]file\f[] into
-\f[I]secret\f[] pathname.
-No spaces are supported in the \f[I]secret\f[] name.
-If \f[I]file\f[] is actually a folder, keyringer will recursivelly
-encrypt all it's contents.
-.RS
-.RE
+encrypt <\f[I]secret\f[R]> [\f[I]file\f[R]]
+Encrypts content from standard input or \f[I]file\f[R] into
+\f[I]secret\f[R] pathname.
+No spaces are supported in the \f[I]secret\f[R] name.
+If \f[I]file\f[R] is actually a folder, keyringer will recursivelly
+encrypt all it\[cq]s contents.
.TP
-.B encrypt\-batch <\f[I]secret\f[]> [\f[I]file\f[]]
+encrypt-batch <\f[I]secret\f[R]> [\f[I]file\f[R]]
Encrypt content, batch mode.
-Behavior is identical to \f[I]encrypt\f[] action, but less verbose.
+Behavior is identical to \f[I]encrypt\f[R] action, but less verbose.
Useful inside scripts.
-.RS
-.RE
.TP
-.B genkeys <\f[I]ssh\f[]|\f[I]gpg\f[]|\f[I]x509\f[]|\f[I]x509\-self\f[]|\f[I]ssl\f[]|\f[I]ssl\-self\f[]> [\f[I]options\f[]]
-Wrapper to generate encryption key\-pairs, useful for automated key
+genkeys <\f[I]ssh\f[R]|\f[I]gpg\f[R]|\f[I]x509\f[R]|\f[I]x509-self\f[R]|\f[I]ssl\f[R]|\f[I]ssl-self\f[R]> [\f[I]options\f[R]]
+Wrapper to generate encryption key-pairs, useful for automated key
deployment.
-.RS
-.RE
.TP
-.B genpair <\f[I]ssh\f[]|\f[I]gpg\f[]|\f[I]x509\f[]|\f[I]x509\-self\f[]|\f[I]ssl\f[]|\f[I]ssl\-self\f[]> [\f[I]options\f[]]
-Alias for \f[I]genkeys\f[] action.
-.RS
-.RE
+genpair <\f[I]ssh\f[R]|\f[I]gpg\f[R]|\f[I]x509\f[R]|\f[I]x509-self\f[R]|\f[I]ssl\f[R]|\f[I]ssl-self\f[R]> [\f[I]options\f[R]]
+Alias for \f[I]genkeys\f[R] action.
.TP
-.B open <\f[I]secret\f[]>
-Decrypt a secret into a temporary folder and open it using xdg\-open,
+open <\f[I]secret\f[R]>
+Decrypt a secret into a temporary folder and open it using xdg-open,
which tries to figure out the file type and then calls the associated
application.
.RS
@@ -230,8 +189,8 @@ After the application exits, keyringer encrypts the temporary decrypted
file again into the secret file and deletes the temporary file.
.RE
.TP
-.B pwgen <\f[I]secret\f[]> [\f[I]size\f[]]
-Generates a random passphrase and stores into \f[I]secret\f[] pathname
+pwgen <\f[I]secret\f[R]> [\f[I]size\f[R]]
+Generates a random passphrase and stores into \f[I]secret\f[R] pathname
with optional entropy size in bytes.
Default size is 20.
.RS
@@ -244,26 +203,20 @@ Combined with clip or sclip action provides an hygienic way to handle
secrets.
.RE
.TP
-.B recrypt <\f[I]secret\f[]>
-Re\-encrypts a secret by decrypting it and encrypting it again.
+recrypt <\f[I]secret\f[R]>
+Re-encrypts a secret by decrypting it and encrypting it again.
Useful when users are added into the recipient configuration.
-If no \f[I]secret\f[] is given, all secrets in the repository are
-re\-encrypted.
-.RS
-.RE
+If no \f[I]secret\f[R] is given, all secrets in the repository are
+re-encrypted.
.TP
-.B clip <\f[I]secret\f[]>
+clip <\f[I]secret\f[R]>
Copy the first line of a secret to the clipboard, following
-password\-store convention.
-.RS
-.RE
+password-store convention.
.TP
-.B xclip <\f[I]secret\f[]>
+xclip <\f[I]secret\f[R]>
Alias to clip action.
-.RS
-.RE
.TP
-.B sclip <\f[I]secret\f[]>
+sclip <\f[I]secret\f[R]>
Same as clip action, but sleeps five seconds, overwrite clipboard and
exit.
If xdotool is available, it also switches to the next window using the
@@ -271,52 +224,44 @@ alt+Tab shortcut.
This action is useful to be invoked by a custom key combo in a window
manager so it becomes easy to provide keyringer managed passphrases to
other applications such as a web browser.
-.RS
-.RE
.SH CONFIGURATION ACTIONS
.TP
-.B commands
+commands
List available actions, useful for shell completion and syntax check.
-.RS
-.RE
.TP
-.B options <\f[I]ls\f[]|\f[I]edit\f[]|\f[I]add\f[]>
-List, edit or add miscellaneous \f[I]repository\f[] options.
+options <\f[I]ls\f[R]|\f[I]edit\f[R]|\f[I]add\f[R]>
+List, edit or add miscellaneous \f[I]repository\f[R] options.
.RS
.PP
Repository options are settings which are saved in the repository as a
-\f[I]global\f[] configuration stanza for a given keyring, shared by all
+\f[I]global\f[R] configuration stanza for a given keyring, shared by all
users with access to the repository.
.PP
-Options are written using the \f[I]KEY=VALUE\f[] syntax.
+Options are written using the \f[I]KEY=VALUE\f[R] syntax.
All lines starting with the hash (#) character are interpreted as
comments.
.RE
.TP
-.B preferences <\f[I]ls\f[]|\f[I]edit\f[]|\f[I]add\f[]>
-List, edit or add \f[I]user\f[] preferences for a given repository.
+preferences <\f[I]ls\f[R]|\f[I]edit\f[R]|\f[I]add\f[R]>
+List, edit or add \f[I]user\f[R] preferences for a given repository.
.RS
.PP
-User preferences are settings which are saved in the user's keyringer
-folder (\f[C]$HOME/.keyringer/\f[]), and not shared with the other
-users.
+User preferences are settings which are saved in the user\[cq]s
+keyringer folder (\f[C]$HOME/.keyringer/\f[R]), and not shared with the
+other users.
.PP
-Preferences are written using the \f[I]KEY=VALUE\f[] syntax.
+Preferences are written using the \f[I]KEY=VALUE\f[R] syntax.
All lines starting with the hash (#) character are interpreted as
comments.
.RE
.TP
-.B usage
+usage
Show keyringer usage information.
-.RS
-.RE
.TP
-.B help
+help
Alias for usage action.
-.RS
-.RE
.TP
-.B recipients <\f[I]ls\f[]|\f[I]edit\f[]> <\f[I]recipients\-file\f[]>
+recipients <\f[I]ls\f[R]|\f[I]edit\f[R]> <\f[I]recipients-file\f[R]>
List, create or edit recipients configuration.
.RS
.PP
@@ -325,59 +270,51 @@ used by keyringer when encrypting secrets and associated with email
aliases.
.PP
Keyringer uses a default recipients file, but specifying a custom
-\f[I]recipients\-file\f[] pathname will override this default.
+\f[I]recipients-file\f[R] pathname will override this default.
.PP
For instance, if a user encrypts a secret to a file in the keyring
-repository's \f[I]accounting\f[] folder, a \f[I]recipients\-file\f[]
-under \f[I]accounting\f[] will be used.
-Encrypting a secret into \f[I]accounting/bank\-accounts\f[] will result
-in a file \f[C]$KEYRING_FOLDER/keys/accounting/bank\-accounts.asc\f[]
+repository\[cq]s \f[I]accounting\f[R] folder, a
+\f[I]recipients-file\f[R] under \f[I]accounting\f[R] will be used.
+Encrypting a secret into \f[I]accounting/bank-accounts\f[R] will result
+in a file \f[C]$KEYRING_FOLDER/keys/accounting/bank-accounts.asc\f[R]
encrypted using the public keys listed in the config
-file\f[C]$KEYRING_FOLDER/config/recipients/accounting\f[].
+file\f[C]$KEYRING_FOLDER/config/recipients/accounting\f[R].
.PP
-Each line in a recipients file has entries in the format `john\@doe.com
-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', where \f[I]john\@doe.com\f[]
-is an alias for the OpenPGP public key whose fingerprint is
-\f[I]XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.\f[]
+Each line in a recipients file has entries in the format
+`john\[at]doe.com XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', where
+\f[I]john\[at]doe.com\f[R] is an alias for the OpenPGP public key whose
+fingerprint is \f[I]XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.\f[R]
.PP
All lines starting with the hash (#) character are interpreted as
comments.
.PP
-Parameters to the \f[I]recipients\f[] action are:
+Parameters to the \f[I]recipients\f[R] action are:
.TP
-.B \f[I]ls\f[]
+\f[I]ls\f[R]
List all existing recipients files.
-.RS
-.RE
.TP
-.B \f[I]edit\f[]
+\f[I]edit\f[R]
Create or edit a recipients file.
.RS
.PP
-Editing happens using the editor specified by the \f[C]$EDITOR\f[]
+Editing happens using the editor specified by the \f[C]$EDITOR\f[R]
environment variable.
.PP
-The required parameter \f[I]recipients\-file\f[] is interpreted relative
-to the \f[C]$KEYRING_FOLDER/config/recipients/\f[] folder.
+The required parameter \f[I]recipients-file\f[R] is interpreted relative
+to the \f[C]$KEYRING_FOLDER/config/recipients/\f[R] folder.
.RE
.RE
.SH FILES
.TP
-.B $HOME/.keyringer/config
-User's main configuration file used to map alias names to keyrings.
-.RS
-.RE
+$HOME/.keyringer/config
+User\[cq]s main configuration file used to map alias names to keyrings.
.TP
-.B $HOME/.keyringer/\f[I]keyring\f[]
-User preferences for the keyringer aliased \f[I]keyring\f[] keyring.
-.RS
-.RE
+$HOME/.keyringer/\f[I]keyring\f[R]
+User preferences for the keyringer aliased \f[I]keyring\f[R] keyring.
.TP
-.B $KEYRING_FOLDER/config/options
+$KEYRING_FOLDER/config/options
Custom keyring options which will be applied for all users that use the
keyringer repository.
-.RS
-.RE
.SH LIMITATIONS
.PP
Keyringer currently has the following limitations:
@@ -386,28 +323,28 @@ Metadata is not encrypted, meaning that an attacker with access to a
keyringer repository can discover all public key IDs used for
encryption, and which secrets are encrypted to which keys.
This can be improved in the future by encrypting the repository
-configuration with support for the \f[I]\[en]hidden\-recipient\f[] GnuPG
+configuration with support for the \f[I]\[en]hidden-recipient\f[R] GnuPG
option and encrypted repository options.
.RS 4
.PP
-To mitigate that, it's possible to keep the repo just atop of an
-encrypted and non\-public place.
+To mitigate that, it\[cq]s possible to keep the repo just atop of an
+encrypted and non-public place.
.RE
.IP "2." 3
History is not rewritten by default when secrets are removed from a
keyringer repository.
-After a secret is removed with the \f[I]del\f[] action, it will still be
-available in the repository history even after a commit.
+After a secret is removed with the \f[I]del\f[R] action, it will still
+be available in the repository history even after a commit.
This is by design for the following reasons:
.IP \[bu] 2
-It's the default behavior of the Git content tracker.
+It\[cq]s the default behavior of the Git content tracker.
Forcing the deletion by default could break the expected behavior and
-hence limit the repository's backup features, which can be helpful if
-someone mistakenly overwrites a secret.
+hence limit the repository\[cq]s backup features, which can be helpful
+if someone mistakenly overwrites a secret.
.IP \[bu] 2
History rewriting cannot be considered a security measure against the
-unauthorized access to a secret as it doesn't automatically update all
-working copies of the repository.
+unauthorized access to a secret as it doesn\[cq]t automatically update
+all working copies of the repository.
.RS 2
.PP
In the case that the secret is a passphrase, the recommended measure
@@ -415,7 +352,7 @@ against such attacks is to change the passphrase, making useless the
knowledge of the previous secret.
.PP
Users wishing to edit their repository history should proceed manually
-using the \f[I]git\f[] action.
+using the \f[I]git\f[R] action.
.RE
.IP "3." 3
Keyringer does not protect data which were not encrypted to a keyring,
@@ -427,12 +364,12 @@ Pay special attention that keyringer outputs data to stdout, which could
be easily spotted by any agent looking directly at you computer screen.
.PP
The xclip action even copies secret data to the X11 clipboard, which can
-be accessed by any application running in the user's X11 session, so use
-this feature carefully.
+be accessed by any application running in the user\[cq]s X11 session, so
+use this feature carefully.
.RE
.SH SEE ALSO
.PP
-The \f[I]README\f[] file distributed with Keyringer contains full
+The \f[I]README\f[R] file distributed with Keyringer contains full
documentation.
.PP
The Keyringer source code and all documentation may be downloaded from
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-10 19:41:15 +0000