@ -1,30 +1,28 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# Global variables:
WORKING_DIRECTORY = " $PWD " # shellcheck disable=2034
# Folders: # Folders:
= ".gitsecret" _SECRETS_DIR = ".gitsecret"
SECRETS_DIR_KEYS= " $SECRETS_DIR /keys " _SECRETS_DIR_KEYS = " ${ _SECRETS_DIR } /keys "
SECRETS_DIR_PATHS= " $SECRETS_DIR /paths " _SECRETS_DIR_PATHS= " ${ _SECRETS_DIR } /paths "
# Files: # Files:
SECRETS_DIR_KEYS_MAPPING= " $SECRETS_DIR_KEYS /mapping.cfg " # shellcheck disable=2034 _SECRETS_DIR_KEYS_MAPPING= " ${ _SECRETS_DIR_KEYS } /mapping.cfg "
SECRETS_DIR_KEYS_TRUSTDB= " $SECRETS_DIR_KEYS /trustdb.gpg " # shellcheck disable=2034 _SECRETS_DIR_KEYS_TRUSTDB= " ${ _SECRETS_DIR_KEYS } /trustdb.gpg "
= " $SECRETS_DIR_PATHS /mapping.cfg " # shellcheck disable=2034 _ SECRETS_DIR_PATHS_MAPPING= " ${ _SECRETS_DIR_PATHS } /mapping.cfg "
: " ${ SECRETS_EXTENSION : = ".secret" } "
: " ${ SECRETS_EXTENSION : = ".secret" } "
# Commands: # Commands:
: " ${ SECRETS_GPG_COMMAND : = "gpg" } "
: " ${ SECRETS_GPG_COMMAND : = "gpg" } "
GPGLOCAL = " $SECRETS_GPG_COMMAND --homedir= $SECRETS_DIR_KEYS --no-permission-warning "
# Inner b ash:# B ash:
function _function_exists { function _function_exists {
declare -f -F " $1 " > /dev/null 2>& 1
local function_name = " $1 " # required
declare -f -F " $function_name " > /dev/null 2>& 1
echo $?
echo $?
} }
@ -60,34 +58,46 @@ function _os_based {
# File System: # File System:
function _set_config { function _set_config {
# First parameter is the KEY, second is VALUE, third is filename.
# This function creates a line in the config, or alters it.
local key = " $1 " # required
local value = " $2 " # required
local filename = " $3 " # required
# The exit status is 0 (true) if the name was found, 1 (false) if not:
# The exit status is 0 (true) if the name was found, 1 (false) if not:
local contains
local contains
contains = $( grep -Fq " $1 " " $3 " ; echo " $? " )
contains = $( grep -Fq " $ key" " $filename " ; echo " $? " )
# Append or alter?
if [ [ " $contains " -eq 0 ] ] ; then
if [ [ " $contains " -eq 0 ] ] ; then
_os_based __replace_in_file " $@ "
_os_based __replace_in_file " $@ "
elif [ [ " $contains " -eq 1 ] ] ; then
elif [ [ " $contains " -eq 1 ] ] ; then
echo " $1 = $2 " >> " $3 "
echo " ${ key } = ${ value } " >> " $filename "
fi
fi
} }
function _file_has_line { function _file_has_line {
# First parameter is the KEY, second is the filename.
# First parameter is the key, second is the filename.
local key = " $1 " # required
local filename = " $2 " # required
local contains
local contains
contains = $( grep -qw " $1 " " $2 " ; echo $? )
contains = $( grep -qw " $key " " $filename " ; echo $? )
# 0 on contains, 1 for error.
# 0 on contains, 1 for error.
echo " $contains " ;
echo " $contains "
} }
function _delete_line { function _delete_line {
local escaped_path
local escaped_path
escaped_path = $( echo " $1 " | sed -e 's/[\/&]/\\&/g' )
escaped_path = $( echo " $1 " | sed -e 's/[\/&]/\\&/g' ) # required
sed -i.bak " / $escaped_path /d " " $2 "
local line = " $2 " # required
sed -i.bak " / $escaped_path /d " " $line "
} }
@ -103,14 +113,17 @@ function _temporary_file {
function _unique_filename { function _unique_filename {
# First parameter is base-path, second is filename,
# First parameter is base-path, second is filename,
# third is optional extension.
# third is optional extension.
local n = 0 result = $2
local n = 0
local base_path = " $1 "
local result = " $2 "
while true; do
while true; do
if [ [ ! -f " $1 / $result " ] ] ; then
if [ [ ! -f " $ base_path / $result " ] ] ; then
break
break
fi
fi
n = $(( n + 1 ))
n = $(( n + 1 ))
result = " ${ 2 } - ${ n } "
result = " ${ 2 } - ${ n } " # calling to the original "$2"
done
done
echo " $result "
echo " $result "
} }
@ -119,7 +132,8 @@ function _unique_filename {
# Manuals: # Manuals:
function _show_manual_for { function _show_manual_for {
local function_name = " $1 "
local function_name = " $1 " # required
man " git-secret- ${ function_name } "
man " git-secret- ${ function_name } "
exit 0
exit 0
} }
@ -128,39 +142,132 @@ function _show_manual_for {
# VCS: # VCS:
function _check_ignore { function _check_ignore {
git check-ignore --no-index -q " $1 " ;
local filename = " $1 " # required
echo $?
local result
result = " $( git check-ignore --no-index -q " $filename " > /dev/null 2>& 1; echo $? ) "
echo " $result "
} }
function _add_ignored_file { function _git_normalize_filename {
if [ [ ! -f ".gitignore" ] ] ; then
local filename = " $1 " # required
touch ".gitignore"
local result
result = $( git ls-files --full-name -o " $filename " )
echo " $result "
}
function _maybe_create_gitignore {
# This function creates '.gitignore' if it was missing.
local full_path
full_path = $( _append_root_path '.gitignore' )
if [ [ ! -f " $full_path " ] ] ; then
touch " $full_path "
fi
fi
}
echo " $1 " >> ".gitignore"
function _add_ignored_file {
# This function adds a line with the filename into the '.gitgnore' file.
# It also creates '.gitignore' if it's not there
local filename = " $1 " # required
_maybe_create_gitignore
local full_path
full_path = $( _append_root_path '.gitignore' )
echo " $filename " >> " $full_path "
} }
function _is_inside_git_tree { function _is_inside_git_tree {
git rev-parse --is-inside-work-tree >/dev/null 2>& 1
# Checks if we are working inside the `git` tree.
echo $?
local result
result = $( git rev-parse --is-inside-work-tree > /dev/null 2>& 1; echo $? )
echo " $result "
} }
function _get_git_root_path { function _get_git_root_path {
# We need this function to get the location of the `.git` folder,
# We need this function to get the location of the `.git` folder,
# since `.gitsecret` must be on the same level.
# since `.gitsecret` must be on the same level.
local result
local result
result = $( git rev-parse --show-toplevel)
result = $( git rev-parse --show-toplevel)
echo " $result "
echo " $result "
} }
# Relative paths:
function _append_root_path {
# This function adds root path to any other path.
local path = " $1 " # required
local root_path
root_path = $( _get_git_root_path)
echo " $root_path / $path "
}
function _get_secrets_dir {
_append_root_path " ${ _SECRETS_DIR } "
}
function _get_secrets_dir_keys {
_append_root_path " ${ _SECRETS_DIR_KEYS } "
}
function _get_secrets_dir_path {
_append_root_path " ${ _SECRETS_DIR_PATHS } "
}
function _get_secrets_dir_keys_mapping {
_append_root_path " ${ _SECRETS_DIR_KEYS_MAPPING } "
}
function _get_secrets_dir_keys_trustdb {
_append_root_path " ${ _SECRETS_DIR_KEYS_TRUSTDB } "
}
function _get_secrets_dir_paths_mapping {
_append_root_path " ${ _SECRETS_DIR_PATHS_MAPPING } "
}
# Logic: # Logic:
function _get_gpg_local {
# This function is required to return proper `gpg` command.
# This function was created due to this bug:
# https://github.com/sobolevn/git-secret/issues/85
local homedir
homedir = $( _get_secrets_dir_keys)
local gpg_local = " $SECRETS_GPG_COMMAND --homedir= $homedir --no-permission-warning "
echo " $gpg_local "
}
function _abort { function _abort {
>& 2 echo " $1 abort. "
local message = " $1 " # required
>& 2 echo " $message abort. "
exit 1
exit 1
} }
@ -171,8 +278,11 @@ function _find_and_clean {
# optional:
# optional:
local verbose = ${ 2 :- "" } # can be empty or should be equal to "v"
local verbose = ${ 2 :- "" } # can be empty or should be equal to "v"
local root
root = $( _get_git_root_path)
# shellcheck disable=2086
# shellcheck disable=2086
find . -name " $pattern " -type f -print0 | xargs -0 rm -f$verbose
find " $root " -path" $pattern " -type f -print0 | xargs -0 rm -f$verbose
} }
@ -196,11 +306,25 @@ function _find_and_clean_formated {
} }
function _list_all_added_files {
local path_mappings
path_mappings = $( _get_secrets_dir_paths_mapping)
if [ [ ! -s " $path_mappings " ] ] ; then
_abort " $path_mappings is missing. "
fi
while read -r line; do
echo " $line "
done < " $path_mappings "
}
function _secrets_dir_exists { function _secrets_dir_exists {
local root_path
# This function checks if "$_SECRETS_DIR" exists and.
root_path = $( _get_git_root_path)
local full_path = " $root_path / $SECRETS_DIR "
local full_path
full_path = $( _get_secrets_dir)
if [ [ ! -d " $full_path " ] ] ; then
if [ [ ! -d " $full_path " ] ] ; then
_abort " $full_path does not exist. "
_abort " $full_path does not exist. "
@ -208,16 +332,42 @@ function _secrets_dir_exists {
} }
function _secrets_dir_is_not_ignored {
# This function checks that "${_SECRETS_DIR}" is not ignored.
local git_secret_dir
git_secret_dir = $( _get_secrets_dir)
local ignores
ignores = $( _check_ignore " ${ _SECRETS_DIR } / " )
if [ [ ! $ignores -eq 1 ] ] ; then
_abort " ' $git_secret_dir /' is ignored. "
fi
}
function _user_required { function _user_required {
# This function does a bunch of validations:
# 1. It calls `_secrets_dir_exists` to verify that "$_SECRETS_DIR" exists.
# 2. It ensures that "$_SECRETS_DIR_KEYS_TRUSTDB" exists.
# 3. It ensures that there are added public keys.
_secrets_dir_exists
_secrets_dir_exists
local error_message = "no users found. run 'git secret tell' before adding files."
local trustdb
if [ [ ! -f " $SECRETS_DIR_KEYS_TRUSTDB " ] ] ; then
trustdb = $( _get_secrets_dir_keys_trustdb)
local error_message = "no users found. run 'git secret tell'."
if [ [ ! -f " $trustdb " ] ] ; then
_abort " $error_message "
_abort " $error_message "
fi
fi
local gpg_local
gpg_local = $( _get_gpg_local)
local keys_exist
local keys_exist
keys_exist = $( $GPGLOCAL -n --list-keys)
keys_exist = $( $ gpg_local -n --list-keys)
if [ [ -z " $keys_exist " ] ] ; then
if [ [ -z " $keys_exist " ] ] ; then
_abort " $error_message "
_abort " $error_message "
fi
fi
@ -236,17 +386,35 @@ function _get_encrypted_filename {
} }
function _get_users_in_keyring { function _parse_keyring_users {
# First argument must be a `sed` pattern
local sed_pattern = " $1 "
local result
local result
result = $( $GPGLOCAL --list-public-keys --with-colon | sed -n 's/.*<\(.*\)>.*/\1/p' )
local gpg_local
gpg_local = $( _get_gpg_local)
result = $( $gpg_local --list-public-keys --with-colon | sed -n " $sed_pattern " )
echo " $result "
echo " $result "
} }
function _get_users_in_keyring {
# This function is required to show the users in the keyring.
# `whoknows` command uses it internally.
# It basically just parses the `gpg` public keys
_parse_keyring_users 's/.*<\(.*\)>.*/\1/p'
}
function _get_recepients { function _get_recepients {
local result
# This function is required to create an encrypted file for different users.
result = $( $GPGLOCAL --list-public-keys --with-colon | sed -n 's/.*<\(.*\)>.*/-r\1/p' )
# These users are called 'recepients' in the `gpg` terms.
echo " $result "
# It basically just parses the `gpg` public keys
_parse_keyring_users 's/.*<\(.*\)>.*/-r\1/p'
} }
@ -278,9 +446,9 @@ function _decrypt {
fi
fi
if [ [ ! -z " $passphrase " ] ] ; then
if [ [ ! -z " $passphrase " ] ] ; then
echo " $passphrase " | $base --batch --yes --no-tty --passphrase-fd 0 \
echo " $passphrase " | $base --quiet -- batch --yes --no-tty --passphrase-fd 0 \
" $encrypted_filename " > /dev/null 2>& 1
" $encrypted_filename "
else
else
$base " $encrypted_filename " > /dev/null 2>& 1
$base --quiet " $encrypted_filename "
fi
fi
} }
sobolevn
8 years ago