From 72f6db37961e30117818c1d030a7c69869928028 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Fri, 18 Oct 2013 17:03:40 -0300
Subject: FHS compliance (closes #18)

---
 lib/keyringer/actions/append        |  41 +++++++
 lib/keyringer/actions/append-batch  |   1 +
 lib/keyringer/actions/commands      |  10 ++
 lib/keyringer/actions/decrypt       |  17 +++
 lib/keyringer/actions/del           |  16 +++
 lib/keyringer/actions/edit          |  45 ++++++++
 lib/keyringer/actions/encrypt       |  56 +++++++++
 lib/keyringer/actions/encrypt-batch |   1 +
 lib/keyringer/actions/genpair       | 222 ++++++++++++++++++++++++++++++++++++
 lib/keyringer/actions/git           |  16 +++
 lib/keyringer/actions/ls            |  16 +++
 lib/keyringer/actions/open          |   1 +
 lib/keyringer/actions/options       |  30 +++++
 lib/keyringer/actions/preferences   |  37 ++++++
 lib/keyringer/actions/recipients    |  46 ++++++++
 lib/keyringer/actions/recrypt       |  45 ++++++++
 lib/keyringer/actions/usage         |  10 ++
 17 files changed, 610 insertions(+)
 create mode 100755 lib/keyringer/actions/append
 create mode 120000 lib/keyringer/actions/append-batch
 create mode 100755 lib/keyringer/actions/commands
 create mode 100755 lib/keyringer/actions/decrypt
 create mode 100755 lib/keyringer/actions/del
 create mode 100755 lib/keyringer/actions/edit
 create mode 100755 lib/keyringer/actions/encrypt
 create mode 120000 lib/keyringer/actions/encrypt-batch
 create mode 100755 lib/keyringer/actions/genpair
 create mode 100755 lib/keyringer/actions/git
 create mode 100755 lib/keyringer/actions/ls
 create mode 120000 lib/keyringer/actions/open
 create mode 100755 lib/keyringer/actions/options
 create mode 100755 lib/keyringer/actions/preferences
 create mode 100755 lib/keyringer/actions/recipients
 create mode 100755 lib/keyringer/actions/recrypt
 create mode 100755 lib/keyringer/actions/usage

(limited to 'lib')

diff --git a/lib/keyringer/actions/append b/lib/keyringer/actions/append
new file mode 100755
index 0000000..30c2d5b
--- /dev/null
+++ b/lib/keyringer/actions/append
@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# Append information into encrypted files.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Get file
+keyringer_get_file "$2"
+
+OLDIFS="$IFS"
+IFS=$'\n'
+
+CONTENT=($(keyringer_exec decrypt "$BASEDIR" "$FILE"))
+
+if [ "$BASENAME" == "append" ]; then
+  # only display directions if we're running append, not append-batch
+  printf "\n%s currently has %d lines\n\n" "$FILE" "${#CONTENT[@]}"
+  printf "Now please write the content to be appended on %s, finnishing with Ctrl-D:\n" "$FILE"
+fi
+
+# FIXME: dkg doesn't know how to check that this does proper escaping
+# (2010-11-16)
+
+APPEND=($(cat -))
+
+NEW=( ${CONTENT[@]} ${APPEND[@]} )
+
+for element in $(seq 0 $((${#NEW[@]} - 1))); do
+  echo ${NEW[$element]}
+done | keyringer_exec encrypt-batch $BASEDIR $FILE
+
+err="$?"
+
+if [ "$err" != "0" ]; then
+  exit "$err"
+fi
+
+IFS="$OLDIFS"
diff --git a/lib/keyringer/actions/append-batch b/lib/keyringer/actions/append-batch
new file mode 120000
index 0000000..6b140f7
--- /dev/null
+++ b/lib/keyringer/actions/append-batch
@@ -0,0 +1 @@
+append
\ No newline at end of file
diff --git a/lib/keyringer/actions/commands b/lib/keyringer/actions/commands
new file mode 100755
index 0000000..2605666
--- /dev/null
+++ b/lib/keyringer/actions/commands
@@ -0,0 +1,10 @@
+#!/bin/bash
+#
+# Show available commands
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+keyringer_show_actions
diff --git a/lib/keyringer/actions/decrypt b/lib/keyringer/actions/decrypt
new file mode 100755
index 0000000..2b1401c
--- /dev/null
+++ b/lib/keyringer/actions/decrypt
@@ -0,0 +1,17 @@
+#!/bin/bash
+#
+# Decrypt files.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Get file
+keyringer_get_file "$2"
+
+# Decrypt
+$GPG --quiet --use-agent -d "$KEYDIR/$FILE"
+
+# Exit
+exit "$?"
diff --git a/lib/keyringer/actions/del b/lib/keyringer/actions/del
new file mode 100755
index 0000000..babd212
--- /dev/null
+++ b/lib/keyringer/actions/del
@@ -0,0 +1,16 @@
+#!/bin/bash
+#
+# Remove files.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Get file
+keyringer_get_file "$2"
+
+# Remove
+if [ -d "$BASEDIR/.git" ]; then
+  keyringer_exec git "$BASEDIR" rm "keys/$FILE"
+fi
diff --git a/lib/keyringer/actions/edit b/lib/keyringer/actions/edit
new file mode 100755
index 0000000..54d0fec
--- /dev/null
+++ b/lib/keyringer/actions/edit
@@ -0,0 +1,45 @@
+#!/bin/bash
+#
+# Edit keys.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Get file
+keyringer_get_file "$2"
+
+# Set recipients file
+keyringer_set_recipients "$FILE"
+
+# Warn user
+echo "Make sure that $BASEDIR is atop of an encrypted volume."
+
+# Set a tmp file
+keyringer_set_tmpfile edit
+
+# Decrypt the information to the file
+$GPG --yes -o "$TMPWORK" --use-agent -d "$KEYDIR/$FILE"
+
+if [ "$BASENAME" == "edit" ]; then
+  APP="$EDITOR"
+elif [ "$BASENAME" == "open" ]; then
+  if which xdg-open &> /dev/null; then
+    APP="xdg-open"
+  else
+    echo "You should have xdg-open application to perform this action, aborting."
+    exit 1
+  fi
+fi
+
+# Prompt
+echo "Press any key to open the decrypted data with $APP, Ctrl-C to abort"
+read key
+$APP "$TMPWORK"
+
+# Encrypt again
+$GPG --yes -o "$KEYDIR/$FILE" --use-agent --armor -e -s $(keyringer_recipients "$RECIPIENTS_FILE") "$TMPWORK"
+
+# Remove temp file
+keyringer_unset_tmpfile "$TMPWORK"
diff --git a/lib/keyringer/actions/encrypt b/lib/keyringer/actions/encrypt
new file mode 100755
index 0000000..cc73b55
--- /dev/null
+++ b/lib/keyringer/actions/encrypt
@@ -0,0 +1,56 @@
+#!/bin/bash
+#
+# Encrypt files to multiple recipients.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Aditional parameters
+if [ ! -z "$3" ]; then
+  UNENCRYPTED_FILE="$2"
+  shift 2
+  keyringer_get_new_file "$*"
+
+  if [ ! -f "$UNENCRYPTED_FILE" ]; then
+    echo "Error: cannot encrypted $UNENCRYPTED_FILE: file not found."
+    exit 1
+  fi
+else
+  UNENCRYPTED_FILE="-"
+  shift
+  keyringer_get_new_file $*
+fi
+
+# Set recipients file
+keyringer_set_recipients "$FILE"
+
+# Encrypt
+mkdir -p "$KEYDIR/`dirname $FILE`"
+
+if [ "$BASENAME" == "encrypt" ]; then
+  # Only display directions if we're running encrypt, not encrypt-batch
+  if [ "$UNENCRYPTED_FILE" == "-" ]; then
+    echo "Type your message and finish your input with EOF (Ctrl-D)."
+  fi
+fi
+
+$GPG --use-agent --armor -e -s $(keyringer_recipients "$RECIPIENTS_FILE") --yes --output "$KEYDIR/$FILE" $UNENCRYPTED_FILE
+
+err="$?"
+
+if [ "$err" != "0" ]; then
+  exit "$err"
+fi
+
+if [ "$UNENCRYPTED_FILE" != "-" ]; then
+  echo "Now make to wipe the non-encrypted $UNENCRYPTED_FILE."
+fi
+
+# Stage
+if [ -d "$BASEDIR/.git" ]; then
+  keyringer_exec git "$BASEDIR" add "keys/$FILE"
+fi
+
+exit "$?"
diff --git a/lib/keyringer/actions/encrypt-batch b/lib/keyringer/actions/encrypt-batch
new file mode 120000
index 0000000..8267197
--- /dev/null
+++ b/lib/keyringer/actions/encrypt-batch
@@ -0,0 +1 @@
+encrypt
\ No newline at end of file
diff --git a/lib/keyringer/actions/genpair b/lib/keyringer/actions/genpair
new file mode 100755
index 0000000..f048bc7
--- /dev/null
+++ b/lib/keyringer/actions/genpair
@@ -0,0 +1,222 @@
+#!/bin/bash
+#
+# Generate keypairs.
+#
+# This script is just a wrapper to easily generate keys for
+# automated systems.
+# 
+
+# Generate a keypair, ssh version
+function genpair_ssh {
+  echo "Make sure that $KEYDIR is atop of an encrypted volume."
+  read -p "Hit ENTER to continue." prompt
+
+  # We're using empty passphrases
+  ssh-keygen -t rsa -P '' -f "$TMPWORK/id_rsa" -C "root@$NODE"
+
+  # Encrypt the result
+  echo "Encrypting secret key into keyringer..."
+  cat "$TMPWORK/id_rsa"     | keyringer_exec encrypt "$BASEDIR" "$FILE"
+  echo "Encrypting public key into keyringer..."
+  cat "$TMPWORK/id_rsa.pub" | keyringer_exec encrypt "$BASEDIR" "$FILE.pub"
+
+  if [ ! -z "$OUTFILE" ]; then
+    mkdir -p `dirname $OUTFILE`
+    printf "Saving copies at %s and %s.pub\n" "$OUTFILE" "$OUTFILE"
+    cat "$TMPWORK/id_rsa"     > "$OUTFILE"
+    cat "$TMPWORK/id_rsa.pub" > "$OUTFILE.pub"
+  fi
+
+  echo "Done"  
+}
+
+# Generate a keypair, gpg version
+function genpair_gpg {
+  echo "Make sure that $KEYDIR is atop of an encrypted volume."
+
+  passphrase="no"
+  passphrase_confirm="confirm"
+
+  while [ "$passphrase" != "$passphrase_confirm" ]; do
+    read -s -p "Enter password for the private key: " passphrase
+    printf "\n"
+    read -s -p "Enter password again: " passphrase_confirm
+    printf "\n"
+
+    if [ "$passphrase" != "$passphrase_confirm" ]; then
+      echo "Password don't match."
+    fi
+  done
+  
+  # TODO: insert random bytes
+  # TODO: custom Name-Comment and Name-Email
+  # TODO: allow for empty passphrases
+  $GPG --homedir "$TMPWORK" --gen-key --batch <<EOF
+    Key-Type: RSA
+    Key-Length: 4096
+    Subkey-Type: ELG-E
+    Subkey-Length: 4096
+    Name-Real: $NODE
+    Name-Email: root@$NODE
+    Expire-Date: 0
+    Passphrase: $passphrase
+    %commit
+EOF
+
+  # Encrypt the result
+  echo "Encrypting secret key into keyringer..."
+  $GPG --armor --homedir "$TMPWORK" --export-secret-keys | keyringer_exec encrypt "$BASEDIR" "$FILE"
+  echo "Encrypting public key into keyringer..."
+  $GPG --armor --homedir "$TMPWORK" --export             | keyringer_exec encrypt "$BASEDIR" "$FILE.pub"
+  echo "Encrypting passphrase into keyringer..."
+  echo "Passphrase for $FILE: $passphrase"               | keyringer_exec encrypt "$BASEDIR" "$FILE.passwd"
+
+  if [ ! -z "$OUTFILE" ]; then
+    mkdir -p `dirname $OUTFILE`
+    printf "Saving copies at %s and %s.pub\n" "$OUTFILE" "$OUTFILE"
+    $GPG --armor --homedir "$TMPWORK" --export-secret-keys > "$OUTFILE"
+    $GPG --armor --homedir "$TMPWORK" --export             > "$OUTFILE.pub"
+  fi
+
+  echo "Done"  
+}
+
+# Generate a keypair, ssl version
+function genpair_ssl {
+  echo "Make sure that $KEYDIR is atop of an encrypted volume."
+  read -p "Hit ENTER to continue." prompt
+
+  # Check for wildcard certs
+  if [ "`echo $NODE | cut -d . -f 1`" == "*" ]; then
+    WILDCARD="yes"
+    CNAME="$NODE"
+    NODE="`echo $NODE | sed -e 's/^\*\.//'`"
+  else
+    CNAME="${NODE}"
+  fi
+
+  # Setup
+  cd "$TMPWORK"
+
+  # Generate certificate
+cat <<EOF >> openssl.conf
+[ req ]
+default_keyfile         = ${NODE}_privatekey.pem
+distinguished_name      = req_distinguished_name
+encrypt_key             = no
+req_extensions          = v3_req # Extensions to add to certificate request
+string_mask             = nombstr
+
+[ req_distinguished_name ]
+commonName_default              = ${CNAME}
+organizationName                = Organization Name
+organizationalUnitName          = Organizational Unit Name
+emailAddress                    = Email Address
+localityName                    = Locality
+stateOrProvinceName             = State
+countryName                     = Country Name
+commonName                      = Common Name
+
+[ v3_req ]
+extendedKeyUsage=serverAuth,clientAuth
+EOF
+
+  # Add SubjectAltNames so wildcard certs can work correctly.
+  if [ "$WILDCARD" == "yes" ]; then
+cat <<EOF >> openssl.conf
+subjectAltName=DNS:${NODE}, DNS:${CNAME}
+EOF
+  fi
+
+  echo "Please review your OpenSSL configuration:"
+  cat openssl.conf
+  read -p "Hit ENTER to continue." prompt
+
+  openssl req -batch -nodes -config openssl.conf -newkey rsa:2048 -sha256 \
+          -keyout ${NODE}_privatekey.pem -out ${NODE}_csr.pem
+
+  openssl req -noout -text -in ${NODE}_csr.pem
+
+  # Self-sign
+  if [ "$KEYTYPE" == "ssl-self" ]; then
+    openssl x509 -in "${NODE}_csr.pem" -out "$NODE.crt" -req -signkey "${NODE}_privatekey.pem" -days 365
+    chmod 600 "${NODE}_privatekey.pem"
+  fi
+
+  # Encrypt the result
+  echo "Encrypting private key into keyringer..."
+  cat "${NODE}_privatekey.pem" | keyringer_exec encrypt "$BASEDIR" "$FILE.pem"
+  echo "Encrypting certificate request into keyringer..."
+  cat "${NODE}_csr.pem"        | keyringer_exec encrypt "$BASEDIR" "$FILE.csr"
+  
+  if [ "$KEYTYPE" == "ssl-self" ]; then
+    echo "Encrypting certificate into keyringer..."
+    cat "${NODE}.crt" | keyringer_exec encrypt "$BASEDIR" "$FILE.crt"
+  elif [ -f "$BASEDIR/keys/$FILE.crt.asc" ]; then
+    # Remove any existing crt
+    keyringer_exec del "$BASEDIR" "$FILE.crt"
+  fi
+
+  cd "$CWD"
+
+  if [ ! -z "$OUTFILE" ]; then
+    mkdir -p `dirname $OUTFILE`
+    printf "Saving copies at %s\n" "`dirname $OUTFILE`"
+    cat "$TMPWORK/${NODE}_privatekey.pem" > "$OUTFILE.pem"
+    cat "$TMPWORK/${NODE}_csr.pem"        > "$OUTFILE.csr"
+
+    if [ -f "$TMPWORK/${NODE}.crt" ]; then
+      cat "$TMPWORK/${NODE}.crt" > "$OUTFILE.crt"
+    fi
+  fi
+
+  # Show cert fingerprint
+  if [ "$KEYTYPE" == "ssl-self" ]; then
+    openssl x509 -noout -in "$TMPWORK/${NODE}.crt" -fingerprint
+  fi
+
+  echo "Done"
+}
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Aditional parameters
+KEYTYPE="$2"
+FILE="$3"
+NODE="$4"
+OUTFILE="$5"
+CWD="`pwd`"
+
+# Verify
+if [ -z "$NODE" ]; then
+  echo -e "Usage: keyringer <keyring> $BASENAME <gpg|ssh|ssl|ssl-self> <file> <hostname> [outfile]"
+  echo -e "Options:"
+  echo -e "\t gpg|ssh|ssl[-self]: key type."
+  echo -e "\t file                      : base file name for encrypted output (relative to keys folder),"
+  echo -e "\t                             without spaces"
+  echo -e "\t hostname                  : host for the key pair"
+  echo -e "\t outfile                   : optional unencrypted output file, useful for deployment,"
+  echo -e "\t                             without spaces"
+  exit 1
+elif [ ! -e "$KEYDIR" ]; then
+  echo "Folder not found: $KEYDIR, leaving"
+  exit 1
+fi
+
+# Set a tmp file
+keyringer_set_tmpfile genpair -d
+
+# Dispatch
+echo "Generating $KEYTYPE key for $NODE..."
+if [ "$KEYTYPE" == "ssl-self" ]; then
+  genpair_ssl
+else
+  genpair_"$KEYTYPE"
+fi
+
+# Cleanup
+cd "$CWD"
+rm -rf "$TMPWORK"
+trap - EXIT
diff --git a/lib/keyringer/actions/git b/lib/keyringer/actions/git
new file mode 100755
index 0000000..3c4f435
--- /dev/null
+++ b/lib/keyringer/actions/git
@@ -0,0 +1,16 @@
+#!/bin/bash
+#
+# Git wrapper.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Aditional parameters
+CWD="`pwd`"
+
+# Run git command
+shift
+mkdir -p "$BASEDIR" && cd "$BASEDIR" && git $*
+cd "$CWD"
diff --git a/lib/keyringer/actions/ls b/lib/keyringer/actions/ls
new file mode 100755
index 0000000..ec8080b
--- /dev/null
+++ b/lib/keyringer/actions/ls
@@ -0,0 +1,16 @@
+#!/bin/bash
+#
+# List keys.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Aditional parameters
+CWD="`pwd`"
+
+# Run list command
+shift
+cd "$KEYDIR" && ls $*
+cd "$CWD"
diff --git a/lib/keyringer/actions/open b/lib/keyringer/actions/open
new file mode 120000
index 0000000..8491ab9
--- /dev/null
+++ b/lib/keyringer/actions/open
@@ -0,0 +1 @@
+edit
\ No newline at end of file
diff --git a/lib/keyringer/actions/options b/lib/keyringer/actions/options
new file mode 100755
index 0000000..8508aea
--- /dev/null
+++ b/lib/keyringer/actions/options
@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# Recipient management.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Command parser
+keyringer_get_command "$2"
+
+# Create options file if old repository
+if [ ! -e "$OPTIONS" ]; then
+  echo "Creating options file..."
+  touch "$OPTIONS"
+  keyringer_exec git "$BASEDIR" add config/options
+fi
+
+if [ "$COMMAND" == "ls" ]; then
+  cat "$OPTIONS"
+elif [ "$COMMAND" == "edit" ]; then
+  "$EDITOR" "$OPTIONS"
+elif [ "$COMMAND" == "add" ]; then
+  shift 2
+  echo $* >> "$OPTIONS"
+else
+  printf "%s: No such command %s\n"  "$BASENAME" "$COMMAND"
+  exit 1
+fi
diff --git a/lib/keyringer/actions/preferences b/lib/keyringer/actions/preferences
new file mode 100755
index 0000000..e82848d
--- /dev/null
+++ b/lib/keyringer/actions/preferences
@@ -0,0 +1,37 @@
+#!/bin/bash
+#
+# Manipulate preferences.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+COMMAND="$2"
+
+if [ -z "$COMMAND" ]; then
+  echo "Usage: keyringer <keyring> preferences <command> [arguments]"
+  echo "Available commands:"
+  echo "	ls"
+  echo "	edit"
+  echo "	add"
+  exit 1
+fi
+
+# Create options file if old repository
+if [ ! -e "$PREFERENCES" ]; then
+  echo "Creating preferences file..."
+  touch "$PREFERENCES"
+fi
+
+if [ "$COMMAND" == "ls" ]; then
+  cat "$PREFERENCES"
+elif [ "$COMMAND" == "edit" ]; then
+  "$EDITOR" "$PREFERENCES"
+elif [ "$COMMAND" == "add" ]; then
+  shift 2
+  [[ -n $* ]] && echo $* >> "$PREFERENCES"
+else
+  printf "%s: No such command %s\n" "$BASENAME" "$COMMAND"
+  exit 1
+fi
diff --git a/lib/keyringer/actions/recipients b/lib/keyringer/actions/recipients
new file mode 100755
index 0000000..7093a6b
--- /dev/null
+++ b/lib/keyringer/actions/recipients
@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+# Recipient management.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+# Command parser
+keyringer_get_command "$2"
+
+# Set recipients file
+keyringer_set_new_recipients "$3"
+
+if [ "$COMMAND" == "ls" ]; then
+  if [ ! -z "$3" ]; then
+    if [ -e "$RECIPIENTS_FILE" ]; then
+      cat "$RECIPIENTS_FILE"
+    else
+      echo "Recipients file not found: $RECIPIENTS_FILE_BASE"
+      exit 1
+    fi
+  else
+    for recipients in `ls $RECIPIENTS`; do
+      echo "In recipients file $recipients:"
+      echo "-----------------------------------------------------------------------------------"
+      cat $RECIPIENTS/$recipients
+      echo ""
+    done
+  fi
+elif [ "$COMMAND" == "edit" ]; then
+  if [ ! -z "$3" ]; then
+    keyringer_create_new_recipients $RECIPIENTS_FILE
+    $EDITOR "$RECIPIENTS_FILE"
+    keyringer_check_recipients
+    keyringer_exec git "$BASEDIR" add "$RECIPIENTS_FILE_BASE"
+  else
+    echo "Please specify one recipient to edit among the available:"
+    ls $RECIPIENTS | sed -e 's/^/\t/'
+    exit 1
+  fi
+else
+  printf "%s: No such command %s\n" "$BASENAME" "$COMMAND"
+  exit 1
+fi
diff --git a/lib/keyringer/actions/recrypt b/lib/keyringer/actions/recrypt
new file mode 100755
index 0000000..014fef7
--- /dev/null
+++ b/lib/keyringer/actions/recrypt
@@ -0,0 +1,45 @@
+#!/bin/bash
+#
+# Re-encrypt files to multiple recipients.
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+function keyringer_recrypt {
+  # Get file
+  keyringer_get_file "$1"
+
+  # Set recipients file
+  keyringer_set_recipients "$FILE"
+
+  # Decrypt
+  decrypted="$($GPG --use-agent -d "$KEYDIR/$FILE" 2> /dev/null)"
+
+  if [ "$?" != "0" ]; then
+    echo "Decryption error."
+    exit 1
+  fi
+
+  # Recrypt
+  recrypted="`echo "$decrypted" | $GPG --use-agent --armor -e -s $(keyringer_recipients "$RECIPIENTS_FILE")`"
+
+  if [ "$?" != "0" ]; then
+    echo "Recryption error."
+    exit 1
+  fi
+
+  unset decrypted
+  echo "$recrypted" > "$KEYDIR/$FILE"
+}
+
+if [ ! -z "$2" ]; then
+  keyringer_recrypt $2
+else
+  cd $KEYDIR && find | while read file; do
+    if [ ! -d "$KEYDIR/$file" ]; then
+      keyringer_recrypt "$file"
+    fi
+  done
+fi
diff --git a/lib/keyringer/actions/usage b/lib/keyringer/actions/usage
new file mode 100755
index 0000000..f4ac0fa
--- /dev/null
+++ b/lib/keyringer/actions/usage
@@ -0,0 +1,10 @@
+#!/bin/bash
+#
+# Show available commands
+#
+
+# Load functions
+LIB="`dirname $0`/../functions"
+source "$LIB" || exit 1
+
+keyringer_usage
-- 
cgit v1.2.3


From 42e81a0d15be5c62913c51f16986c5ea8fc92c70 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 24 Oct 2013 21:15:16 -0200
Subject: FIXME moved to #26

---
 lib/keyringer/actions/append | 3 ---
 1 file changed, 3 deletions(-)

(limited to 'lib')

diff --git a/lib/keyringer/actions/append b/lib/keyringer/actions/append
index 30c2d5b..e945bff 100755
--- a/lib/keyringer/actions/append
+++ b/lib/keyringer/actions/append
@@ -21,9 +21,6 @@ if [ "$BASENAME" == "append" ]; then
   printf "Now please write the content to be appended on %s, finnishing with Ctrl-D:\n" "$FILE"
 fi
 
-# FIXME: dkg doesn't know how to check that this does proper escaping
-# (2010-11-16)
-
 APPEND=($(cat -))
 
 NEW=( ${CONTENT[@]} ${APPEND[@]} )
-- 
cgit v1.2.3


From 3a03d2a8e068fc38b1d87134b86c4f62abfcf65b Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 24 Oct 2013 21:30:18 -0200
Subject: Minor fix

---
 lib/keyringer/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index 66a23df..0864b91 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -504,7 +504,7 @@ function keyringer_set_new_recipients {
 function keyringer_create_new_recipients {
   if [ ! -e "$1" ]; then
     mkdir -p "`dirname $1`"
-    echo "# Use entries in the form of 'john@doe.com XXXXXXXX" > "$1"
+    echo "# Use entries in the form of 'john@doe.com XXXXXXXX'" > "$1"
     echo "" >> "$1"
   fi
 }
-- 
cgit v1.2.3


From da7b0d3a12c254463f90845566437211682fd647 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 7 Nov 2013 17:44:37 -0200
Subject: Allow slashes on filenames

---
 lib/keyringer/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index 0864b91..e2face1 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -348,7 +348,7 @@ function keyringer_get_new_file {
   fi
 
   # Sanitize and complete file name
-  FILE="`echo $FILE | sed -e s/[^A-Za-z0-9.]/_/g`"
+  FILE="`echo $FILE | sed -e s/[^A-Za-z0-9.\/]/_/g`"
   FILE="$(keyringer_filename "$FILE")"
   
   if [ -z "$FILE" ]; then
-- 
cgit v1.2.3


From ee1beb85b4dc8f7f0da9689c88706aeb516e954d Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Sun, 10 Nov 2013 20:18:12 -0200
Subject: Usage and setup cosmetics

---
 keyringer               | 2 +-
 lib/keyringer/functions | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

(limited to 'lib')

diff --git a/keyringer b/keyringer
index abd0a57..8ba1093 100755
--- a/keyringer
+++ b/keyringer
@@ -68,7 +68,7 @@ function keyringer_init {
       touch "$OPTIONS"
 
       # Setup README
-      echo "Keyring repository powered by http://git.sarava.org/?p=keyringer.git;a=summary" > "$BASEDIR/README"
+      echo "Keyring repository powered by https://keyringer.pw" > "$BASEDIR/README"
       echo "" >> "$BASEDIR/README"
 
       # Set config version
diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index e2face1..206e0da 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -390,9 +390,10 @@ function keyringer_show_actions {
 
 # Usage
 function keyringer_usage {
-  printf "Usage: %s <keyring> <action> [arguments]\n" "$BASENAME"
-  printf "Available commands: \n"
+  printf "Usage: %s <keyring> <action> [arguments]\n\n" "$BASENAME"
+  printf "Available commands: \n\n"
   keyringer_show_actions | sed -e 's/^/\t/'
+  printf "\tinit <path> [remote]\n\n" $BASENAME
 }
 
 # Check recipients
-- 
cgit v1.2.3


From d6ace9471fbeb4c6c57f803d870accd8b11c7d2f Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Sun, 10 Nov 2013 20:38:46 -0200
Subject: Fixing encryption for files with spaces (closes #20)

---
 lib/keyringer/actions/encrypt | 10 +++++-----
 lib/keyringer/functions       |  8 ++++++--
 2 files changed, 11 insertions(+), 7 deletions(-)

(limited to 'lib')

diff --git a/lib/keyringer/actions/encrypt b/lib/keyringer/actions/encrypt
index cc73b55..6b9c061 100755
--- a/lib/keyringer/actions/encrypt
+++ b/lib/keyringer/actions/encrypt
@@ -9,12 +9,12 @@ source "$LIB" || exit 1
 
 # Aditional parameters
 if [ ! -z "$3" ]; then
-  UNENCRYPTED_FILE="$2"
-  shift 2
-  keyringer_get_new_file "$*"
+  shift 1
+  UNENCRYPTED_FILE="$*"
+  keyringer_get_new_file $*
 
   if [ ! -f "$UNENCRYPTED_FILE" ]; then
-    echo "Error: cannot encrypted $UNENCRYPTED_FILE: file not found."
+    echo "Error: cannot encrypt $UNENCRYPTED_FILE: file not found."
     exit 1
   fi
 else
@@ -36,7 +36,7 @@ if [ "$BASENAME" == "encrypt" ]; then
   fi
 fi
 
-$GPG --use-agent --armor -e -s $(keyringer_recipients "$RECIPIENTS_FILE") --yes --output "$KEYDIR/$FILE" $UNENCRYPTED_FILE
+$GPG --use-agent --armor -e -s $(keyringer_recipients "$RECIPIENTS_FILE") --yes --output "$KEYDIR/$FILE" "$UNENCRYPTED_FILE"
 
 err="$?"
 
diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index 206e0da..67b5122 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -342,7 +342,6 @@ function keyringer_get_new_file {
   # File must not contain spaces
   if [ ! -z "$2" ] ; then
     FILE="`echo "$*" | sed -e 's/ /_/g'`"
-    echo "File $* has spaces, secret will be named as $FILE..."
   else
     FILE="$1"
   fi
@@ -350,8 +349,13 @@ function keyringer_get_new_file {
   # Sanitize and complete file name
   FILE="`echo $FILE | sed -e s/[^A-Za-z0-9.\/]/_/g`"
   FILE="$(keyringer_filename "$FILE")"
+
+  # Warn user about file name change:w
+  if [ "`basename "$*"`" != "$FILE" ]; then
+    echo "Sanitizing destination filename to `basename $FILE`"
+  fi
   
-  if [ -z "$FILE" ]; then
+  if [ -z "$*" ]; then
     keyringer_action_usage
     exit 1
   fi
-- 
cgit v1.2.3


From e53aba05b0a18c39b5f75267318694d2073248f2 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Sun, 10 Nov 2013 22:44:58 -0200
Subject: Changing encrypt syntax, rebuilding manpage

---
 lib/keyringer/actions/encrypt |  22 +++++-
 lib/keyringer/functions       |  14 ++--
 share/man/keyringer.1         | 166 +++++++++++++++++++++---------------------
 share/man/keyringer.1.mdwn    |   4 +-
 4 files changed, 111 insertions(+), 95 deletions(-)

(limited to 'lib')

diff --git a/lib/keyringer/actions/encrypt b/lib/keyringer/actions/encrypt
index 6b9c061..d9d8f96 100755
--- a/lib/keyringer/actions/encrypt
+++ b/lib/keyringer/actions/encrypt
@@ -7,11 +7,27 @@
 LIB="`dirname $0`/../functions"
 source "$LIB" || exit 1
 
+# Usage
+function keyringer_usage_encrypt {
+  echo "Usage: keyringer <keyring> $BASENAME <secret> [file]"
+}
+
+# Alias for keyringer_usage_encrypt
+function keyringer_usage_encrypt_batch {
+  keyringer_usage_encrypt $*
+}
+
+# Usage
+if [ -z "$2" ]; then
+  keyringer_action_usage
+  exit 1
+fi
+
 # Aditional parameters
 if [ ! -z "$3" ]; then
-  shift 1
+  keyringer_get_new_file $2
+  shift 2
   UNENCRYPTED_FILE="$*"
-  keyringer_get_new_file $*
 
   if [ ! -f "$UNENCRYPTED_FILE" ]; then
     echo "Error: cannot encrypt $UNENCRYPTED_FILE: file not found."
@@ -45,7 +61,7 @@ if [ "$err" != "0" ]; then
 fi
 
 if [ "$UNENCRYPTED_FILE" != "-" ]; then
-  echo "Now make to wipe the non-encrypted $UNENCRYPTED_FILE."
+  echo "Done. PLEASE WIPE the non-encrypted $UNENCRYPTED_FILE."
 fi
 
 # Stage
diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index 67b5122..bf2977d 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -347,14 +347,16 @@ function keyringer_get_new_file {
   fi
 
   # Sanitize and complete file name
-  FILE="`echo $FILE | sed -e s/[^A-Za-z0-9.\/]/_/g`"
-  FILE="$(keyringer_filename "$FILE")"
+  FILE="`echo $FILE | sed -e s/[^A-Za-z0-9.\/\-]/_/g`"
 
-  # Warn user about file name change:w
-  if [ "`basename "$*"`" != "$FILE" ]; then
+  # Warn user about file name change
+  if [ "`basename $*`" != "`basename $FILE`" ]; then
     echo "Sanitizing destination filename to `basename $FILE`"
   fi
-  
+
+  # Complete file name
+  FILE="$(keyringer_filename "$FILE")"
+
   if [ -z "$*" ]; then
     keyringer_action_usage
     exit 1
@@ -365,7 +367,7 @@ function keyringer_get_new_file {
 function keyringer_get_command {
   # Aditional parameters
   COMMAND="$1"
-  
+
   if [ -z "$COMMAND" ]; then
     keyringer_action_usage command
     exit 1
diff --git a/share/man/keyringer.1 b/share/man/keyringer.1
index 0f6e62d..c3fbc54 100644
--- a/share/man/keyringer.1
+++ b/share/man/keyringer.1
@@ -10,22 +10,22 @@ keyringer <\f[I]keyring\f[]> <\f[I]action\f[]> [\f[I]options\f[]]...
 Keyringer lets you manage and share secrets using GnuPG and Git in a
 distributed fashion.
 .PP
-It has custom commands to encrypt, decrypt and recrypt secrets as well
-as create key pairs and supports encryption to multiple recipients and
-groups of different recipients to ensure the same repository can be
-shared with a workgroup but allowing to keep some secrets available just
-to subsets of that group.
-.PP
-Secrets are encrypted using GPG and added to a git tree so later then
-can be synced with remote branches.
+It has custom commands to create key-pairs and to encrypt, decrypt and
+re-encrypt secrets.
+It also supports encryption to multiple recipients and groups of
+recipients, to allow a workgroup to share access to a single repository
+while restricting some secrets to subsets of the group.
+.PP
+Secrets are encrypted using GPG and added to a Git tree so that they can
+be synced with remote branches later.
 .SH ACTIONS
 .PP
 Keyringer has three types of actions:
 .IP "1." 3
-Repository lookup and manipulation actions, which handles repository
+Repository lookup and manipulation actions, which handle repository
 initialization, content tracking and navigation.
 .IP "2." 3
-Secret manipulation actions, which takes care of encrypting, decrypting
+Secret manipulation actions, which take care of encrypting, decrypting
 and other read/write operations on secrets.
 .IP "3." 3
 Configuration actions, handling repository metadata.
@@ -41,14 +41,14 @@ After initialization, \f[I]path\f[] will contain a folder structure for
 storing secrets and metadata (user aka recipients, groups of recipients,
 etc).
 .PP
-Also, an entry on \f[C]$HOME/.keyringer/config\f[] will be added
-allowing keyringer to find the keyring by it\[aq]s alias.
+Also, an entry will be added to \f[C]$HOME/.keyringer/config\f[]
+allowing keyringer to find the keyring by its alias.
 .RE
 .TP
 .B git <\f[I]action\f[]> <\f[I]options\f[]>
 Git wrapper that operates from the toplevel keyring repository.
-You can issue any \f[I]GIT(1)\f[] subcommand with this action that it
-will be applied into the keyring repository.
+You can issue any \f[I]GIT(1)\f[] subcommand with this action to have it
+applied in the keyring repository.
 .RS
 .RE
 .TP
@@ -61,11 +61,11 @@ command.
 .RE
 .SH SECRET MANIPULATION ACTIONS
 .PP
-All secret manipulation actions operates upon a \f[I]secret\f[] which is
-the pathname of an encrypted file relative to keyring with optional
+All secret manipulation actions operate upon a \f[I]secret\f[] which is
+the pathname of an encrypted file relative to the keyring with optional
 \f[C]\&.asc\f[] extension.
 .PP
-If the \f[C]\&.asc\f[] extension is ommited, keyringer will add it in
+If the \f[C]\&.asc\f[] extension is omitted, keyringer will add it at
 the end of the pathname.
 .PP
 No spaces are allowed in the secret name.
@@ -92,27 +92,27 @@ Decrypts a secret into standard output.
 .RE
 .TP
 .B del <\f[I]secret\f[]>
-Removes a secret using git.
+Removes a secret using Git.
 After deleting a secret a git commit and push is still needed to update
 remote repositories.
 .RS
 .PP
 Please note that this command \f[B]does not remove the secret from the
-git history.\f[] To completely remove a file from a keyring, you should
-also rewrite the git history by yourself.
+Git history.\f[] To completely remove a file from a keyring, you should
+also rewrite the Git history yourself.
 .RE
 .TP
 .B edit <\f[I]secret\f[]>
 Edit a secret by temporarily decrypting it, opening the decrypted copy
 into the text editor defined by the \f[I]$EDITOR\f[] environment
-variable and then recrypting it again.
+variable and then re-encrypting it.
 .RS
 .RE
 .TP
-.B encrypt [\f[I]file\f[]] <\f[I]secret\f[]>
+.B encrypt <\f[I]secret\f[]> [\f[I]file\f[]]
 Encrypts content from standard input or \f[I]file\f[] into
 \f[I]secret\f[] pathname.
-No spaces are supported in the \f[I]file\f[] name.
+No spaces are supported in the \f[I]secret\f[] name.
 .RS
 .RE
 .TP
@@ -123,24 +123,24 @@ Encrypt content, batch mode.
 .TP
 .B genpair <\f[I]ssh\f[]|\f[I]gpg\f[]|\f[I]ssl\f[]|\f[I]ssl-self\f[]>
 [\f[I]options\f[]]
-Wrapper to generete encryption keypairs, useful for automated key
+Wrapper to generate encryption key-pairs, useful for automated key
 deployment.
 .RS
 .RE
 .TP
 .B open <\f[I]secret\f[]>
-Decrypt a secret into a temporary folder and opening it using xdg-open
-which then tries to figure out the file type and calling the associated
+Decrypt a secret into a temporary folder and open it using xdg-open,
+which tries to figure out the file type and then calls the associated
 application.
 .RS
 .PP
 After the application exits, keyringer encrypts the temporary decrypted
-file again into the secret file.
+file again into the secret file and deletes the temporary file.
 .RE
 .TP
 .B recrypt <\f[I]secret\f[]>
-Recrypts a secret by decrypting it and recrypting again.
-Useful when users are added into recipient configuration.
+Re-encrypts a secret by decrypting it and encrypting it again.
+Useful when users are added into the recipient configuration.
 If no \f[I]secret\f[] is given, all secrets in the repository are
 re-encrypted.
 .RS
@@ -153,13 +153,12 @@ List available actions, useful for shell completion and syntax check.
 .RE
 .TP
 .B options <\f[I]ls\f[]|\f[I]edit\f[]|\f[I]add\f[]>
-List, edit or add miscelaneous \f[I]repository\f[] options.
+List, edit or add miscellaneous \f[I]repository\f[] options.
 .RS
 .PP
-Repository options are specific configurations for the keyring which are
-saved into the repository, making it available for all users with access
-to the repository and hence is a \f[I]global\f[] configuration stanza
-for a given keyring.
+Repository options are settings which are saved in the repository as a
+\f[I]global\f[] configuration stanza for a given keyring, shared by all
+users with access to the repository.
 .PP
 Options are written using the \f[I]KEY=VALUE\f[] syntax.
 All lines starting with the hash (#) character are interpreted as
@@ -170,9 +169,9 @@ comments.
 List, edit or add \f[I]user\f[] preferences for a given repository.
 .RS
 .PP
-User preferences are specific configurations for the keyring which are
-saved into the user\[aq]s keyringer folder (\f[C]$HOME/.keyringer/\f[])
-hence not shared with the other users.
+User preferences are settings which are saved in the user\[aq]s
+keyringer folder (\f[C]$HOME/.keyringer/\f[]), and not shared with the
+other users.
 .PP
 Preferences are written using the \f[I]KEY=VALUE\f[] syntax.
 All lines starting with the hash (#) character are interpreted as
@@ -184,53 +183,51 @@ Show keyringer usage information.
 .RS
 .RE
 .TP
-.B recipients <\f[I]ls\f[]|\f[I]edit\f[]> <\f[I]recipient-file\f[]>
-List, create or edit recipient configuration.
+.B recipients <\f[I]ls\f[]|\f[I]edit\f[]> <\f[I]recipients-file\f[]>
+List, create or edit recipients configuration.
 .RS
 .PP
-Recipient files are lists of OpenPGP public key fingerprints which are
+Recipients files are lists of OpenPGP public key fingerprints which are
 used by keyringer when encrypting secrets and associated with email
 aliases.
 .PP
-Keyringer uses a default recipient file and supports custom
-\f[I]recipient-files\f[] which overrides the default recipient file
-according to it\[aq]s matching pathname.
-.PP
-For instance, a the \f[I]recipient-file\f[] called \f[I]accounting\f[]
-will be used wherever a user encrypts a secret to a file residing from
-the \f[I]accounting\f[] folder in the keyring repository.
-In that case, encrypting a secret into \f[I]accounting/bank-accounts\f[]
-will result in a file
-\f[C]$KEYRING_FOLDER/keys/accounting/bank-accounts.asc\f[] encrypted
-using the public keys listed in
-\f[C]$KEYRING_FOLDER/config/recipients/accounting\f[] config file.
-.PP
-Each line in a recipients file has entries in the form of
-\[aq]john\@doe.com XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\[aq], where
-\f[I]john\@doe.com\f[] is an alias for the GPG public key whose
-fingerprint is \f[I]XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.\f[]
-.PP
-All lines starting with the hash (#) character are interpreted as
-comments.
-.PP
-Parameters to the \f[I]recipients\f[] action are:
-.TP
-.B \f[I]ls\f[]
-List all existing recipient files.
-.RS
+Keyringer uses a default recipients file, but specifying a custom
+\f[I]recipients-file\f[] pathname will override this default.
+For instance, if a user encrypts a secret to a file in the keyring
+repository\[aq]s \f[I]accounting\f[] folder, a \f[I]recipients-file\f[]
+under \f[I]accounting\f[] will be used.
+Encrypting a secret into \f[I]accounting/bank-accounts\f[] will result
+in a file
 .RE
-.TP
-.B \f[I]edit\f[]
-Create or edit a recipient-file.
-.RS
 .PP
-Editing happens using the editor specified by the \f[C]$EDITOR\f[]
-environment variable.
-.PP
-The required parameter \f[I]recipient-file\f[] is taken relativelly from
-the \f[C]$KEYRING_FOLDER/config/recipients/\f[] folder.
-.RE
-.RE
+\f[C]$KEYRING_FOLDER/keys/accounting/bank-accounts.asc\f[] encrypted
+using the public keys listed in the config
+file\f[C]$KEYRING_FOLDER/config/recipients/accounting\f[].
+.IP
+.nf
+\f[C]
+Each\ line\ in\ a\ recipients\ file\ has\ entries\ in\ the\ format
+\[aq]john\@doe.com\ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\[aq],\ where\ *john\@doe.com*
+is\ an\ alias\ for\ the\ GPG\ public\ key\ whose\ fingerprint\ is
+*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.*
+
+All\ lines\ starting\ with\ the\ hash\ (#)\ character\ are\ interpreted\ as\ comments.
+
+Parameters\ to\ the\ *recipients*\ action\ are:
+
+\ \ *ls*
+\ \ :\ \ \ List\ all\ existing\ recipients\ files.
+
+\ \ *edit*
+\ \ :\ \ \ Create\ or\ edit\ a\ recipients\ file.
+
+\ \ \ \ \ \ Editing\ happens\ using\ the\ editor\ specified\ by\ the\ `$EDITOR`
+\ \ \ \ \ \ environment\ variable.
+
+\ \ \ \ \ \ The\ required\ parameter\ *recipients-file*\ is\ interpreted\ relative
+\ \ \ \ \ \ to\ the\ `$KEYRING_FOLDER/config/recipients/`\ folder.
+\f[]
+.fi
 .SH FILES
 .PP
 $HOME/.keyringer/config : User\[aq]s main configuration file used to map
@@ -246,21 +243,22 @@ applied for all users that use the keyringer repository.
 Keyringer currently has the following limitations:
 .IP "1." 3
 Metadata is not encrypted, meaning that an attacker with access to a
-keyringer repository knows all public key IDs are used for encryption
-and which secrets are encrypted to which keys.
+keyringer repository can discover all public key IDs used for
+encryption, and which secrets are encrypted to which keys.
 This can be improved in the future by encrypting the repository
-configuration with support for \f[I]--hidden-recipient\f[] GnuPG option.
+configuration with support for the \f[I]--hidden-recipient\f[] GnuPG
+option.
 .IP "2." 3
 History is not rewritten by default when secrets are removed from a
 keyringer repository.
-After a secret is removed with \f[I]del\f[] action, it will still be
+After a secret is removed with the \f[I]del\f[] action, it will still be
 available in the repository history even after a commit.
-This is by design due to the following reasons:
+This is by design for the following reasons:
 .IP \[bu] 2
 It\[aq]s the default behavior of the Git content tracker.
 Forcing the deletion by default could break the expected behavior and
 hence limit the repository\[aq]s backup features, which can be helpful
-is someone mistakenly overwrites a secret.
+if someone mistakenly overwrites a secret.
 .IP \[bu] 2
 History rewriting cannot be considered a security measure against the
 unauthorized access to a secret as it doesn\[aq]t automatically update
@@ -268,7 +266,7 @@ all working copies of the repository.
 .RS 2
 .PP
 In the case that the secret is a passphrase, the recommended measure
-against such attack is to change the passphrase, making useless the
+against such attacks is to change the passphrase, making useless the
 knowledge of the previous secret.
 .PP
 Users wishing to edit their repository history should proceed manually
diff --git a/share/man/keyringer.1.mdwn b/share/man/keyringer.1.mdwn
index 396e44d..ee035e3 100644
--- a/share/man/keyringer.1.mdwn
+++ b/share/man/keyringer.1.mdwn
@@ -92,9 +92,9 @@ edit <*secret*>
 :   Edit a secret by temporarily decrypting it, opening the decrypted copy into the 
     text editor defined by the *$EDITOR* environment variable and then re-encrypting it.
 
-encrypt [*file*] <*secret*>
+encrypt <*secret*> [*file*]
 :   Encrypts content from standard input or *file* into *secret* pathname. No spaces
-    are supported in the *file* name.
+    are supported in the *secret* name.
 
 encrypt-batch <*secret*>
 :   Encrypt content, batch mode.
-- 
cgit v1.2.3


From ee608b62742a05721256e50d4759da32f8be46fa Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 10:41:59 -0200
Subject: Enhancing shell completion for 'encrypt' action

---
 lib/keyringer/completions/bash/keyringer | 18 ++++++++++++++----
 lib/keyringer/completions/zsh/_keyringer |  3 +++
 2 files changed, 17 insertions(+), 4 deletions(-)

(limited to 'lib')

diff --git a/lib/keyringer/completions/bash/keyringer b/lib/keyringer/completions/bash/keyringer
index 875e6ab..7bfa62f 100644
--- a/lib/keyringer/completions/bash/keyringer
+++ b/lib/keyringer/completions/bash/keyringer
@@ -42,6 +42,15 @@ _keyringer_git_complete() {
   fi
 }
 
+# Path completion
+function _keyringer_path_complete() {
+  # Thanks http://unix.stackexchange.com/questions/55520/create-bash-completion-script-to-autocomplete-paths-after-is-equal-sign
+  cur=${1//\\ / }
+  [[ ${cur} == "~/"* ]] && cur=${cur/\~/$HOME}
+
+  echo ${cur}
+}
+
 _keyringer() {
   # Standard stuff
   local cur prev command config path keyrings instances instance opts
@@ -94,10 +103,7 @@ _keyringer() {
         opts="$(_keyringer_git_complete ${cur})"
         ;;
       init)
-        # Thanks http://unix.stackexchange.com/questions/55520/create-bash-completion-script-to-autocomplete-paths-after-is-equal-sign
-        cur=${cur//\\ / }
-        [[ ${cur} == "~/"* ]] && cur=${cur/\~/$HOME}
-
+        cur="$(_keyringer_path_complete ${cur})"
         opts="$(compgen -o dirnames ${cur})"
         ;;
       *)
@@ -115,6 +121,10 @@ _keyringer() {
         # TODO
         opts="$(_keyringer_git_complete ${prev} ${cur})"
         ;;
+      encrypt|encrypt-batch)
+        cur="$(_keyringer_path_complete ${cur})"
+        opts="$(compgen -o dirnames ${cur})"
+        ;;
       *)
         ;;
     esac
diff --git a/lib/keyringer/completions/zsh/_keyringer b/lib/keyringer/completions/zsh/_keyringer
index 119d26d..50ff433 100644
--- a/lib/keyringer/completions/zsh/_keyringer
+++ b/lib/keyringer/completions/zsh/_keyringer
@@ -77,6 +77,9 @@ _keyringer() {
           git)
             compadd "$@" $(_keyringer_git_complete $words[4] $words[5])
             ;;
+          encrypt|encrypt-batch)
+            _files
+            ;;
           *)
             ;;
         esac
-- 
cgit v1.2.3


From e6f22ac9ccb5112f13d45d99e2ffb173237c4e1c Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 10:54:55 -0200
Subject: Show available keyrings on usage

---
 lib/keyringer/functions | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lib')

diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index bf2977d..d1bbb1c 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -396,10 +396,16 @@ function keyringer_show_actions {
 
 # Usage
 function keyringer_usage {
+  local keyrings="$(ls --color=never `dirname $CONFIG` | sed -e 's/config//' | xargs)"
+
   printf "Usage: %s <keyring> <action> [arguments]\n\n" "$BASENAME"
   printf "Available commands: \n\n"
   keyringer_show_actions | sed -e 's/^/\t/'
   printf "\tinit <path> [remote]\n\n" $BASENAME
+
+  if [ ! -z "$keyrings" ]; then
+    printf "Available keyrings: %s \n" "$keyrings"
+  fi
 }
 
 # Check recipients
-- 
cgit v1.2.3


From 8857d60617c00553aaab7f06153b17699c860e96 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 11:15:32 -0200
Subject: Edit default recipients during initialization

---
 keyringer               | 10 +++++++++-
 lib/keyringer/functions |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/keyringer b/keyringer
index 8ba1093..7aad6a0 100755
--- a/keyringer
+++ b/keyringer
@@ -90,8 +90,16 @@ function keyringer_init {
   # Init
   if ! keyringer_is_git "$BASEDIR"; then
     keyringer_exec git "$BASEDIR" init
+
+    # Edit default recipients
+    echo "Now you have to edit the default recipient configuration to be able to encrypt secrets."
+    echo "Press any key to proceed editing..."
+    read key
+    keyringer $KEYRING recipients edit default
+
+    # Stage and commit
     keyringer_exec git "$BASEDIR" add .
-    keyringer_exec git "$BASEDIR" commit -m Importing
+    keyringer_exec git "$BASEDIR" commit -m Initializing
   fi
 }
 
diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index d1bbb1c..b39b8ec 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -517,7 +517,7 @@ function keyringer_set_new_recipients {
 function keyringer_create_new_recipients {
   if [ ! -e "$1" ]; then
     mkdir -p "`dirname $1`"
-    echo "# Use entries in the form of 'john@doe.com XXXXXXXX'" > "$1"
+    echo "# Use entries in the form of 'john@doe.com XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'" > "$1"
     echo "" >> "$1"
   fi
 }
-- 
cgit v1.2.3


From 1340e329768f8f022c6d5cd91e512380d883a5ac Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 14:36:46 -0200
Subject: Set file extension for encrypted files

---
 lib/keyringer/actions/edit    |  8 +++++++-
 lib/keyringer/actions/encrypt | 17 ++++++++++++++++-
 lib/keyringer/functions       |  9 ++++++---
 3 files changed, 29 insertions(+), 5 deletions(-)

(limited to 'lib')

diff --git a/lib/keyringer/actions/edit b/lib/keyringer/actions/edit
index 54d0fec..f6477bf 100755
--- a/lib/keyringer/actions/edit
+++ b/lib/keyringer/actions/edit
@@ -16,8 +16,13 @@ keyringer_set_recipients "$FILE"
 # Warn user
 echo "Make sure that $BASEDIR is atop of an encrypted volume."
 
+# Get original file EXTENSION
+FILENAME="$(basename "$FILE" .asc)"
+FILENAME="$(basename "$FILENAME")"
+EXTENSION="${FILENAME##*.}"
+
 # Set a tmp file
-keyringer_set_tmpfile edit
+keyringer_set_tmpfile $BASENAME.$EXTENSION
 
 # Decrypt the information to the file
 $GPG --yes -o "$TMPWORK" --use-agent -d "$KEYDIR/$FILE"
@@ -26,6 +31,7 @@ if [ "$BASENAME" == "edit" ]; then
   APP="$EDITOR"
 elif [ "$BASENAME" == "open" ]; then
   if which xdg-open &> /dev/null; then
+    # TODO: set TMPWORK depending on the MIME type (`file -i` or `xdg-mime query filetype`)
     APP="xdg-open"
   else
     echo "You should have xdg-open application to perform this action, aborting."
diff --git a/lib/keyringer/actions/encrypt b/lib/keyringer/actions/encrypt
index d9d8f96..aadb9fa 100755
--- a/lib/keyringer/actions/encrypt
+++ b/lib/keyringer/actions/encrypt
@@ -25,10 +25,25 @@ fi
 
 # Aditional parameters
 if [ ! -z "$3" ]; then
-  keyringer_get_new_file $2
+  # Set secret name and original file
+  FILE="$2"
   shift 2
   UNENCRYPTED_FILE="$*"
 
+  # Get original file EXTENSION
+  FILENAME="$(basename "$UNENCRYPTED_FILE")"
+  EXTENSION="${FILENAME##*.}"
+
+  # Append file extension in the secret name
+  #
+  # Useful when opening files and the application needs the
+  # extension to guess the file type.
+  if ! echo $FILE | grep -q -e "\.$EXTENSION$"; then
+    FILE="$FILE.$EXTENSION"
+  fi
+
+  keyringer_get_new_file $FILE
+
   if [ ! -f "$UNENCRYPTED_FILE" ]; then
     echo "Error: cannot encrypt $UNENCRYPTED_FILE: file not found."
     exit 1
diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index b39b8ec..40e13aa 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -118,13 +118,16 @@ function keyringer_set_tmpfile {
     exit 1
   fi
 
+  # Set base temp folder
+  local tmp="$BASEDIR/tmp"
+
   if [ -z "$1" ]; then
-    template="$BASEDIR/tmp/keyringer.XXXXXXXXXX"
+    template="$tmp/keyringer.XXXXXXXXXX"
   else
-    template="$BASEDIR/tmp/$1.XXXXXXXXXX"
+    template="$tmp/XXXXXXXXXX.$1"
   fi
 
-  mkdir -p "$BASEDIR/tmp"
+  mkdir -p "$tmp"
   keyringer_git_ignore 'tmp/*'
 
   if [ "$2" == "-d" ]; then
-- 
cgit v1.2.3


From d5071621ef59e20fe1a0052ec237503afbf0b444 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 14:44:28 -0200
Subject: TODO cleanup (#28)

---
 lib/keyringer/actions/edit | 1 -
 1 file changed, 1 deletion(-)

(limited to 'lib')

diff --git a/lib/keyringer/actions/edit b/lib/keyringer/actions/edit
index f6477bf..c539846 100755
--- a/lib/keyringer/actions/edit
+++ b/lib/keyringer/actions/edit
@@ -31,7 +31,6 @@ if [ "$BASENAME" == "edit" ]; then
   APP="$EDITOR"
 elif [ "$BASENAME" == "open" ]; then
   if which xdg-open &> /dev/null; then
-    # TODO: set TMPWORK depending on the MIME type (`file -i` or `xdg-mime query filetype`)
     APP="xdg-open"
   else
     echo "You should have xdg-open application to perform this action, aborting."
-- 
cgit v1.2.3


From 6c08cb89106d0ab22749993ef860f593bb60b344 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 15:01:01 -0200
Subject: Adding keyringer_shred (closes #27)

---
 lib/keyringer/functions | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index 40e13aa..fcec045 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -144,13 +144,42 @@ function keyringer_set_tmpfile {
   trap "keyringer_unset_tmpfile $TMPWORK; exit" INT TERM EXIT
 }
 
+# Shred files
+function keyringer_shred {
+  local path="$1"
+  local tool
+
+  if [ -z "$path" ]; then
+    return
+  fi
+
+  # Get shred implementation
+  if which wipe &> /dev/null; then
+    tool="wipe"
+  elif which shred &> /dev/null; then
+    tool="shred"
+  else
+    # Worst implementation
+    tool="rm"
+  fi
+
+  echo "Removing $path using $tool..."
+
+  if [ -d "$path" ]; then
+    find $path -exec $tool -f {} \;
+    rmdir $path
+  elif [ -e "$path" ]; then
+    $tool -f "$path"
+  fi
+}
+
 # Remove a temporary file
 function keyringer_unset_tmpfile {
   if [ -z "$1" ]; then
     echo "No tmp file set"
   fi
 
-  rm -f "$1"
+  keyringer_shred "$1"
 
   if [ "$?" != "0" ]; then
     echo "Warning: could not delete file $1. Please delete it manually as it might have sensitive information."
-- 
cgit v1.2.3


From c10fdd5e50d1543196e0aeb29ee8032f0ad5aa0b Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 15:02:56 -0200
Subject: Warn user if keyringer_shred is using rm

---
 lib/keyringer/functions | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index fcec045..4d97f34 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -148,6 +148,7 @@ function keyringer_set_tmpfile {
 function keyringer_shred {
   local path="$1"
   local tool
+  local message="Removing"
 
   if [ -z "$path" ]; then
     return
@@ -160,10 +161,11 @@ function keyringer_shred {
     tool="shred"
   else
     # Worst implementation
+    message="WARNING $message"
     tool="rm"
   fi
 
-  echo "Removing $path using $tool..."
+  echo "$message $path using $tool..."
 
   if [ -d "$path" ]; then
     find $path -exec $tool -f {} \;
-- 
cgit v1.2.3


From d892fb9997a98d12d9a09b12d3179242c48a07c9 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 15:06:24 -0200
Subject: ChangeLog update and minor keyringer_shred improvement

---
 ChangeLog               | 2 ++
 lib/keyringer/functions | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/ChangeLog b/ChangeLog
index 629d2b5..b14e95a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 2013-11-14 -       Silvio Rhatto  <rhatto@riseup.net>
 
+	Shred of temporary files (closes #27)
+
 	Encrypt/open improvements (closes #9)
 
 	Initialization now asks user to edit the default preferences file
diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index 4d97f34..d02b1d8 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -152,6 +152,8 @@ function keyringer_shred {
 
   if [ -z "$path" ]; then
     return
+  elif [ ! -e "$path" ]; then
+    return
   fi
 
   # Get shred implementation
@@ -170,7 +172,7 @@ function keyringer_shred {
   if [ -d "$path" ]; then
     find $path -exec $tool -f {} \;
     rmdir $path
-  elif [ -e "$path" ]; then
+  else
     $tool -f "$path"
   fi
 }
-- 
cgit v1.2.3


From d7b631b470aa0fde1f6d768632ee5d643aede320 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 14 Nov 2013 16:05:17 -0200
Subject: Ramdisk check (closes #13)

---
 lib/keyringer/actions/edit |  3 ---
 lib/keyringer/functions    | 50 +++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 49 insertions(+), 4 deletions(-)

(limited to 'lib')

diff --git a/lib/keyringer/actions/edit b/lib/keyringer/actions/edit
index c539846..9a3e488 100755
--- a/lib/keyringer/actions/edit
+++ b/lib/keyringer/actions/edit
@@ -13,9 +13,6 @@ keyringer_get_file "$2"
 # Set recipients file
 keyringer_set_recipients "$FILE"
 
-# Warn user
-echo "Make sure that $BASEDIR is atop of an encrypted volume."
-
 # Get original file EXTENSION
 FILENAME="$(basename "$FILE" .asc)"
 FILENAME="$(basename "$FILENAME")"
diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index d02b1d8..7570a94 100755
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -111,16 +111,64 @@ function keyringer_is_git {
   fi
 }
 
+# Check the security of a temporary folder
+function keyringer_check_tmp {
+  local path="$1"
+  local minor
+  local mode
+
+  if [ -z "$path" ]; then
+    return
+  fi
+
+  # Mode check
+  if [ "`stat -c "%A" $path`" != "drwxrwxrwt" ]; then
+    return 1
+  fi
+
+  # Ramdisk check
+  if [ -x "/sbin/udevadm" ]; then
+    minor="$(/sbin/udevadm info --device-id-of-file "$path" | cut -d : -f 1)"
+  elif which mountpoint &> /dev/null; then
+    minor="$(mountpoint -d $(df "$path" | sed -n '$p' | awk '{print $NF}') | cut -d : -f 1)"
+  fi
+
+  if [ ! -z "$minor" ]; then
+    return $minor
+  else
+    return 1
+  fi
+}
+
 # Setup a temporary file
 function keyringer_set_tmpfile {
+  local tmp
+  local candidate
+  local candidates="/tmp /run/shm $TMP"
+
   if [ -z "$BASEDIR" ]; then
     echo "Please set BASEDIR before creating a tmp file"
     exit 1
   fi
 
+  # Ramdisk check
+  for candidate in $candidates; do
+    if keyringer_check_tmp $candidate; then
+      tmp="$candidate/keyringer.`whoami`"
+      break
+    fi
+  done
+
   # Set base temp folder
-  local tmp="$BASEDIR/tmp"
+  if [ -z "$tmp" ]; then
+    echo "WARNING: neither one of $candidates is mounted in a tmpfs/ramdisk, using $BASEDIR/tmp as fallback."
+    echo "Make sure that $BASEDIR is atop of an encrypted volume."
+    echo "Press any key to continue, Ctrl-C to abort"
+    read key
+    tmp="$BASEDIR/tmp"
+  fi
 
+  # Determine template
   if [ -z "$1" ]; then
     template="$tmp/keyringer.XXXXXXXXXX"
   else
-- 
cgit v1.2.3