From 14af076627a25b52ca1761c13e9da824db1bcdae Mon Sep 17 00:00:00 2001 From: "rhatto@riseup.net" Date: Fri, 11 Apr 2014 13:38:34 -0300 Subject: Sketching coding standards --- development.mdwn | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/development.mdwn b/development.mdwn index 957a7f8..91ddc87 100644 --- a/development.mdwn +++ b/development.mdwn @@ -37,6 +37,13 @@ These steps should be run once in a while to ensure we have an up to date packag DIST=sid sudo cowbuilder --update +Coding standards +---------------- + + - Respect the existing coding style. + + - Be clear: easy audability must be one of keyringer's requirements. + Development workflow -------------------- -- cgit v1.2.3 From 3c06f7b7a2a8fa6577df7b224e334ca831562798 Mon Sep 17 00:00:00 2001 From: "rhatto@riseup.net" Date: Fri, 11 Apr 2014 15:45:04 -0300 Subject: Use 'encrypt' on edit action and new env variable KEYRINGER_ADD_EXTENSION --- ChangeLog | 7 ++++++- lib/keyringer/actions/edit | 3 ++- lib/keyringer/actions/encrypt | 4 +++- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 738a1f1..efc8dc8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,9 @@ -2014-04-10 - Silvio Rhatto +2014-04-11 - Silvio Rhatto + + Edit: use encrypt action + + Encrypt: support for KEYRINGER_ADD_EXTENSION environment variable + which controls if file extension should be appended to secret name Genpair: generate ssh and ssl keys with 4096 bits size diff --git a/lib/keyringer/actions/edit b/lib/keyringer/actions/edit index ff220a1..2267f37 100755 --- a/lib/keyringer/actions/edit +++ b/lib/keyringer/actions/edit @@ -43,7 +43,8 @@ read key $APP "$TMPWORK" # Encrypt again -$GPG --yes -o "$KEYDIR/$FILE" --use-agent --armor -e -s $(keyringer_recipients "$RECIPIENTS_FILE") "$TMPWORK" +export KEYRINGER_ADD_EXTENSION=false +keyringer_exec encrypt "$BASEDIR" "$FILE" "$TMPWORK" # Check exit status errcrypt="$?" diff --git a/lib/keyringer/actions/encrypt b/lib/keyringer/actions/encrypt index e9bf453..7415267 100755 --- a/lib/keyringer/actions/encrypt +++ b/lib/keyringer/actions/encrypt @@ -57,9 +57,11 @@ if [ ! -z "$3" ]; then # # Useful when opening files and the application needs the # extension to guess the file type. - if ! echo $BASEPATH | grep -q -e "\.$EXTENSION$"; then + if [ "$KEYRINGER_ADD_EXTENSION" != "false" ] && ! echo $BASEPATH | grep -q -e "\.$EXTENSION$"; then echo "Appending '$EXTENSION' into secret name..." FILE="$BASEPATH.$EXTENSION" + else + FILE="$BASEPATH" fi else FILE="$BASEPATH" -- cgit v1.2.3 From 05a0984a92401a8343fa7cf39247d571723b74da Mon Sep 17 00:00:00 2001 From: "rhatto@riseup.net" Date: Thu, 17 Apr 2014 17:17:57 -0300 Subject: Editor leakage warning (#50) --- share/man/keyringer.1.mdwn | 3 +++ 1 file changed, 3 insertions(+) diff --git a/share/man/keyringer.1.mdwn b/share/man/keyringer.1.mdwn index 3b2fbc0..407baaa 100644 --- a/share/man/keyringer.1.mdwn +++ b/share/man/keyringer.1.mdwn @@ -135,6 +135,9 @@ edit <*secret*> : Edit a secret by temporarily decrypting it, opening the decrypted copy into the text editor defined by the *$EDITOR* environment variable and then re-encrypting it. + Please make sure to use an *$EDITOR* which does not leak data like history buffers. + Keyringer tries to detect if *$EDITOR* is set to VIM and disables the *.viminfo* file. + encrypt <*secret*> [*file*] : Encrypts content from standard input or *file* into *secret* pathname. No spaces are supported in the *secret* name. If *file* is actually a folder, keyringer -- cgit v1.2.3 From 7aa135d606c036ab41d1671b484bb80c11b0442f Mon Sep 17 00:00:00 2001 From: "rhatto@riseup.net" Date: Thu, 17 Apr 2014 17:48:57 -0300 Subject: Edit/open: wait for background process to finish (#49) --- ChangeLog | 2 ++ lib/keyringer/actions/edit | 1 + 2 files changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index efc8dc8..742307c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,7 @@ 2014-04-11 - Silvio Rhatto + Edit/open: wait for background process to finish (#49) + Edit: use encrypt action Encrypt: support for KEYRINGER_ADD_EXTENSION environment variable diff --git a/lib/keyringer/actions/edit b/lib/keyringer/actions/edit index 2267f37..576bb67 100755 --- a/lib/keyringer/actions/edit +++ b/lib/keyringer/actions/edit @@ -41,6 +41,7 @@ echo "Press any key to open the decrypted data with $APP, Ctrl-C to abort" echo "WARNING: please make sure that $APP doesn't leak data to external applications os files" read key $APP "$TMPWORK" +wait # Encrypt again export KEYRINGER_ADD_EXTENSION=false -- cgit v1.2.3 From 4759a178831bf003e2c962928be11db30feb8795 Mon Sep 17 00:00:00 2001 From: "rhatto@riseup.net" Date: Thu, 17 Apr 2014 17:55:22 -0300 Subject: Rollback: use find+grep instead of 'find -iname' (#53) --- ChangeLog | 2 ++ lib/keyringer/actions/find | 2 +- lib/keyringer/functions | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 742307c..c068f9c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,7 @@ 2014-04-11 - Silvio Rhatto + Find: rollback: use find+grep instead of 'find -iname' (#53) + Edit/open: wait for background process to finish (#49) Edit: use encrypt action diff --git a/lib/keyringer/actions/find b/lib/keyringer/actions/find index 21afc7a..9b18d66 100755 --- a/lib/keyringer/actions/find +++ b/lib/keyringer/actions/find @@ -15,5 +15,5 @@ shift ARGS="`echo "$*" | sed -e "s|^/*||"`" # Run find command -cd "$KEYDIR/$RELATIVE_PATH" && find -iname "*$ARGS*" | sed -e 's|^./||g' +cd "$KEYDIR/$RELATIVE_PATH" && find | grep -i "$ARGS" | sed -e 's|^./||g' cd "$CWD" diff --git a/lib/keyringer/functions b/lib/keyringer/functions index ad18f44..59777d0 100755 --- a/lib/keyringer/functions +++ b/lib/keyringer/functions @@ -436,7 +436,7 @@ function keyringer_get_file { elif [ ! -f "$KEYDIR/$FILE" ]; then # Try to find a similar file count=0 - candidates=(`keyringer_exec find "$BASEDIR" "$1*.asc"`) + candidates=(`keyringer_exec find "$BASEDIR" | grep -i "$1" | grep -e '.asc$'`) if [ ! -z "$candidates" ]; then echo "Could not find exact match for \"$1\", please choose one of the following secrets:" -- cgit v1.2.3 From 4c5157f9ffbae18f3914b5fb58c07e8d895f1732 Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Fri, 16 May 2014 15:28:01 -0300 Subject: Use 'nobackup' and 'nowritebackup' if VIM is set as $EDITOR (#50) --- ChangeLog | 4 +++- lib/keyringer/functions | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index c068f9c..029a546 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,6 @@ -2014-04-11 - Silvio Rhatto +2014-05-16 - Silvio Rhatto + + Use 'nobackup' and 'nowritebackup' if VIM is set as $EDITOR (#50) Find: rollback: use find+grep instead of 'find -iname' (#53) diff --git a/lib/keyringer/functions b/lib/keyringer/functions index 59777d0..50d01db 100755 --- a/lib/keyringer/functions +++ b/lib/keyringer/functions @@ -287,7 +287,7 @@ function keyringer_set_env { # Avoid viminfo, see https://keyringer.pw/trac/ticket/50 if $EDITOR --help | grep -q -e "^VIM"; then if ! echo $EDITOR | grep -q -- "-i NONE"; then - EDITOR="$EDITOR -i NONE" + EDITOR="$EDITOR -i NONE '+set nowritebackup' '+set nobackup'" fi fi -- cgit v1.2.3 From 845e593c84661f05576f96da9e384a671ca56e53 Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Fri, 16 May 2014 15:37:55 -0300 Subject: Workaround for open/edit action returning instantaneously (#49) --- ChangeLog | 2 ++ lib/keyringer/actions/edit | 14 +++++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 029a546..e4e7ede 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,7 @@ 2014-05-16 - Silvio Rhatto + Workaround for open/edit action returning instantaneously (#49) + Use 'nobackup' and 'nowritebackup' if VIM is set as $EDITOR (#50) Find: rollback: use find+grep instead of 'find -iname' (#53) diff --git a/lib/keyringer/actions/edit b/lib/keyringer/actions/edit index 576bb67..63017d5 100755 --- a/lib/keyringer/actions/edit +++ b/lib/keyringer/actions/edit @@ -38,11 +38,23 @@ fi # Prompt echo "Press any key to open the decrypted data with $APP, Ctrl-C to abort" -echo "WARNING: please make sure that $APP doesn't leak data to external applications os files" +echo "WARNING: please make sure that $APP doesn't leak data to external applications or files" read key $APP "$TMPWORK" + +# Wait for background process to finish wait +# Workaround for some applications running in client/server mode, handling open file requests +# to a daemon and exiting immediatelly, making keyringer guess the editing is over and the file +# must be encrypted again (See #49). +# +# Thus, we cannot just wipe the file and exit keyringer, as the user might have a buffered copy +# of the unencrypted file in the application, which can lead to information leakage if the user +# saves the file and leaves the editor. +echo "Press any key when done using the file and you're sure that $APP is closed." +read -n 1 + # Encrypt again export KEYRINGER_ADD_EXTENSION=false keyringer_exec encrypt "$BASEDIR" "$FILE" "$TMPWORK" -- cgit v1.2.3 From e32a1a5bc4d7331e129df173260fc754ff20c0da Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Fri, 16 May 2014 15:48:04 -0300 Subject: Minor UI enhancements at open/edit actions --- lib/keyringer/actions/edit | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/keyringer/actions/edit b/lib/keyringer/actions/edit index 63017d5..3ccf977 100755 --- a/lib/keyringer/actions/edit +++ b/lib/keyringer/actions/edit @@ -39,7 +39,8 @@ fi # Prompt echo "Press any key to open the decrypted data with $APP, Ctrl-C to abort" echo "WARNING: please make sure that $APP doesn't leak data to external applications or files" -read key +echo "Press ENTER to continue" +read -s key $APP "$TMPWORK" # Wait for background process to finish @@ -53,7 +54,7 @@ wait # of the unencrypted file in the application, which can lead to information leakage if the user # saves the file and leaves the editor. echo "Press any key when done using the file and you're sure that $APP is closed." -read -n 1 +read -s -n 1 # Encrypt again export KEYRINGER_ADD_EXTENSION=false -- cgit v1.2.3 From 79a87b0e7536299ba49b559e8bcdd0c96291f413 Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Fri, 16 May 2014 16:43:04 -0300 Subject: Release workflow with git-flow --- development.mdwn | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/development.mdwn b/development.mdwn index 91ddc87..67c6456 100644 --- a/development.mdwn +++ b/development.mdwn @@ -52,9 +52,10 @@ We use [git-flow](https://github.com/nvie/gitflow) for the development workflow. Release workflow ---------------- -Go to master branch +Go to develop branch and start a new release - git checkout master + git checkout develop + git flow release start VERSION Prepare the source code: @@ -64,6 +65,8 @@ Prepare the source code: Create and upload a new release: + git flow release finish $VERSION + git checkout master make release Update the debian branch: -- cgit v1.2.3 From 4edea3d52e0c04651508fba9bae6ed0d81ccaa01 Mon Sep 17 00:00:00 2001 From: Silvio Rhatto Date: Fri, 16 May 2014 16:46:47 -0300 Subject: Keyringer 0.3.4 --- ChangeLog | 2 +- keyringer | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index e4e7ede..aa63787 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -2014-05-16 - Silvio Rhatto +2014-05-16 - 0.3.4 - Silvio Rhatto Workaround for open/edit action returning instantaneously (#49) diff --git a/keyringer b/keyringer index 6a1eda5..e1f405f 100755 --- a/keyringer +++ b/keyringer @@ -138,7 +138,7 @@ function keyringer_dispatch { # Config NAME="keyringer" -KEYRINGER_VERSION="0.3.3" +KEYRINGER_VERSION="0.3.4" CONFIG_VERSION="0.1" CONFIG_BASE="$HOME/.$NAME" CONFIG="$CONFIG_BASE/config" -- cgit v1.2.3