refactored all src folder

.ci/before_deploy.sh

@@ -11,5 +11,5 @@ fi
 if [[ ! -z "$DOCKER_DIST" ]]; then
   # When making a non-container build, this step will generate
   # proper manifest files:
-  make deploy-${GITSECRET_DIST};
+  make "deploy-${GITSECRET_DIST}";
 fi

.ci/before_script.sh

@@ -13,12 +13,16 @@ fi
 
 # Mac:
 if [[ "$GITSECRET_DIST" == "brew" ]]; then
-  brew install $GITSECRET_GPG_DEP
+  brew install "$GITSECRET_GPG_DEP"
 fi
 
 # Local linux (standart build):
-if [[ "$GITSECRET_DIST" == "none" ]] &&
-   [[ "$GITSECRET_GPG_DEP" == "gnupg2" ]]; then
-  # Installing custom GPG version:
-  sudo apt-get install -y gnupg2
+if [[ "$GITSECRET_DIST" == "none" ]]; then
+  # Installing linter:
+  sudo apt-get install -y shellcheck
+
+  if [[ "$GITSECRET_GPG_DEP" == "gnupg2" ]]; then
+    # Installing custom GPG version:
+    sudo apt-get install -y gnupg2
+  fi
 fi

.ci/script.sh

@@ -6,7 +6,7 @@ set -e
 if [[ ! -z "$DOCKER_DIST" ]]; then
   TEMPLATE="sobolevn/git-secret-docker-$DOCKER_DIST"
   # Passing the `TRAVIS_COMMIT` into the container:
-  COMMAND="if [ ! -z "${TRAVIS_COMMIT}" ]; then git checkout "${TRAVIS_COMMIT}"; fi; make test-${GITSECRET_DIST}-ci"
+  COMMAND="if [ ! -z ${TRAVIS_COMMIT} ]; then git checkout ${TRAVIS_COMMIT}; fi; make test-${GITSECRET_DIST}-ci"
 
   # This will run the full intergration check inside the `docker` container:
   # see `test-deb-ci` and `test-rpm-ci` in `Makefile`
@@ -20,3 +20,8 @@ if [[ -z "$DOCKER_DIST" ]]; then
   # since it is called inside the docker container anyway.
   make test
 fi
+
+if [[ "$GITSECRET_DIST" == 'none' ]]; then
+  # If running a native build, do a lint:
+  find src -type f -name '*.sh' -print0 | xargs -0 -I {} shellcheck {}
+fi

.gitignore

@@ -133,3 +133,4 @@ temp/
 build/
 *.deb
 *.fpm
+test.txt

git-secret.plugin.zsh

@@ -1,3 +1,5 @@
+#!/usr/bin/env zsh
+
 # Copyright 2016 Sobolev Nikita <mail@sobolevn.me>
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,7 +15,7 @@
 # limitations under the License.
 
 # Create binary:
-PLUGIN_DIR="$(dirname $0)"
+PLUGIN_DIR="$(dirname "$0")"
 
 if [ ! -f "$PLUGIN_DIR/git-secret" ]; then
   cd "$PLUGIN_DIR" && make build && cd ..

src/_utils/_git_secret_tools.sh

@@ -212,7 +212,7 @@ function _decrypt {
   local encrypted_filename
   encrypted_filename=$(_get_encrypted_filename "$filename")
 
-  local base="$SECRETS_GPG_COMMAND --use-agent -q --decrypt"
+  local base="$SECRETS_GPG_COMMAND --use-agent -q --decrypt --no-permission-warning"
 
   if [[ "$write_to_file" -eq 1 ]]; then
     base="$base -o $filename"

src/commands/git_secret_changes.sh

@@ -1,11 +1,13 @@
 #!/usr/bin/env bash
 
 function changes {
+  local passphrase=""
+
   OPTIND=1
 
-  while getopts "hd:p:" opt; do
+  while getopts 'hd:p:' opt; do
     case "$opt" in
-      h) _show_manual_for "changes";;
+      h) _show_manual_for 'changes';;
 
       p) passphrase=$OPTARG;;
 
@@ -14,7 +16,7 @@ function changes {
   done
 
   shift $((OPTIND-1))
-  [ "$1" = "--" ] && shift
+  [ "$1" = '--' ] && shift
 
   local filenames="$1"
   if [[ -z "$filenames" ]]; then
@@ -22,18 +24,21 @@ function changes {
     filenames=$(git secret list)
   fi
 
-  local previous_commit=$(git rev-parse HEAD)
-
-  for filename in "$filenames"; do
-    # Meta information:
-    local encrypted_filename=$(_get_encrypted_filename "$filename")
-    local last_encrypted=$(git show "${previous_commit}:${encrypted_filename}")
+  IFS='
+  '
+  for filename in $filenames; do
+    local decrypted
+    local content
+    local diff_result
 
     # Now we have all the data required:
-    local decrypted=$(_decrypt "$filename" "0" "0" "$homedir" "$passphrase")
-    local content=$(cat "$filename")
+    decrypted=$(_decrypt "$filename" "0" "0" "$homedir" "$passphrase")
+    content=$(cat "$filename")
 
-    local diff_result=$(diff <(echo "$decrypted") <(echo "$content"))
+    # Let's diff the result:
+    diff_result=$(diff <(echo "$decrypted") <(echo "$content")) || true
+    # There was a bug in the previous version, since `diff` returns
+    # exit code `1` when the files are different.
     echo "changes in ${filename}: ${diff_result}"
   done
 }

src/commands/git_secret_clean.sh

@@ -2,22 +2,23 @@
 
 
 function clean {
+  local verbose=''
+
   OPTIND=1
 
-  local verbose=""
-  while getopts "vh" opt; do
+  while getopts 'vh' opt; do
     case "$opt" in
       v) verbose="v";;
 
-      h) _show_manual_for "clean";;
+      h) _show_manual_for 'clean';;
     esac
   done
 
   shift $((OPTIND-1))
-  [ "$1" = "--" ] && shift
+  [ "$1" = '--' ] && shift
 
   if [[ ! -z "$verbose" ]]; then
-    echo && echo "cleaing:"
+    echo && echo 'cleaing:'
   fi
 
   find . -name "*$SECRETS_EXTENSION" -type f -print0 | xargs rm -f$verbose

src/commands/git_secret_hide.sh

@@ -12,7 +12,7 @@ function _optional_clean {
 
       h) _show_manual_for 'hide';;
 
-      v) opt_string="-v";;
+      v) opt_string='-v';;
     esac
   done
 

src/commands/git_secret_killperson.sh

@@ -4,9 +4,9 @@
 function killperson {
   OPTIND=1
 
-  while getopts "h" opt; do
+  while getopts 'h' opt; do
     case "$opt" in
-      h) _show_manual_for "killperson";;
+      h) _show_manual_for 'killperson';;
     esac
   done
 

src/commands/git_secret_list.sh

@@ -4,14 +4,14 @@
 function list {
   OPTIND=1
 
-  while getopts 'h?' opt; do
+  while getopts 'h' opt; do
     case "$opt" in
       h) _show_manual_for 'list';;
     esac
   done
 
   shift $((OPTIND-1))
-  [ "$1" = "--" ] && shift
+  [ "$1" = '--' ] && shift
 
   _user_required
 

src/commands/git_secret_remove.sh

@@ -2,9 +2,10 @@
 
 
 function remove {
-  OPTIND=1
   local clean=0
 
+  OPTIND=1
+
   while getopts 'ch' opt; do
     case "$opt" in
       c) clean=1;;
@@ -14,9 +15,9 @@ function remove {
   done
 
   shift $((OPTIND-1))
-  [ "$1" = "--" ] && shift
+  [ "$1" = '--' ] && shift
 
-  # validate if user exist:
+  # Validate if user exists:
   _user_required
 
   for item in "$@"; do
@@ -25,7 +26,7 @@ function remove {
     fi
 
     _delete_line "$item" "$SECRETS_DIR_PATHS_MAPPING"
-    rm -f "${SECRETS_DIR_PATHS_MAPPING}.bak"
+    rm -f "${SECRETS_DIR_PATHS_MAPPING}.bak"  # not all systems create '.bak'
 
     if [[ "$clean" == 1 ]]; then
       local encrypted_filename

src/commands/git_secret_reveal.sh

@@ -2,15 +2,15 @@
 
 
 function reveal {
+  local homedir=''
+  local passphrase=''
+  local force=0
 
   OPTIND=1
-  local homedir=""
-  local passphrase=""
-  local force=0
 
-  while getopts "hfd:p:" opt; do
+  while getopts 'hfd:p:' opt; do
     case "$opt" in
-      h) _show_manual_for "reveal";;
+      h) _show_manual_for 'reveal';;
 
       f) force=1;;
 
@@ -21,13 +21,13 @@ function reveal {
   done
 
   shift $((OPTIND-1))
-  [ "$1" = "--" ] && shift
+  [ "$1" = '--' ] && shift
 
    _user_required
 
   local counter=0
-  while read line; do
-    # the parameters are: filename, force, homedir, passphrase
+  while read -r line; do
+    # The parameters are: filename, write-to-file, force, homedir, passphrase
     _decrypt "$line" "1" "$force" "$homedir" "$passphrase"
 
     counter=$((counter+1))

src/commands/git_secret_tell.sh

@@ -2,15 +2,13 @@
 
 
 function tell {
-  _secrets_dir_exists
+  local email
+  local homedir
 
   # A POSIX variable
   # Reset in case getopts has been used previously in the shell.
   OPTIND=1
 
-  local email
-  local homedir
-
   while getopts "h?md:" opt; do
     case "$opt" in
       h) _show_manual_for "tell";;
@@ -26,6 +24,9 @@ function tell {
   shift $((OPTIND-1))
   [ "$1" = "--" ] && shift
 
+  # Moved to enable viewing a manual without validation:
+  _secrets_dir_exists
+
   # Custom argument-parsing:
   if [[ -z $email ]]; then
     # Email was not set via `-m` and is in $1:
@@ -33,18 +34,20 @@ function tell {
   fi
 
   # This file will be removed automatically:
-  _temporary_file
+  _temporary_file  # note, that `_temporary_file` will export `filename` var.
+  # shellcheck disable=2154
   local keyfile="$filename"
 
   if [[ -z "$homedir" ]]; then
     $SECRETS_GPG_COMMAND --export -a "$email" > "$keyfile"
   else
     # It means that homedir is set as an extra argument via `-d`:
-    $SECRETS_GPG_COMMAND --no-permission-warning --homedir="$homedir" --export -a "$email" > "$keyfile"
+    $SECRETS_GPG_COMMAND --no-permission-warning --homedir="$homedir" \
+      --export -a "$email" > "$keyfile"
   fi
 
   if [[ ! -s "$keyfile" ]]; then
-    _abort 'gpg key is empty. check your key name: `gpg --list-keys`.'
+    _abort 'gpg key is empty. check your key name: "gpg --list-keys".'
   fi
 
   # Importing public key to the local keychain:

src/commands/git_secret_whoknows.sh

@@ -13,8 +13,12 @@ function whoknows {
   shift $((OPTIND-1))
   [ "$1" = "--" ] && shift
 
+  # Validating, that we have a user:
   _user_required
 
-  local keys=$(_get_users_in_keyring)
+  local keys
+
+  # Just to the point:
+  keys=$(_get_users_in_keyring)
   echo "$keys"
 }

src/main.sh

@@ -12,14 +12,14 @@ function _check_setup {
   local ignored
   ignored=$(_check_ignore ".gitsecret/")
   if [[ ! $ignored -eq 1 ]]; then
-    _abort ".gitsecret folder is ignored."
+    _abort '.gitsecret folder is ignored.'
   fi
 
   # Checking gpg setup:
   local secring="$SECRETS_DIR_KEYS/secring.gpg"
   if [[ -f $secring ]] && [[ -s $secring ]]; then
     # secring.gpg is not empty, someone has imported a private key.
-    _abort "it seems that someone has imported a secret key."
+    _abort 'it seems that someone has imported a secret key.'
   fi
 }
 
@@ -39,7 +39,7 @@ function _show_version {
 
 function _init_script {
   if [[ $# == 0 ]]; then
-    _incorrect_usage "no input parameters provided." 126
+    _incorrect_usage 'no input parameters provided.' 126
   fi
 
   # Parse plugin-level options:
@@ -49,7 +49,7 @@ function _init_script {
     local opt="$1"
 
     case "$opt" in
-      # options for quick-exit strategy:
+      # Options for quick-exit strategy:
       --dry-run)
         dry_run=1
         shift;;
@@ -61,13 +61,10 @@ function _init_script {
   done
 
   if [[ "$dry_run" == 0 ]]; then
-    # checking for proper set-up:
-    _check_setup 
+    # Checking for proper set-up:
+    _check_setup
 
-    # load dependencies:
-    # for f in ${0%/*}/src/*/*; do [[ -f "$f" ]] && . "$f"; done
-
-    # routing the input command:
+    # Routing the input command:
     if [[ $(_function_exists "$1") == 0 ]] && [[ ! $1 == _* ]]; then
       $1 "${@:2}"
     else  # TODO: elif [[ $(_plugin_exists $1) == 0 ]]; then

tests/test_changes.bats

@@ -3,6 +3,7 @@
 load _test_base
 
 FILE_TO_HIDE="file_to_hide"
+SECOND_FILE_TO_HIDE="second_file_to_hide"
 FILE_CONTENTS="hidden content юникод"
 
 FINGERPRINT=""
@@ -15,6 +16,7 @@ function setup {
   set_state_secret_init
   set_state_secret_tell "$TEST_DEFAULT_USER"
   set_state_secret_add "$FILE_TO_HIDE" "$FILE_CONTENTS"
+  set_state_secret_add "$SECOND_FILE_TO_HIDE" "$FILE_CONTENTS"
   set_state_secret_hide
 }
 
@@ -26,16 +28,16 @@ function teardown {
 }
 
 
-@test "run 'changes' without previous commit" {
+@test "run 'changes' with one file changed" {
   local password=$(test_user_password "$TEST_DEFAULT_USER")
   local new_content="new content"
   echo "$new_content" >> "$FILE_TO_HIDE"
 
-  run git secret changes -d "$TEST_GPG_HOMEDIR" -p "$password"
+  run git secret changes -d "$TEST_GPG_HOMEDIR" -p "$password" "$FILE_TO_HIDE"
   [ "$status" -eq 0 ]
 
   # Testing that output has both filename and changes:
-  [[ "$output" == *"$FILE_TO_HIDE"* ]]
+  [[ "$output" == *"changes in $FILE_TO_HIDE"* ]]
   [[ "$output" == *"$new_content"* ]]
 }
 
@@ -47,14 +49,20 @@ function teardown {
 }
 
 
-@test "run 'changes' with commit" {
-  git_commit "$(test_user_email $TEST_DEFAULT_USER)" 'initial'
+@test "run 'changes' with multiple files changed" {
   local password=$(test_user_password "$TEST_DEFAULT_USER")
-
-  echo "new content" >> "$FILE_TO_HIDE"
+  local new_content="new content"
+  local second_new_content="something different"
+  echo "$new_content" >> "$FILE_TO_HIDE"
+  echo "$second_new_content" >> "$SECOND_FILE_TO_HIDE"
 
   run git secret changes -d "$TEST_GPG_HOMEDIR" -p "$password"
   [ "$status" -eq 0 ]
-  [[ "$output" == *"$FILE_TO_HIDE"* ]]
+
+  # Testing that output has both filename and changes:
+  [[ "$output" == *"changes in $FILE_TO_HIDE"* ]]
   [[ "$output" == *"$new_content"* ]]
+
+  [[ "$output" == *"changes in $SECOND_FILE_TO_HIDE"* ]]
+  [[ "$output" == *"$second_file_to_hide"* ]]
 }

tests/test_killperson.bats

@@ -8,10 +8,6 @@ function setup {
   set_state_git
   set_state_secret_init
   set_state_secret_tell "$TEST_DEFAULT_USER"
-
-  # init_git_repository
-  # git_secret_init
-  # git_secret_tell_test
 }