1#!/bin/sh
 2#
 3# re-encrypt passwords with existing recipients and identities
 4#
 5# This will allow users to add or remove access to their passwords by updating
 6# the recipients file.
 7
 8die() {
 9    printf '%s: %s.\n' "$(basename "$0")" "$1" >&2
10    exit 1
11}
12
13age=$(command -v age || command -v rage) ||
14    die "age not found, install per https://age-encryption.org"
15
16# Restrict permissions of any new files to only the current user.
17umask 077
18
19: "${PA_DIR:=${XDG_DATA_HOME:-$HOME/.local/share}/pa}"
20: "${PA_IDENTITIES:=$PA_DIR/identities}"
21
22passdir=$PA_DIR/passwords
23[ -d "$passdir" ] ||
24    die "password directory '$passdir' doesn't exist"
25
26if [ -n "$PA_RECIPIENTS" ]; then
27    recipients_file=$PA_RECIPIENTS
28elif [ -f "$passdir/recipients" ]; then
29    recipients_file=$passdir/recipients
30elif [ -f "$passdir/.recipients" ]; then
31    recipients_file=$passdir/.recipients
32elif [ -f "$PA_DIR/recipients" ]; then
33    recipients_file=$PA_DIR/recipients
34else
35    recipients_file=$passdir/recipients
36fi
37
38PA_RECIPIENTS=$recipients_file
39
40[ -f "$PA_IDENTITIES" ] ||
41    die "identities file '$PA_IDENTITIES' doesn't exist"
42
43[ -f "$PA_RECIPIENTS" ] ||
44    die "recipients file '$PA_RECIPIENTS' doesn't exist"
45
46cd "$passdir" ||
47    die "couldn't change to password directory"
48
49# Ensure that debug mode is never enabled to
50# prevent the password from leaking.
51set +x
52
53printf 'Using identities: %s\n' "$PA_IDENTITIES"
54printf 'Using recipients: %s\n' "$PA_RECIPIENTS"
55printf 'Re-encrypting passwords in %s...\n' "$passdir"
56
57pa l | while IFS= read -r name; do
58    [ -n "$name" ] || continue
59    printf '  re-encrypting %s\n' "$name"
60    pass=$($age --decrypt -i "$PA_IDENTITIES" "./$name.age") ||
61        die "couldn't decrypt $name.age"
62    printf '%s\n' "$pass" | $age --encrypt -R "$PA_RECIPIENTS" -o "./$name.age" ||
63        die "couldn't encrypt $name.age"
64done || exit 1
65
66printf 'Staging and committing changes to git...\n'
67git add -A || die "couldn't stage files in git"
68git commit -qm "pa-rekey run" || die "couldn't git commit"
69printf 'Created commit: "pa-rekey run"\n'
70
71printf 'Done.\n'
72
73printf '\n===\n'
74printf 'NOTICE: If you are removing keys you might want to wipe git history so those passwords are not still accessible.\n'
75printf '===\n'