Commit df43346

fix: pa rekey

1@@ -257,7 +257,7 @@ main() {
2         git config diff.age.textconv "$age --decrypt -i '$identities_file'"
3 
4         # Assign this diff driver to all passwords.
5-        printf '%s\n' '*.age diff=age' >.gitattributes
6+        printf '%s\n' '*.age diff=age' >|.gitattributes
7 
8         git_add_and_commit . "initial commit"
9     }

 1@@ -1,9 +1,8 @@
 2 #!/bin/sh
 3 #
 4-# rotate keys and reencrypt passwords
 5+# re-encrypt passwords with existing recipients and identities
 6 #
 7-# Reuse identities file: export PA_IDENTITIES=~/.local/share/pa/identities
 8-# Reuse recipients file: export PA_RECIPIENTS=~/.local/share/pa/recipients
 9+# Override recipients file: export PA_RECIPIENTS=~/.local/share/pa/recipients
10 
11 die() {
12     printf '%s: %s.\n' "$(basename "$0")" "$1" >&2
13@@ -13,13 +12,14 @@ die() {
14 age=$(command -v age || command -v rage) ||
15     die "age not found, install per https://age-encryption.org"
16 
17-age_keygen=$(command -v age-keygen || command -v rage-keygen) ||
18-    die "age-keygen not found, install per https://age-encryption.org"
19-
20 # Restrict permissions of any new files to only the current user.
21 umask 077
22 
23 : "${PA_DIR:=${XDG_DATA_HOME:-$HOME/.local/share}/pa}"
24+: "${PA_RECIPIENTS:=$PA_DIR/recipients}"
25+
26+[ -f "$PA_RECIPIENTS" ] ||
27+    die "recipients file '$PA_RECIPIENTS' doesn't exist"
28 
29 realstore=$(realpath "$PA_DIR/passwords") ||
30     die "couldn't get path to password directory"
31@@ -38,15 +38,10 @@ cp -Rp "$realstore" "$tmpdir/passwords" ||
32 # Remove git repository for forward secrecy.
33 rm -rf "$tmpdir/passwords/.git"
34 
35-[ "$PA_IDENTITIES" ] && cp "$PA_IDENTITIES" "$tmpdir/identities"
36-[ "$PA_RECIPIENTS" ] && cp "$PA_RECIPIENTS" "$tmpdir/recipients"
37-
38-$age_keygen >>"$tmpdir/identities" 2>/dev/null
39-$age_keygen -y "$tmpdir/identities" >>"$tmpdir/recipients" 2>/dev/null
40-
41-pa l | while read -r name; do
42+pa l | while IFS= read -r name; do
43+    [ -n "$name" ] || continue
44     pa s "$name" |
45-        $age -R "$tmpdir/recipients" -o "$tmpdir/passwords/$name.age" ||
46+        $age -R "$PA_RECIPIENTS" -o "$tmpdir/passwords/$name.age" ||
47         die "couldn't encrypt $name.age"
48 done
49 
50@@ -56,10 +51,7 @@ rm -rf "$realstore" ||
51     die "couldn't remove password directory"
52 
53 mv "$tmpdir/passwords" "$realstore"
54-mv "$tmpdir/identities" "$(realpath "$PA_DIR/identities")"
55-mv "$tmpdir/recipients" "$(realpath "$PA_DIR/recipients")"
56-rmdir "$tmpdir"
57+rmdir "$tmpdir" 2>/dev/null || :
58 
59 # Recreate git repository if needed.
60 pa l >/dev/null
61-