[ { "path": ".circleci/config.yml", "content": "#version: 2\n#\n#workflows:\n# version: 2\n# build_and_test:\n# jobs:\n# - debian\n# - ubuntu\n#\n#jobs:\n#\n# debian:\n# docker:\n# - image: debian:9.1\n# steps:\n# - checkout\n# - run:\n# name: 'Installing'\n# command: |\n# apt-get update -y\n# apt-get install -y build-essential expect git gnupg2 pinentry-tty procps rpm ruby-dev libffi-dev\n# gem install fpm\n# - run:\n# name: 'Cleaning'\n# command: |\n# rm -rf ~/.gpnupg\n# make clean\n# - run:\n# name: 'Testing'\n# command: |\n# GPG=gpg2 make test\n# make packages-deb\n# make packages-rpm\n#\n# ubuntu:\n# docker:\n# - image: ubuntu:16.04\n# steps:\n# - checkout\n# - run:\n# name: 'Installing'\n# command: |\n# apt-get update -y\n# apt-get install -y build-essential expect git gnupg2 pinentry-tty procps rpm ruby-dev libffi-dev\n# gem install fpm\n# - run:\n# name: 'Cleaning'\n# command: |\n# rm -rf ~/.gpnupg\n# make clean\n# - run:\n# name: 'Testing'\n# command: |\n# GPG=gpg2 make test\n# make packages-deb\n# make packages-rpm\n" }, { "path": ".gitattributes", "content": "bin/** text eol=lf\ntools/** text eol=lf\nMakefile text eol=lf\nPortfile text eol=lf\nblackbox.plugin.zsh text eol=lf\n" }, { "path": ".github/workflows/build.yml", "content": "name: build\n\non: \n pull_request:\n branches: [ master ]\n push:\n branches: [ master ]\n\njobs:\n\n build:\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repo\n uses: actions/checkout@v2\n with:\n fetch-depth: 0\n - name: Set up Go\n uses: actions/setup-go@v2\n with:\n go-version: ^1.15\n - name: Build binaries\n run: go run build/build.go\n - name: Run unit tests\n run: go test ./...\n - name: Run integration tests\n working-directory: integrationTest\n run: umask 0027 ; rm -rf /tmp/bbhome-* && go test -long -nocleanup\n" }, { "path": ".github/workflows/release.yml", "content": "on:\n release:\n types: [published]\n\nname: release\njobs:\n release:\n name: release\n runs-on: ubuntu-latest\n steps:\n\n - name: Get release\n id: get_release\n uses: bruceadams/get-release@v1.2.2\n env:\n GITHUB_TOKEN: ${{ github.token }}\n\n - name: Checkout repo\n uses: actions/checkout@v2\n with:\n fetch-depth: 0\n\n - name: Set up Go\n uses: actions/setup-go@v2\n with:\n go-version: ^1.15\n\n - name: Build binaries\n run: go run build/build.go\n\n - name: Upload blackbox-Darwin\n uses: actions/upload-release-asset@v1\n env:\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n with:\n upload_url: ${{ steps.get_release.outputs.upload_url }} \n asset_path: ./blackbox-Darwin\n asset_name: blackbox-Darwin\n asset_content_type: application/octet-stream\n\n - name: Upload blackbox-Linux\n uses: actions/upload-release-asset@v1\n env:\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n with:\n upload_url: ${{ steps.get_release.outputs.upload_url }} \n asset_path: ./blackbox-Linux\n asset_name: blackbox-Linux\n asset_content_type: application/octet-stream\n\n - name: Upload blackbox.exe\n uses: actions/upload-release-asset@v1\n env:\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n with:\n upload_url: ${{ steps.get_release.outputs.upload_url }} \n asset_path: ./blackbox.exe\n asset_name: blackbox.exe\n asset_content_type: application/octet-stream\n" }, { "path": ".gitignore", "content": "# Byte-compiled / optimized / DLL files\n__pycache__/\n*.py[cod]\n\n# C extensions\n*.so\n\n# Distribution / packaging\n.Python\nenv/\ndevelop-eggs/\ndist/\neggs/\nlib/\nlib64/\nparts/\nsdist/\nvar/\n*.egg-info/\n.installed.cfg\n*.egg\n\n# Installer logs\npip-log.txt\npip-delete-this-directory.txt\n\n# Unit test / coverage reports\nhtmlcov/\n.tox/\n.coverage\n.cache\nnosetests.xml\ncoverage.xml\n\n# Translations\n*.mo\n\n# Mr Developer\n.mr.developer.cfg\n.project\n.pydevproject\n\n# Rope\n.ropeproject\n\n# Django stuff:\n*.log\n*.pot\n\n# Sphinx documentation\ndocs/_build/\n\n# macOS\n.DS_Store\n\n# Blackbox\nbbintegration\n.*.swp\n/integrationTest/.blackbox\n\n# golang\n/vendor/\n" }, { "path": "AUTHORS", "content": "Tom Limoncelli \n" }, { "path": "CHANGELOG.md", "content": "Release v1.20220610\n\nNOTE: I don't have a lot of time to commit to this project. I'd gladly accept help, especially\nwith improving the testing on various operating systems.\n\nMajor feature: macOS users rejoice! Incompatibility with macOS Monterey 12.3 is fixed! (#347)\n\n* Add .gitattributes during repo initialization (#352)\n* Update zgen reference to zgenom (#350)\n* Improve test data generation (#348)\n* Fix 'chmod' for macOS Monterey 12.3 (#347)\n\n\nRelease v1.20200429\n\nNOTE: While there is now support for NetBSD and SunOS/SmartOS, the\nrelease process only tests on macOS and CentOS7 because that's all I\nhave access to.\n\n* Fix tools that break when \"..\" or \".\" are used in a path (#304)\n* Respect PREFIX variable for copy-install (#294)\n* Documentation: Add pkgsrc install instructions (#292)\n* Improve support for Windows (#291)\n* Clarify gpg version usage (#290)\n* Many documentation fixes\n* DOCUMENTATION: Promote 'getting started' to a section, enumerate steps (#283)\n* Commit changes to gitignore when deregistering (#282)\n* Add support for NetBSD and SunOS (SmartOS)\n* Defend against ShellShock\n\n\nRelease v1.20181219\n\n* New OS support: Add support for NetBSD and SunOS (SmartOS)\n* Testing: Improve confidence test.\n* .blackbox is now the default config directory for new repos. (#272)\n* Add blackbox_decrypt_file (#270)\n* Improved compatibility: change\"/bin/[x]\" to \"/usr/bin/env [x]\" (#265)\n* Add blackbox_less. (#263)\n* add nix method of install (#261)\n* Linked setting up of GPG key (#260)\n\n\nRelease v1.20180618\n\n* Restore `make manual-install` with warning. (#258)\n\nRelease v1.20180615\n\n* Standardize on .blackbox for config. Use keyrings/live for backwards compatibility.\n* Store keys in .blackbox directory (#218)\n* Suggest committing changes to pubring.gpg when running blackbox_removeadmin (#248)\n* Fix typo (#246)\n* Improve installation instructions (#244)\n* Fix replacing-expired-keys link in README (#241)\n* Fix problems when gpg2 is installed next to gpg (#237)\n* Many documentation corrections, updates, etc.\n* Exclude default keyring from import (#223)\n* .gitattributes not always updated (PR#146)\n* Fix bugs related to updating .gitattributes (PR#146)\n* Update readme with CircleCI link (#216)\n* Run the tests on a CI (#215)\n* Fixed Alpine compatibility (chmod) (#212)\n* direct repobase message to stderr (#204)\n* Improve Windows compatibility\n* NEW: .gitattributes Set Unix-only files to eol=lf\n* Silence 'not changed' output during keychain import (#200)\n* Improve FreeBSD compatibility\n* shred_file() outputs warning message to stderr. (#192)\n* Don't complain about GPG_AGENT_INFO if using newer gpg-agent (#189)\n* [FreeBSD] Fix use of chmod (#180)\n* Requiring a file to be entered to finish editing (#175)\n* Remove the key from the keyring when removing an admin (#173)\n* Add FreeBSD support (#172)\n* Add list admins commandline tool. (#170)\nignore backup files and secring.gpg in $BLACKBOXDATA (#169)\nAllow parallel shredding of files (#167)\n* Add/improve Mingw support\n* Make \"make confidence\" less fragile\n* And a lot, lot more.\n\nRelease v1.20170309\n\n* \"make test\" is an alias for \"make confidence\"\n* macOS: make_tempdir must create shorter paths\n* Fix \"make confidence\" for newer version of Git\n* README.md: Add info about our new mailing list\n\nRelease v1.20170611\n\n* confidence_test.sh verifies external tools exist\n* confidence_test.sh more reliable for non-UTF8 users\n* \"make test\" no longer prompts for passwords\n* blackbox works better when target directory lives in root (#194)\n* Add confidence_test.sh tests for admin operations\n* blackbox_list_admins fails (#193)\n* confidence_test.sh works better on FreeBSD\n* tools/confidence_test.sh: now works with gnupg-2.0 and gnupg-2.1\n* Blackbox now officially supports both gnupg-2.0 and gnupg-2.1\n* blackbox_shred_all_files: BUGFIX: Does not shred files with spaces\n* blackbox_removeadmin: disable gpg's confirmation\n* Sync mk_rpm_fpmdir from master\n\nRelease v1.20170127\n\n* Starting CHANGELOG.\n" }, { "path": "DESIGN.md", "content": "BlackBox Internals\n==================\n\nThe goal of the Go rewrite is to improve the usability and\nmaintainability of Blackbox, meanwhile make it easier to implement new \n\nThe system is built in distinct layers: view, controller, model.\n\nSuppose there is a subcommand \"`foo`\". `blackbox.go` parses the\nuser's command line args and calls `cmdFoo()`, which is given\neverything it needs to do the operation. For example, it is given the\nfilenames the user specified exactly; even if an empty list means \"all\nfiles\", at this layer the empty list is passed to the function.\n\n`cmdFoo()` contains the business logic of how the operation should be\ndone: usually iterating over filenames and calling verb(s) for each\none. For example if an empty file list means \"all files\", this is the\nlayer that enumerates the files.\n\n`cmdFoo()` is implemented in the file `cmd_foo.go`. The caller of\n`cmdFoo()` should provide all data it needs to get the job done.\n`cmdFoo()` doesn't refer to global flags, they are passed to the\nfunction as parameters. Therefore the function has zero side-effects\n(except possibly logging) and can be called as library functions by\nother systems. This is the external (binary) API which should be\nrelatively stable.\n\n`cmdFoo()` calls verbs that are in `bbutil/`. Some of those verbs are\nactually interfaces. For example, any VCS-related verbs are actually a\nGo interface which might be implemented one of many ways (Git,\nSubversion, Mercurial), GPG-functions may be implemented by shelling\nout to `gpg.exe` or by using Go's gpg library.\n\nThey layers look like this:\n\n| View | `blackbox.go` | Parses User Commands, calls controller |\n| Controller | `cmd_*.go` | The business logic. Iterates and calls verbs |\n| Model | `pkg/bbutil` | Verbs |\n| Interfaces | `pkg/*` | Interfaces and their implementations |\n\nAt least that's the goal. We'll see how well we can achieve this.\n\n\nVersion 2.0\n===========\n\nSoftware architecture.\n\nWe try to keep the command-line parsing separate from the business\nlogic and all plug-ins. This keeps things clean and easy to refactor.\nIn fact layer 2 could be used as a stand-alone module for projects\nthat want to embed blackbox actions.\n\nLayer 1: The command itself\n\n * cmd/blackbox/blackbox.go -- main() not much more\n * cmd/blackbox/cli.go -- Set up and call the ufave/cli flag parser\n * cmd/blackbox/drive.go -- Check # of arguments, conflicting flags, and then call the businss logic layer\n\nLayer 2: The business logic\n\n * pkg/box/box.go -- The interface to accessing .blackbox (admins, files, etc.)\n * pkg/box/verbs.go -- Verbs called by Layer 1. Just the verbs\n * pkg/box/boxutils.go -- Functions needed by the verbs\n\nLayer 3: The plug-ins\n\n * pkg/vcs/... -- Plug-ins for Git, (Mercurial, Subversion, Perforce,) and None\n * pkg/crypters/... -- Plug-ins for PGP access: GnuPG, (go-openpgp, others in the future)\n\nLayer 4: Support functions for use by Layer 3\n\n * pkg/bbutil/filestats.go -- File manipulations\n * pkg/bbutil/runbash.go -- Safely run external Linux commands\n" }, { "path": "LICENSE.txt", "content": "The MIT License (MIT)\n\nCopyright (c) 2014-2021 Stack Exchange, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n" }, { "path": "Makefile", "content": "SHELL=/bin/sh\nPREFIX?=/usr/local\nPKGNAME=stack_blackbox\nBASEDIR?=$(HOME)\nOUTPUTDIR?=\"$(BASEDIR)/debbuild-${PKGNAME}\"\n\nall:\n\t@echo 'Menu:'\n\t@echo ' make update Update any generated files'\n\t@echo ' make packages-rpm Make RPM packages'\n\t@echo ' make packages-deb Make DEB packages'\n\t@echo ' make symlinks-install Make symlinks in ${PREFIX}/bin/'\n\t@echo ' make copy-install Copy \"bin\" files to ${PREFIX}/bin/'\n\t@echo ' make copy-uninstall Remove blackbox files from ${PREFIX}/bin/'\n\t@echo ' make test Run tests'\n\ninstall:\n\t@echo 'To install, copy the files from bin to somewhere in your PATH.'\n\t@echo 'The README.md document gives more details.'\n\t@echo 'Or run \"make\" (with no options) for more info.'\n\n# The default package type is RPM.\npackages: packages-rpm\n\n#\n# RPM builds\n#\n\n# NOTE: mk_rpm_fpmdir.stack_blackbox.txt is the master list of files. All\n# other packages should generate their list from it.\n\npackages-rpm:\n\tcd tools && PKGRELEASE=\"$${PKGRELEASE}\" PKGDESCRIPTION=\"Safely store secrets in git/hg/svn repos using GPG encryption\" ./mk_rpm_fpmdir stack_blackbox mk_rpm_fpmdir.stack_blackbox.txt\n\npackages-rpm-debug:\n\t@echo BUILD:\n\t@PKGRELEASE=99 make packages\n\t@echo ITEMS TO BE PACKAGED:\n\tfind $(BASEDIR)/rpmbuild-$(PKGNAME)/installroot -type f\n\t@echo ITEMS ACTUALLY IN PACKAGE:\n\t@rpm -qpl $$(cat $(BASEDIR)/rpmbuild-$(PKGNAME)/bin-packages.txt)\n\nlocal-rpm:\n\t@PKGRELEASE=1 make packages\n\t-@sudo rpm -e $(PKGNAME)\n\tsudo rpm -i $$(cat $(BASEDIR)/rpmbuild-$(PKGNAME)/bin-packages.txt)\n\nlock-rpm:\n\tsudo yum versionlock add $(PKGNAME)\n\nunlock-rpm:\n\tsudo yum versionlock clear\n\n#\n# Manual install\n#\nsymlinks-install:\n\t@echo \"Symlinking files from ./bin to ${PREFIX}/bin\"\n\t@cd bin && for f in `find . -type f -iname \"*\" ! -iname \"Makefile\"`; do ln -fs `pwd`/$$f $(PREFIX)/bin/$$f; done\n\t@echo 'Done.'\n\nmanual-install:\n\t@echo '***************************************************************'\n\t@echo '* DEPRECATED *'\n\t@echo '* `make manual-install` is now called `make symlinks-install` *'\n\t@echo '***************************************************************'\n\t$(MAKE) symlinks-install\n\ncopy-install:\n\t@echo \"Copying files from ./bin to ${PREFIX}/bin\"\n\t@cd bin && for f in `find . -type f -iname \"*\" ! -iname \"Makefile\"`; do cp `pwd`/$$f $(PREFIX)/bin/$$f; done\n\t@echo 'Done.'\n\ncopy-uninstall:\n\t@echo \"Removing blackbox files from ${PREFIX}/bin\"\n\t@cd bin && for f in `find . -type f -iname \"*\" ! -iname \"Makefile\"`; do rm $(PREFIX)/bin/$$f; done\n\t@echo 'Done.'\n\n#\n# DEB builds\n#\n\npackages-deb:\ttools/mk_deb_fpmdir.stack_blackbox.txt\n\tcd tools && OUTPUTDIR=$(OUTPUTDIR) PKGRELEASE=\"$${PKGRELEASE}\" PKGDESCRIPTION=\"Safely store secrets in git/hg/svn repos using GPG encryption\" ./mk_deb_fpmdir stack_blackbox mk_deb_fpmdir.stack_blackbox.txt\n\n# Make mk_deb_fpmdir.vcs_blackbox.txt from mk_rpm_fpmdir.stack_blackbox.txt:\ntools/mk_deb_fpmdir.stack_blackbox.txt: tools/mk_rpm_fpmdir.stack_blackbox.txt\n\tsed -e '/^#/d' -e 's@/usr/blackbox/bin/@/usr/bin/@g' -e '/profile.d-usrblackbox.sh/d' $@\n\npackages-deb-debug:\ttools/mk_deb_fpmdir.stack_blackbox.txt\n\t@echo BUILD:\n\t@PKGRELEASE=99 make packages-deb\n\t@echo ITEMS TO BE PACKAGED:\n\tfind ~/debbuild-$(PKGNAME)/installroot -type f\n\t@echo ITEMS ACTUALLY IN PACKAGE:\n\t@dpkg --contents $$(cat $(BASEDIR)/debbuild-$(PKGNAME)/bin-packages.txt)\n\nlocal-deb:\n\t@PKGRELEASE=1 make packages\n\t-@sudo dpkg -e $(PKGNAME)\n\tsudo dpkg -i $$(cat $(BASEDIR)/rpmbuild-$(PKGNAME)/bin-packages.txt)\n\n#\n# MacPorts builds\n#\n# To test:\n# rm -rf /tmp/foo ; mkdir -p /tmp/foo;make packages-macports DESTDIR=/tmp/foo;find /tmp/foo -ls\n\n# Make mk_macports.vcs_blackbox.txt from mk_rpm_fpmdir.stack_blackbox.txt:\ntools/mk_macports.vcs_blackbox.txt: tools/mk_rpm_fpmdir.stack_blackbox.txt\n\tsed -e '/^#/d' -e 's@/usr/blackbox/bin/@bin/@g' -e '/profile.d-usrblackbox.sh/d' $@\n\n# MacPorts expects to run: make packages-macports DESTDIR=${destroot}\npackages-macports: tools/mk_macports.vcs_blackbox.txt\n\tmkdir -p $(DESTDIR)/bin\n\tcd tools && ./mk_macports mk_macports.vcs_blackbox.txt\n\n# stow is a pretty easy way to manage simple local installs on GNU systems\ninstall-stow:\n\tmkdir -p /usr/local/stow/blackbox/bin\n\tcp bin/* /usr/local/stow/blackbox/bin\n\trm /usr/local/stow/blackbox/bin/Makefile\n\tcd /usr/local/stow; stow -R blackbox\nuninstall-stow:\n\tcd /usr/local/stow; stow -D blackbox\n\trm -rf /usr/local/stow/blackbox\n\n# Add other package types here.\n\n#\n# Updates\n#\nupdate: tools/mk_deb_fpmdir.stack_blackbox.txt tools/mk_macports.vcs_blackbox.txt\n\nclean:\n\trm -f tools/mk_deb_fpmdir.stack_blackbox.txt tools/mk_macports.vcs_blackbox.txt\n\n#\n# System Test:\n#\ntest: confidence\nconfidence:\n\t@if [ -e ~/.gnupg ]; then echo ERROR: '~/.gnupg should not exist. If it does, bugs may polute your .gnupg configuration. If the code has no bugs everything will be fine. Do you feel lucky?'; false ; fi\n\t@if which >/dev/null gpg-agent ; then pkill gpg-agent ; rm -rf /tmp/tmp.* ; fi\n\t@export PATH=\"$(PWD)/bin:$(PREFIX)/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/local/bin:/usr/local/MacGPG2/bin:/opt/homebrew/bin:$(PATH)\" ; tools/auto_system_test\n\t@if which >/dev/null gpg-agent ; then pkill gpg-agent ; fi\n\t@if [ -e ~/.gnupg ]; then echo ERROR: '~/.gnupg was created which means the scripts might be poluting GnuPG configuration. Fix this bug.'; false ; fi\n" }, { "path": "README-v2.md", "content": "BlackBox v2\n===========\n\nWARNING: v2 is still experimental. It is in the same git repo as v1\nbecause the filenames do not overlap. Please do not mix the two. v1\nis in `bin`. v2 is in `cmd/blackbox` and `binv2`.\n\nBlackbox is an open source tool that enables you to safe store sensitive information in\nGit (or other) repos by encrypting them with GPG. Only the encrypted\nversion of the file is available. You can be free to provide access\nto the repo, as but only people with the right GPG keys can access the\nencrypted data.\n\nThings you should **never** store in a repo without encryption:\n\n* TLS (SSL) certificates\n* Passwords\n* API keys\n* And more!\n\nProject Info:\n\n* [Overview](user-overview.md)\n* [Why is this important?](why-is-this-important.md)\n* [Support/Community](support.md)\n* [How BB encrypts](encryption.md)\n* [OS Compatibility](compatibility.md)\n* [Installation Instructions](installation.md)\n* [Alternatives](alternatives.md)\n\nUser Info:\n\n* [Enabling Blackbox on a Repo](enable-repo.md)\n* [Enroll a file](enable-repo.md)\n* [Full Command List](full-command-list.md)\n* [Add/Remove users](admin-ops.md)\n* [Add/Remove files](file-ops.md)\n* [Advanced techiques](advanced.md)\n* [Use with Role Accounts](role-accounts.md)\n* [Backwards Compatibility](backwards-compatibility.md)\n* [Replacing expired keys](expired-keys.md)\n* [Git Tips](git-tips.md)\n* [SubVersion Tips](subversion-tips.md)\n* [GnuPG tips](gnupg-tips.md)\n* [Use with Ansible](with-ansible.md)\n* [Use with Puppet](with-puppet.md)\n\nFor contributors:\n\n* [Developer Info](dev.md)\n* [Code overview](dev-code-overview.md)\n* [HOWTO: Add new OS support](dev-add-os-support.md)\n* [HOWTO: Add new VCS support](dev-add-vcs-support.md)\n\n\nA slide presentation about an older release [is on SlideShare](http://www.slideshare.net/TomLimoncelli/the-blackbox-project-sfae).\n\nJoin our mailing list: [https://groups.google.com/d/forum/blackbox-project](https://groups.google.com/d/forum/blackbox-project)\n\n\nLicense\n=======\n\nThis content is released under the MIT License.\nSee the [LICENSE.txt](LICENSE.txt) file.\n" }, { "path": "README.md", "content": "BlackBox [![CircleCI](https://circleci.com/gh/StackExchange/blackbox.svg?style=shield)](https://circleci.com/gh/StackExchange/workflows/blackbox) [![Build Status](https://github.com/StackExchange/blackbox/workflows/build/badge.svg)](https://github.com/StackExchange/blackbox/actions?query=workflow%3Abuild+branch%3Amaster)\n========\n\nTHIS PROJECT IS ABANDONED. DO NOT USE. DO NOT SUBMIT BUG REPORTS OR PRs.\n\nThere are plenty of other, better, projects. A partial list is listed under \"Alternatives\" below.\n\n========\n\nSafely store secrets in a VCS repo (i.e. Git, Mercurial, Subversion or Perforce). These commands make it easy for you to Gnu Privacy Guard (GPG) encrypt specific files in a repo so they are \"encrypted at rest\" in your repository. However, the scripts make it easy to decrypt them when you need to view or edit them, and decrypt them for use in production. Originally written for Puppet, BlackBox now works with any Git or Mercurial repository.\n\n\nWARNING: The goal of this project is to be a simple wrapper around `gpg` so you and your coworkers don't have to remember its all those inscrutable and confusing flags. It is *not* intended to be a sophisticated encryption system that solves all problems or supports a large numbers of files. The ideal use-case is to keep secrets in a secure service such as Conjur, AWS KMS, Azure Key Vault or GCP KMS; then use Blackbox for safely storing the API keys needed to access that system. That way you are encrypting a single, tiny, file. Feature-requests for anything more will be rejected; do not expect or even request \"enterprise features\". If this disappoints you, please consider a competiting project such as https://www.agwa.name/projects/git-crypt\n\nA slide presentation (about an older release) [is on SlideShare](http://www.slideshare.net/TomLimoncelli/the-blackbox-project-sfae).\n\nJoin our mailing list: [https://groups.google.com/d/forum/blackbox-project](https://groups.google.com/d/forum/blackbox-project)\n\n## What blackbox is NOT:\n\n\nTable of Contents\n=================\n\n- [BlackBox](#blackbox)\n- [Table of Contents](#table-of-contents)\n- [Overview](#overview)\n- [Why is this important?](#why-is-this-important)\n- [Installation Instructions](#installation-instructions)\n- [Commands](#commands)\n- [Compatibility](#compatibility)\n- [How is the encryption done?](#how-is-the-encryption-done)\n- [What does this look like to the typical user?](#what-does-this-look-like-to-the-typical-user)\n- Configuration Management\n - [How to use the secrets with Ansible?](#how-to-use-the-secrets-with-ansible)\n - [How to use the secrets with Puppet?](#how-to-use-the-secrets-with-puppet)\n - [Entire files](#entire-files)\n - [Small strings](#small-strings)\n- File Management\n - [How to enroll a new file into the system?](#how-to-enroll-a-new-file-into-the-system)\n - [How to remove a file from the system?](#how-to-remove-a-file-from-the-system)\n- User Management\n - [How to indoctrinate a new user into the system?](#how-to-indoctrinate-a-new-user-into-the-system)\n - [How to remove a user from the system?](#how-to-remove-a-user-from-the-system)\n - [Note to the Web Of Trust](#note-to-the-web-of-trust)\n- Repo Management\n - [Enabling BlackBox For a Repo](#enabling-blackbox-for-a-repo)\n- [Set up automated users or “role accounts”](#set-up-automated-users-or-role-accounts)\n- [Replacing expired keys](#replacing-expired-keys)\n- [Some common errors](#some-common-errors)\n- [Using BlackBox on Windows](#using-blackbox-on-windows)\n- [Using BlackBox without a repo](#using-blackbox-without-a-repo)\n- [Some Subversion gotchas](#some-subversion-gotchas)\n- [Using Blackbox when gpg2 is installed next to gpg](#using-blackbox-when-gpg2-is-installed-next-to-gpg)\n- [How to submit bugs or ask questions?](#how-to-submit-bugs-or-ask-questions)\n- [Developer Info](#developer-info)\n- [Alternatives](#alternatives)\n- [License](#license)\n\nOverview\n========\n\nSuppose you have a VCS repository (i.e. a Git or Mercurial repo) and certain files contain secrets such as passwords or SSL private keys. Often people just store such files \"and hope that nobody finds them in the repo\". That's not safe.\n\nWith BlackBox, those files are stored encrypted using GPG. Access to the VCS repo without also having the right GPG keys makes it worthless to have the files. As long as you keep your GPG keys safe, you don't have to worry about storing your VCS repo on an untrusted server. Heck, even if you trust your server, now you don't have to trust the people that do backups of that server, or the people that handle the backup tapes!\n\nRather than one GPG passphrase for all the files, each person with access has their own GPG keys in the system. Any file can be decrypted by anyone with their GPG key. This way, if one person leaves the company, you don't have to communicate a new password to everyone with access. Simply disable the one key that should no longer have access. The process for doing this is as easy as running 2 commands (1 to disable their key, 1 to re-encrypt all files.)\n\nAutomated processes often need access to all the decrypted files. This is easy too. For example, suppose Git is being used for Puppet files. The master needs access to the decrypted version of all the files. Simply set up a GPG key for the Puppet master (or the role account that pushes new files to the Puppet master) and have that user run `blackbox_postdeploy` after any files are updated.\n\nGetting started\n---------------\n\n1. If you don't have a GPG key, set it up using instructions such as:\n[Set up GPG key](https://help.github.com/articles/generating-a-new-gpg-key/). \\\nNow you are ready to go.\n\n1. `cd` into a Git, Mercurial, Subversion or Perforce repository and run `blackbox_initialize`.\n\n1. If a file is to be encrypted, run `blackbox_register_new_file` and you are done.\n\n1. Add and remove keys with `blackbox_addadmin` and `blackbox_removeadmin`.\n\n1. To view and/or edit a file, run `blackbox_edit`;\nthis will decrypt the file and open with whatever is specified by\nyour $EDITOR environment variable. \\\nWhen you close the editor the\nfile will automatically be encrypted again and the temporary plaintext\nfile will be shredded. \\\nIf you need to leave the file decrypted while\nyou update you can use the`blackbox_edit_start` to decrypt the file\nand `blackbox_edit_end` when you want to \"put it back in the box.\"\n\nWhy is this important?\n======================\n\nOBVIOUSLY we don't want secret things like SSL private keys and passwords to be leaked.\n\nNOT SO OBVIOUSLY when we store \"secrets\" in a VCS repo like Git or Mercurial, suddenly we are less able to share our code with other people. Communication between subteams of an organization is hurt. You can't collaborate as well. Either you find yourself emailing individual files around (yuck!), making a special repo with just the files needed by your collaborators (yuck!!), or just deciding that collaboration isn't worth all that effort (yuck!!!).\n\nThe ability to be open and transparent about our code, with the exception of a few specific files, is key to the kind of collaboration that DevOps and modern IT practitioners need to do.\n\nInstallation Instructions\n=========================\n\n- *The hard way (manual)*: Copy all the files in \"bin\" to your \"bin\".\n- *The hard way (automatic)*: `make copy-install` will copy the bin files into $PREFIX/bin, default is /usr/local (uninstall with `make copy-uninstall`).\n- *The symlinks way*: `make symlinks-install` will make symlinks of the bin files into $PREFIX/bin, default is /usr/local (uninstall with `make copy-uninstall`) (useful when doing development)\n- *The MacPorts Way*: `sudo port install vcs_blackbox`\n- *The Homebrew Way*: `brew install blackbox`\n- *The RPM way*: Check out the repo and make an RPM via `make packages-rpm`; now you can distribute the RPM via local methods. (Requires [fpm](https://github.com/jordansissel/fpm).)\n- *The Debian/Ubuntu way*: Check out the repo and make a DEB via `make packages-deb`; now you can distribute the DEB via local methods. (Requires [fpm](https://github.com/jordansissel/fpm).)\n- *The Antigen Way*: Add `antigen bundle StackExchange/blackbox` to your .zshrc\n- *The Zgenom Way*: Add `zgenom load StackExchange/blackbox` to your .zshrc where you're loading your other plugins.\n- *The Nix Way*: `nix-shell -p blackbox`\n- *The Pkgsrc Way*: `pkgin in scm-blackbox`\n\nCommands\n========\n\n| Name: | Description: |\n|-------------------------------------|-------------------------------------------------------------------------|\n| `blackbox_edit ` | Decrypt, run $EDITOR, re-encrypt a file |\n| `blackbox_edit_start ` | Decrypt a file so it can be updated |\n| `blackbox_edit_end ` | Encrypt a file after blackbox_edit_start was used |\n| `blackbox_cat ` | Decrypt and view the contents of a file |\n| `blackbox_view ` | Like blackbox_cat but pipes to `less` or $PAGER |\n| `blackbox_diff` | Diff decrypted files against their original crypted version |\n| `blackbox_initialize` | Enable blackbox for a GIT or HG repo |\n| `blackbox_register_new_file ` | Encrypt a file for the first time |\n| `blackbox_deregister_file ` | Remove a file from blackbox |\n| `blackbox_list_files` | List the files maintained by blackbox |\n| `blackbox_list_admins` | List admins currently authorized for blackbox |\n| `blackbox_decrypt_file ` | Decrypt a file |\n| `blackbox_decrypt_all_files` | Decrypt all managed files (INTERACTIVE) |\n| `blackbox_postdeploy` | Decrypt all managed files (batch) |\n| `blackbox_addadmin ` | Add someone to the list of people that can encrypt/decrypt secrets |\n| `blackbox_removeadmin ` | Remove someone from the list of people that can encrypt/decrypt secrets |\n| `blackbox_shred_all_files` | Safely delete any decrypted files |\n| `blackbox_update_all_files` | Decrypt then re-encrypt all files. Useful after keys are changed |\n| `blackbox_whatsnew ` | show what has changed in the last commit for a given file |\n\nCompatibility\n=============\n\nBlackBox automatically determines which VCS you are using and does the right thing. It has a plug-in architecture to make it easy to extend to work with other systems. It has been tested to work with many operating systems.\n\n- Version Control systems\n - `git` -- The Git\n - `hg` -- Mercurial\n - `svn` -- SubVersion (Thanks, Ben Drasin!)\n - `p4` -- Perforce\n - none -- The files can be decrypted outside of a repo if the `.blackbox` directory is intact\n- Operating system\n - CentOS / RedHat\n - MacOS X\n - Cygwin (Thanks, Ben Drasin!) **See Note Below**\n - MinGW (git bash on windows) **See Note Below**\n - NetBSD\n - SmartOS\n\nTo add or fix support for a VCS system, look for code at the end of `bin/_blackbox_common.sh`\n\nTo add or fix support for a new operating system, look for the case statements in `bin/_blackbox_common.sh` and `bin/_stack_lib.sh` and maybe `tools/confidence_test.sh`\n\nUsing BlackBox on Windows\n=========================\n\nBlackBox can be used with Cygwin, MinGW or WSL2.\n\n### Protect the line endings\n\nBlackBox assumes that `blackbox-admins.txt` and `blackbox-files.txt` will have\nLF line endings. Windows users should be careful to configure Git or other systems\nto not convert or \"fix\" those files.\n\nIf you use Git, add the following lines to your `.gitattributes` file:\n\n **/blackbox-admins.txt text eol=lf\n **/blackbox-files.txt text eol=lf\n\nThe latest version of `blackbox_initialize` will create a `.gitattributes` file in the `$BLACKBOXDATA`\ndirectory (usually `.blackbox`) for you.\n\n### Cygwin\n\nCygwin support requires the following packages:\n\nNormal operation:\n\n- gnupg\n- git or mercurial or subversion or perforce (as appropriate)\n\nDevelopment (if you will be adding code and want to run the confidence test)\n\n- procps\n- make\n- git (the confidence test currently only tests git)\n\n### MinGW\n\nMinGW (comes with Git for Windows) support requires the following:\n\nNormal operation:\n\n- [Git for Windows](https://git-scm.com/) (not tested with Mercurial)\n - Git Bash MINTTY returns a MinGW console. So when you install make sure you pick `MINTTY` instead of windows console. You'll be executing blackbox from the Git Bash prompt.\n - You need at least version 2.8.1 of Git for Windows.\n- [GnuWin32](https://sourceforge.net/projects/getgnuwin32/files/) - needed for various tools not least of which is mktemp which is used by blackbox\n - after downloading the install just provides you with some batch files. Because of prior issues at sourceforge and to make sure you get the latest version of each package the batch files handle the brunt of the work of getting the correct packages and installing them for you.\n - from a **windows command prompt** run `download.bat` once it has completed run `install.bat` then add the path for those tools to your PATH (ex: `PATH=%PATH%;c:\\GnuWin32\\bin`)\n\nDevelopment:\n\n- unknown (if you develop Blackbox under MinGW, please let us know if any additional packages are required to run `make test`)\n\n### WSL2\n\nIf you get the following error in WSL2, you can try to setup your environment with the following instructions (Tested with Ubuntu 22.04 on WSL2):\n\n- Install [Gpg4win](https://www.gpg4win.org/) (Tested with version 4.1.0)\n- Import your private key in Gpg4win (you can use Kleopatra on your Windows host if you wish).\n- Edit the file `~/.gnupg/gpg-agent.conf` on WSL and add the following line: `pinentry-program \"/mnt/c/Program Files (x86)/GnuPG/bin/pinentry-basic.exe\"`\n- Restart gpg agent on your linux system: `gpg-connect-agent reloadagent /bye`\n\nHow is the encryption done?\n===========================\n\nGPG has many different ways to encrypt a file. BlackBox uses the mode that lets you specify a list of keys that can decrypt the message.\n\nIf you have 5 people (\"admins\") that should be able to access the secrets, each creates a GPG key and adds their public key to the keychain. The GPG command used to encrypt the file lists all 5 key names, and therefore any 1 key can decrypt the file.\n\nTo remove someone's access, remove that admin's key name (i.e. email address) from the list of admins and re-encrypt all the files. They can still read the .gpg file (assuming they have access to the repository) but they can't decrypt it any more.\n\n*What if they kept a copy of the old repo before you removed access?* Yes, they can decrypt old versions of the file. This is why when an admin leaves the team, you should change all your passwords, SSL certs, and so on. You should have been doing that before BlackBox, right?\n\n*Why don't you use symmetric keys?* In other words, why mess with all this GPG key stuff and instead why don't we just encrypt all the files with a single passphrase. Yes, GPG supports that, but then we are managing a shared password, which is fraught with problems. If someone \"leaves the team\" we would have to communicate to everyone a new password. Now we just have to remove their key. This scales better.\n\n*How do automated processes decrypt without asking for a password?* GPG requires a passphrase on a private key. However, it permits the creation of subkeys that have no passphrase. For automated processes, create a subkey that is only stored on the machine that needs to decrypt the files. For example, at Stack Exchange, when our Continuous Integration (CI) system pushes a code change to our Puppet masters, they run `blackbox_postdeploy` to decrypt all the files. The user that runs this code has a subkey that doesn't require a passphrase. Since we have many masters, each has its own key. And, yes, this means our Puppet Masters have to be very secure. However, they were already secure because, like, dude... if you can break into someone's puppet master you own their network.\n\n*If you use Puppet, why didn't you just use hiera-eyaml?* There are 4 reasons:\n\n1. This works with any Git or Mercurial repo, even if you aren't using Puppet.\n2. hiera-eyaml decrypts \"on demand\" which means your Puppet Master now uses a lot of CPU to decrypt keys every time it is contacted. It slows down your master, which, in my case, is already slow enough.\n3. This works with binary files, without having to ASCIIify them and paste them into a YAML file. Have you tried to do this with a cert that is 10K long and changes every few weeks? Ick.\n4. hiera-eyaml didn't exist when I wrote this.\n\nWhat does this look like to the typical user?\n=============================================\n\n- If you need to, start the GPG Agent: `eval $(gpg-agent --daemon)`\n- Decrypt the file so it is editable: `blackbox_edit_start FILENAME`\n- (You will need to enter your GPG passphrase.)\n- Edit FILENAME as you desire: `vim FILENAME`\n- Re-encrypt the file: `blackbox_edit_end FILENAME`\n- Commit the changes. `git commit -a` or `hg commit`\n\nWait... it can be even easier than that! Run `blackbox_edit FILENAME`, and it'll decrypt the file in a temp file and call `$EDITOR` on it, re-encrypting again after the editor is closed.\n\nHow to use the secrets with Ansible?\n===================================\n\nAnsible Vault provides functionality for encrypting both entire files and strings stored within files; however,\nkeeping track of the password(s) required for decryption is not handled by this module.\n\nInstead one must specify a password file when running the playbook.\n\nAnsible example for password file: `my_secret_password.txt.gpg`\n\n```\nansible-playbook --vault-password-file my_secret_password.txt site.yml\n```\n\nAlternatively, one can specify this in the `ANSIBLE_VAULT_PASSWORD_FILE` environment variable.\n\nHow to use the secrets with Puppet?\n===================================\n\n### Entire files:\n\nEntire files, such as SSL certs and private keys, are treated just like regular files. You decrypt them any time you push a new release to the puppet master.\n\nPuppet example for an encrypted file: `secret_file.key.gpg`\n\n```\nfile { '/etc/my_little_secret.key':\n ensure => 'file',\n owner => 'root',\n group => 'puppet',\n mode => '0760',\n source => \"puppet:///modules/${module_name}/secret_file.key\",\n}\n```\n\n### Small strings:\n\nSmall strings, such as passwords and API keys, are stored in a hiera yaml file, which you encrypt with `blackbox_register_new_file`. For example, we use a file called `blackbox.yaml`. You can access them using the hiera() function.\n\n*Setup:* Configure `hiera.yaml` by adding \"blackbox\" to the search hierarchy:\n\n```\n:hierarchy:\n - ...\n - blackbox\n - ...\n```\n\nIn blackbox.yaml specify:\n\n```\n---\nmodule::test_password: \"my secret password\"\n```\n\nIn your Puppet Code, access the password as you would any hiera data:\n\n```\n$the_password = hiera('module::test_password', 'fail')\n\nfile {'/tmp/debug-blackbox.txt':\n content => $the_password,\n owner => 'root',\n group => 'root',\n mode => '0600',\n}\n```\n\nThe variable `$the_password` will contain \"my secret password\" and can be used anywhere strings are used.\n\nHow to enroll a new file into the system?\n=========================================\n\n- If you need to, start the GPG Agent: `eval $(gpg-agent --daemon)`\n- Add the file to the system:\n\n```\nblackbox_register_new_file path/to/file.name.key\n```\n\nMultiple file names can be specified on the command line:\n\nExample 1: Register 2 files:\n\n```\nblackbox_register_new_file file1.txt file2.txt\n```\n\nExample 2: Register all the files in `$DIR`:\n\n```\nfind $DIR -type f -not -name '*.gpg' -print0 | xargs -0 blackbox_register_new_file\n```\n\nHow to remove a file from the system?\n=====================================\n\nThis happens quite rarely, but we've got it covered:\n\n```\nblackbox_deregister_file path/to/file.name.key\n```\n\nHow to indoctrinate a new user into the system?\n===============================================\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\n`.blackbox/blackbox-admins.txt` is a file that lists which users are able to decrypt files. (More pedantically, it is a list of the GnuPG key names that the file is encrypted for.)\n\nTo join the list of people that can edit the file requires three steps; You create a GPG key and add it to the key ring. Then, someone that already has access adds you to the system. Lastly, you should test your access.\n\n### Step 1: NEW USER creates a GPG key pair on a secure machine and adds to public keychain.\n\nIf you don't already have a GPG key, here's how to generate one:\n\n```\ngpg --gen-key\n```\n\nWARNING: New versions of GPG generate keys which are not understood by\nold versions of GPG. If you generate a key with a new version of GPG,\nthis will cause problems for users of older versions of GPG.\nTherefore it is recommended that you either assure that everyone using\nBlackbox have the exact same version of GPG, or generate GPG keys\nusing a version of GPG as old as the oldest version of GPG used by\neveryone using Blackbox.\n\nPick defaults for encryption settings, 0 expiration. Pick a VERY GOOD passphrase. Store a backup of the private key someplace secure. For example, keep the backup copy on a USB drive that is locked in safe. Or, at least put it on a secure machine with little or no internet access, full-disk-encryption, etc. Your employer probably has rules about how to store such things.\n\nFYI: If generating the key is slow, this is usually because the system\nisn't generating enough entropy. Tip: Open another window on that\nmachine and run this command: `ls -R /`\n\nNow that you have a GPG key, add yourself as an admin:\n\n```\nblackbox_addadmin KEYNAME\n```\n\n...where \"KEYNAME\" is the email address listed in the gpg key you created previously. For example:\n\n```\nblackbox_addadmin tal@example.com\n```\n\nWhen the command completes successfully, instructions on how to commit these changes will be output. Run the command as given to commit the changes. It will look like this:\n\n```\ngit commit -m'NEW ADMIN: tal@example.com' .blackbox/pubring.gpg .blackbox/trustdb.gpg .blackbox/blackbox-admins.txt\n```\n\nThen push it to the repo:\n\n```\ngit push\n\nor\n\nht push\n\n(or whatever is appropriate)\n```\n\nNOTE: Creating a Role Account? If you are adding the pubring.gpg of a role account, you can specify the directory where the pubring.gpg file can be found as a 2nd parameter: `blackbox_addadmin puppetmaster@puppet-master-1.example.com /path/to/the/dir`\n\n### Step 2: EXISTING ADMIN adds new user to the system.\n\nAsk someone that already has access to re-encrypt the data files. This gives you access. They simply decrypt and re-encrypt the data without making any changes.\n\nPre-check: Verify the new keys look good.\n\n```\ngit pull # Or whatever is required for your system\ngpg --homedir=.blackbox --list-keys\n```\n\nFor example, examine the key name (email address) to make sure it conforms to corporate standards.\n\nImport the keychain into your personal keychain and reencrypt:\n\n```\ngpg --import .blackbox/pubring.gpg\nblackbox_update_all_files\n```\n\nPush the re-encrypted files:\n\n```\ngit commit -a\ngit push\n\nor\n\nhg commit\nhg push\n```\n\n### Step 3: NEW USER tests.\n\nMake sure you can decrypt a file. (Suggestion: Keep a dummy file in VCS just for new people to practice on.)\n\nHow to remove a user from the system?\n=====================================\n\nSimply run `blackbox_removeadmin` with their keyname then re-encrypt:\n\nExample:\n\n```\nblackbox_removeadmin olduser@example.com\nblackbox_update_all_files\n```\n\nWhen the command completes, you will be given a reminder to check in the change and push it.\n\nNote that their keys will still be in the key ring, but they will go unused. If you'd like to clean up the keyring, use the normal GPG commands and check in the file.\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\n```\ngpg --homedir=.blackbox --list-keys\ngpg --homedir=.blackbox --delete-key olduser@example.com\ngit commit -m'Cleaned olduser@example.com from keyring' .blackbox/*\n```\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\nThe key ring only has public keys. There are no secret keys to delete.\n\nRemember that this person did have access to all the secrets at one time. They could have made a copy. Therefore, to be completely secure, you should change all passwords, generate new SSL keys, and so on just like when anyone that had privileged access leaves an organization.\n\nNote to the Web Of Trust\n========================\n\nValidating the trustworthiness of keys is a task that can't be accomplished by Blackbox; this is a completely external topic that has to be dealt with manually (the same way as generating/managing your key is, for example) or by a dedicated mechanism (a company CA with corresponding workflows e.g.). Aside from the \"common\" benefits of a Web Of Trust (see [here](https://www.gnupg.org/gph/en/manual/x334.html) or [here](https://www.gnupg.org/gph/en/manual/x547.html) e.g.), it prevents several errors as well.\n\nHistorically Blackbox was using and enforcing a \"trust every key\" model but this has changed! Now the decision of whether and how to use the PGP/GPG trust models is left up to the user by configuration (or by the PGP/GPG defaults). \nWhen updating Blackbox people might run into functional problems if they haven't yet dealt with the trustability of the keys they're using. It's the right time to do so and built up your Web Of Trust now!\n\nIf you have an external workflow in place that ensures the integrity of the keys Blackbox uses you might want to disable the PGP/GPG trust models and rely on this workflow. \nThis can be achieved by declaring \"trust model always\", either by passing the command line parameter `--trust-model=always` to your PGP/GPG binary when using Blackbox (by defining an alias or using the environment variable (e.g. `GPG=\"gpg2 --trust-model=always\"`) or a combination of both) or by setting `trust-model always` in your `gpg.conf` (note that this disables the Web Of Trust everywhere, not just for Blackbox).\n\nWARNING: It is strongly disadvised to not use any key validation at all! This opens up various ways to bypass the confidentiality of your encrypted secrets!\n\nWhere is the configuration stored? .blackbox vs. keyrings/live\n==============================================================\n\nBlackbox stores its configuration data in the `.blackbox` subdirectory. Older\nrepos use `keyrings/live`. For backwards compatibility either will work.\n\nAll documentation refers to `.blackbox`.\n\nYou can convert an old repo by simply renaming the directory:\n\n```\nmv keyrings/live .blackbox\nrmdir keyrings\n```\n\nThere is no technical reason to convert old repos except that it is less\nconfusing to users.\n\nThis change was made in commit 60e782a0, release v1.20180615.\n\nThe details:\n\n- First Blackbox checks `$BLACKBOXDATA`. If this environment variable is set, this is the directory that will be used. If it lists a directory that does not exist, Blackbox will print an error and exit.\n- If `$BLACKBOXDATA` is not set: (which is the typical use case)\n - Blackbox will first try `keyrings/live` and use it if it exists.\n - Otherwise the default `.blackbox` will be used. If `.blackbox` does not exist, Blackbox will print an error and exit.\n\n\nEnabling BlackBox For a Repo\n============================\n\nOverview:\n\nTo add \"blackbox\" to a git or mercurial repo, you'll need to do the following:\n\n1. Run the initialize script. This adds a few files to your repo in a directory called \".blackbox\".\n2. For the first user, create a GPG key and add it to the key ring.\n3. Encrypt the files you want to be \"secret\".\n4. For any automated user (one that must be able to decrypt without a passphrase), create a GPG key and create a subkey with an empty passphrase.\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\n### Run the initialize script.\n\nYou'll want to include blackbox's \"bin\" directory in your PATH:\n\n```\nexport PATH=$PATH:/the/path/to/blackbox/bin\nblackbox_initialize\n```\n\nIf you're using antigen, adding `antigen bundle StackExchange/blackbox` to your .zshrc will download this repository and add it to your $PATH.\n\n### For the first user, create a GPG key and add it to the key ring.\n\nFollow the instructions for \"[How to indoctrinate a new user into the system?](#how-to-indoctrinate-a-new-user-into-the-system)\". Only do Step 1.\n\nOnce that is done, is a good idea to test the system by making sure a file can be added to the system (see \"How to enroll a new file into the system?\"), and a different user can decrypt the file.\n\nMake a new file and register it:\n\n```\nrm -f foo.txt.gpg foo.txt\necho This is a test. >foo.txt\nblackbox_register_new_file foo.txt\n```\n\nDecrypt it:\n\n```\nblackbox_edit_start foo.txt.gpg\ncat foo.txt\necho This is the new file contents. >foo.txt\n```\n\nRe-encrypt it:\n\n```\nblackbox_edit_end foo.txt.gpg\nls -l foo.txt*\n```\n\nYou should only see `foo.txt.gpg` as `foo.txt` should be gone.\n\nThe next step is to commit `foo.txt.gpg` and make sure another user can check out, view, and change the contents of the file. That is left as an exercise for the reader. If you are feel like taking a risk, don't commit `foo.txt.gpg` and delete it instead.\n\nSet up automated users or \"role accounts\"\n=========================================\n\ni.e. This is how a Puppet Master can have access to the unencrypted data.\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\nAn automated user (a \"role account\") is one that that must be able to decrypt without a passphrase. In general you'll want to do this for the user that pulls the files from the repo to the master. This may be automated with Jenkins CI or other CI system.\n\nGPG keys have to have a passphrase. However, passphrases are optional on subkeys. Therefore, we will create a key with a passphrase then create a subkey without a passphrase. Since the subkey is very powerful, it should be created on a very secure machine.\n\nThere's another catch. The role account probably can't check files into Git/Mercurial. It probably only has read-only access to the repo. That's a good security policy. This means that the role account can't be used to upload the subkey public bits into the repo.\n\nTherefore, we will create the key/subkey on a secure machine as yourself. From there we can commit the public portions into the repo. Also from this account we will export the parts that the role account needs, copy them to where the role account can access them, and import them as the role account.\n\nProTip: If asked to generate entropy, consider running this on the same machine in another window: `sudo dd if=/dev/sda of=/dev/null`\n\nFor the rest of this doc, you'll need to make the following substitutions:\n\n- ROLEUSER: svc_deployacct or whatever your role account's name is.\n- NEWMASTER: the machine this role account exists on.\n- SECUREHOST: The machine you use to create the keys.\n\nNOTE: This should be more automated/scripted. Patches welcome.\n\nOn SECUREHOST, create the puppet master's keys:\n\n```\n$ mkdir /tmp/NEWMASTER\n$ cd /tmp/NEWMASTER\n$ gpg --homedir . --gen-key\nYour selection?\n (1) RSA and RSA (default)\nWhat keysize do you want? (2048) DEFAULT\nKey is valid for? (0) DEFAULT\n\n# Real name: Puppet CI Deploy Account\n# Email address: svc_deployacct@hostname.domain.name\n```\n\nNOTE: Rather than a real email address, use the username@FQDN of the host the key will be used on. If you use this role account on many machines, each should have its own key. By using the FQDN of the host, you will be able to know which key is which. In this doc, we'll refer to username@FQDN as $KEYNAME\n\nSave the passphrase somewhere safe!\n\nCreate a sub-key that has no password:\n\n```\n$ gpg --homedir . --edit-key svc_deployacct\ngpg> addkey\n(enter passphrase)\n Please select what kind of key you want:\n (3) DSA (sign only)\n (4) RSA (sign only)\n (5) Elgamal (encrypt only)\n (6) RSA (encrypt only)\nYour selection? 6\nWhat keysize do you want? (2048)\nKey is valid for? (0)\nCommand> key 2\n(the new subkey has a \"*\" next to it)\nCommand> passwd\n(enter the main key's passphrase)\n(enter an empty passphrase for the subkey... confirm you want to do this)\nCommand> save\n```\n\nNow securely export this directory to NEWMASTER:\n\n```\ngpg --homedir . --export -a svc_sadeploy >/tmp/NEWMASTER/pubkey.txt\ntar cvf /tmp/keys.tar .\nrsync -avP /tmp/keys.tar NEWMASTER:/tmp/.\n```\n\nOn NEWMASTER, receive the new GnuPG config:\n\n```\nsudo -u svc_deployacct bash\nmkdir -m 0700 -p ~/.gnupg\ncd ~/.gnupg && tar xpvf /tmp/keys.tar\n```\n\n\n\nBack on SECUREHOST, add the new email address to .blackbox/blackbox-admins.txt:\n\n```\ncd /path/to/the/repo\nblackbox_addadmin $KEYNAME /tmp/NEWMASTER\n```\n\nVerify that secring.gpg is a zero-length file. If it isn't, you have somehow added a private key to the keyring. Start over.\n\n```\ncd .blackbox\nls -l secring.gpg\n```\n\nCommit the recent changes:\n\n```\ncd .blackbox\ngit commit -m\"Adding key for KEYNAME\" pubring.gpg trustdb.gpg blackbox-admins.txt\n```\n\nRegenerate all encrypted files with the new key:\n\n```\nblackbox_update_all_files\ngit status\ngit commit -m\"updated encryption\" -a\ngit push\n```\n\nOn NEWMASTER, import the keys and decrypt the files:\n\n```\nsudo -u svc_sadeploy bash # Become the role account.\ngpg --import /etc/puppet/.blackbox/pubring.gpg\nexport PATH=$PATH:/path/to/blackbox/bin\nblackbox_postdeploy\nsudo -u puppet cat /etc/puppet/hieradata/blackbox.yaml # or any encrypted file.\n```\n\nProTip: If you get \"gpg: decryption failed: No secret key\" then you forgot to re-encrypt blackbox.yaml with the new key.\n\nOn SECUREHOST, securely delete your files:\n\n```\ncd /tmp/NEWMASTER\n# On machines with the \"shred\" command:\nshred -u /tmp/keys.tar\nfind . -type f -print0 | xargs -0 shred -u\n# All else:\nrm -rf /tmp/NEWMASTER\n```\n\nAlso shred any other temporary files you may have made.\n\nReplacing expired keys\n======================\n\nIf someone's key has already expired, blackbox will stop\nencrypting. You see this error:\n\n```\n$ blackbox_edit_end modified_file.txt\n--> Error: can't re-encrypt because a key has expired.\n```\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\nYou can also detect keys that are about to expire by issuing this command and manually reviewing the \"expired:\" dates:\n\n gpg --homedir=.blackbox --list-keys\n\nor... list UIDs that will expire within 1 month from today: (Warning: this also lists keys without an expiration date)\n\n gpg --homedir=.blackbox --list-keys --with-colons --fixed-list-mode | grep ^uid | awk -F: '$6 < '$(( $(date +%s) + 2592000))\n\nHere's how to replace the key:\n\n- Step 1. Administrator removes expired user:\n\nWarning: This process will erase any unencrypted files that you were in the process of editing. Copy them elsewhere and restore the changes when done.\n\n```\nblackbox_removeadmin expired_user@example.com\n# This next command overwrites any changed unencrypted files. See warning above.\nblackbox_update_all_files\ngit commit -m \"Re-encrypt all files\"\ngpg --homedir=.blackbox --delete-key expired_user@example.com\ngit commit -m 'Cleaned expired_user@example.com from keyring' .blackbox/*\ngit push\n```\n\n- Step 2. Expired user adds an updated key:\n\n```\ngit pull\nblackbox_addadmin updated_user@example.com\ngit commit -m'NEW ADMIN: updated_user@example.com .blackbox/pubring.gpg .blackbox/trustdb.gpg .blackbox/blackbox-admins.txt\ngit push\n```\n\n- Step 3. Administrator re-encrypts all files with the updated key of the expired user:\n\n```\ngit pull\ngpg --import .blackbox/pubring.gpg\nblackbox_update_all_files\ngit commit -m \"Re-encrypt all files\"\ngit push\n```\n\n- Step 4: Clean up:\n\nAny files that were temporarily copied in the first step so as to not be overwritten can now be copied back and re-encrypted with the `blackbox_edit_end` command.\n\n(Thanks to @chishaku for finding a solution to this problem!)\n\n### Configure git to show diffs in encrypted files\n\nIt's possible to tell Git to decrypt versions of the file before running them through `git diff` or `git log`. To achieve this do:\n\n- Add the following to `.gitattributes` at the top of the git repository:\n\n```\n*.gpg diff=blackbox\n```\n\n- Add the following to `.git/config`:\n\n```\n[diff \"blackbox\"]\n textconv = gpg --use-agent -q --batch --decrypt\n````\n\nAnd now commands like `git log -p file.gpg` will show a nice log of the changes in the encrypted file.\n\nSome common errors\n==================\n\n`gpg: filename: skipped: No public key` -- Usually this means there is an item in `.blackbox/blackbox-admins.txt` that is not the name of the key. Either something invalid was inserted (like a filename instead of a username) or a user has left the organization and their key was removed from the keychain, but their name wasn't removed from the blackbox-admins.txt file.\n\n`gpg: decryption failed: No secret key` -- Usually means you forgot to re-encrypt the file with the new key.\n\n`Error: can't re-encrypt because a key has expired.` -- A user's key has expired and can't be used to encrypt any more. Follow the [Replace expired keys](#replace-expired-keys) tip.\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\nUsing Blackbox without a repo\n=============================\n\nIf the files are copied out of a repo they can still be decrypted and edited. Obviously edits, changes to keys, and such will be lost if they are made outside the repo. Also note that commands are most likely to only work if run from the base directory (i.e. the parent to the .blackbox directory).\n\nThe following commands have been tested outside a repo:\n\n- `blackbox_postdeploy`\n- `blackbox_edit_start`\n- `blackbox_edit_end`\n\nSome Subversion gotchas\n=======================\n\nThe current implementation will store the blackbox in `/keyrings` at the root of the entire repo. This will create an issue between environments that have different roots (i.e. checking out `/` on development vs `/releases/foo` in production). To get around this, you can `export BLACKBOX_REPOBASE=/path/to/repo` and set a specific base for your repo.\n\nThis was originally written for git and supports a two-phase commit, in which `commit` is a local commit and \"push\" sends the change upstream to the version control server when something is registered or deregistered with the system. The current implementation will immediately `commit` a file (to the upstream subversion server) when you execute a `blackbox_*` command.\n\nUsing Blackbox when gpg2 is installed next to gpg\n=================================================\n\nIn some situations, team members or automated roles need to install gpg\n2.x alongside the system gpg version 1.x to catch up with the team's gpg\nversion. On Ubuntu 16, you can ```apt-get install gnupg2``` which\ninstalls the binary gpg2. If you want to use this gpg2 binary, run every\nblackbox command with GPG=gpg2.\n\nFor example:\n\n```\nGPG=gpg2 blackbox_postdeploy\n```\n\nHow to submit bugs or ask questions?\n====================================\n\nWe welcome questions, bug reports and feedback!\n\nThe best place to start is to join the [blackbox-project mailing list](https://groups.google.com/d/forum/blackbox-project) and ask there.\n\nBugs are tracked here in Github. Please feel free to [report bugs](https://github.com/StackExchange/blackbox/issues) yourself.\n\nDeveloper Info\n==============\n\nCode submissions are gladly welcomed! The code is fairly easy to read.\n\nGet the code:\n\n```\ngit clone git@github.com:StackExchange/blackbox.git\n```\n\nTest your changes:\n\n```\nmake confidence\n```\n\nThis runs through a number of system tests. It creates a repo, encrypts files, decrypts files, and so on. You can run these tests to verify that the changes you made didn't break anything. You can also use these tests to verify that the system works with a new operating system.\n\nPlease submit tests with code changes:\n\nThe best way to change BlackBox is via Test Driven Development. First add a test to `tools/confidence.sh`. This test should fail, and demonstrate the need for the change you are about to make. Then fix the bug or add the feature you want. When you are done, `make confidence` should pass all tests. The PR you submit should include your code as well as the new test. This way the confidence tests accumulate as the system grows as we know future changes don't break old features.\n\nNote: The tests currently assume \"git\" and have been tested only on CentOS, Mac OS X, and Cygwin. Patches welcome!\n\nAlternatives\n============\n\nHere are other open source packages that do something similar to BlackBox. If you like them better than BlackBox, please use them.\n\n- [git-crypt](https://www.agwa.name/projects/git-crypt/)\n- [Pass](http://www.zx2c4.com/projects/password-store/)\n- [Transcrypt](https://github.com/elasticdog/transcrypt)\n- [Keyringer](https://keyringer.pw/)\n- [git-secret](https://github.com/sobolevn/git-secret)\n\ngit-crypt has the best git integration. Once set up it is nearly transparent to the users. However it only works with git.\n\n\nLicense\n=======\n\nThis content is released under the MIT License.\nSee the [LICENSE.txt](LICENSE.txt) file.\n" }, { "path": "RELEASE_ENGINEERING.md", "content": "Table of Contents:\n==================\n\n-\t[Branches and Tags:](#branches-and-tags)\n-\t[Testing:](#testing)\n-\t[Build Tasks](#build-tasks)\n-\t[Stable Releases](#stable-releases)\n-\t[Production Releases](#production-releases)\n-\t[Updating MacPorts (automatic)](#updating-macports-automatic)\n-\t[Updating MacPorts (manual)](#updating-macports-manual)\n\nBranches and Tags:\n==================\n\nThere are 3 branches/tags:\n\n-\t**HEAD:** The cutting edge of development.\n-\t**tag stable:** Stable enough for use by most people.\n-\t**tag production:** Burned in long enough that we are confident it can be widely adopted.\n\nIf you are packaging BlackBox for distribution, you should track the *tag production*. You might also want to provide a separate package that tracks *tag stable:* for early adopters.\n\nTesting\n=======\n\nTips:\n\n* macOS: `brew install gpg pinentry`\n* FreeBSD: `pkg install gpg gmake`\n* CentOS7: `yum install gpg`\n\nTo run a suite of tests:\n\n```\ncd ~/src/github.com/StackExchange/blackbox\nmake test\n```\n\nFYI: For FreeBSD, use `gmake test`\n\n\nBuild Tasks\n===========\n\nStable Releases\n===============\n\nStep 0. Test the software\n\nRun this command to run the unit and system tests:\n\n```\nmake test\n```\n\nNOTE: The tests require pinentry-tty. On macOS with NIX this\ncan be installed via: `nix-env -i pinentry`\n\nMarking the software to be \"stable\":\n\nStep 1. Update CHANGELOG.md\n\nUse \"git log\" to see what has changed and update CHANGELOG.md.\n\nFor a new release, add:\n\n```\n echo Release v1.$(date +%Y%m%d)\n```\n\nCommit with:\n\n```\ngit commit -m'Update CHANGELOG.md' CHANGELOG.md\n```\n\nStep 2. Tag it.\n\n```\ngit pull\ngit tag -d stable\ngit push origin :stable\ngit tag stable\ngit push origin tag stable\n```\n\nStep 3. Mark your calendar 1 week from today to check to see if this should be promoted to production.\n\nProduction Releases\n===================\n\nIf no bugs have been reported a full week after a stable tag has been pushed, mark the release to be \"production\".\n\n```\ngit fetch\ngit checkout stable\ngit tag -d production\ngit push origin :production\ngit tag production\ngit push origin tag production\nR=\"v1.$(date +%Y%m%d)\"\ngit tag \"$R\"\ngit push origin tag \"$R\"\n```\n\nStep 4. Get credit!\n\nRecord the fact that you did this release in your weekly accomplishments file.\n\n\n\nUpdating MacPorts (automatic)\n=============================\n\nStep 1: Generate the Portfile\n\n```\ntools/macports_report_upgrade.sh 1.20150222\n```\n\nThis script will generate a file called `Portfile-vcs_blackbox.diff` and instructions on how to submit it as a update request.\n\nStep 2: Submit the update request.\n\nSubmit the diff file as a bug as instructed. The instructions should look like this:\n\n-\tPLEASE OPEN A TICKET WITH THIS INFORMATION: https://trac.macports.org/newticket\n-\tSummary: `vcs_blackbox @1.20150222 Update to latest upstream`\n-\tDescription: `New upstream of vcs_blackbox.\n\tgithub.setup and checksums updated.`\n-\tType: `update`\n-\tComponent: `ports`\n-\tPort: `vcs_blackbox`\n-\tKeywords: `maintainer haspatch`\n-\tAttach this file: `Portfile-vcs_blackbox.diff`\n\nStep 3: Watch for the update to happen.\n\n\nUpdating MacPorts (manual)\n==========================\n\nThis is the old, manual, procedure. If the automated procedure fails to work, these notes may or may not be helpful.\n\nThe ultimate result of the script should be the output of `diff -u Portfile.orig Portfile` which is sent as an attachment to MacPorts. The new `Portfile` should have these changes:\n\n1.\tThe `github.setup` line should have a new version number.\n2.\tThe `checksums` line(s) should have updated checksums.\n\nHow to generate the checksums?\n\nThe easiest way is to to make a Portfile with incorrect checksums, then run `sudo port -v checksum vcs_blackbox` to see what they should have been. Fix the file, and try again until the checksum command works.\n\nNext run `port lint vcs_blackbox` and make sure it has no errors.\n\nSome useful commands:\n\nChange repos in sources.conf:\n\n```\nsudo vi /opt/local/etc/macports/sources.conf\n Add this line early in the file:\n file:///var/tmp/ports\n```\n\nAdd a local repo:\n\n```\nfgrep >/dev/null -x 'file:///var/tmp/ports' /opt/local/etc/macports/sources.conf || sudo sed -i -e '1s@^@file:///var/tmp/ports\\'$'\\n@' /opt/local/etc/macports/sources.conf\n```\n\nRemove the local repo:\n\n```\nsudo sed -i -e '\\@^file:///var/tmp/ports@d' /opt/local/etc/macports/sources.conf\n```\n\nTest a Portfile:\n\n```\nsudo port uninstall vcs_blackbox\nsudo port clean --all vcs_blackbox\nrm -rf ~/.macports/opt/local/var/macports/sources/rsync.macports.org/release/tarballs/ports/security/vcs_blackbox/\nrm -rf /var/tmp/ports\nmkdir -p /var/tmp/ports/security/vcs_blackbox\ncp Portfile /var/tmp/ports/security/vcs_blackbox\ncd /var/tmp/ports && portindex\nsudo port -v checksum vcs_blackbox\nsudo port install vcs_blackbox\n```\n" }, { "path": "SPECS/empty.spec", "content": "" }, { "path": "Version2-Ideas.md", "content": "# Ideas for BlackBox Version 2\n\nI'm writing this to solicit feedback and encourage discussion.\n\nHere are my thoughts on a \"version 2\" of BlackBox. This is where\nI list ideas that would require major changes to the system. They\nmight break backwards compatibility, though usually not.\n\nBlackBox grew from a few simple shell scripts used at StackOverflow.com\nto a larger system used by dozens (hundreds?) of organizations. Not\nall the design decisions were \"forward looking\".\n\nThese are the things I'd like to change someday.\n\n[TOC]\n\n## Change the commmand names\n\nThere should be one program, with subcommands that have names that make more sense:\n\n* `blackbox admin add `\n* `blackbox admin list`\n* `blackbox admin remove `\n* `blackbox cat ...`\n* `blackbox decrypt ...`\n* `blackbox diff ...`\n* `blackbox edit ...`\n* `blackbox encrypt ...`\n* `blackbox file add ...`\n* `blackbox file list`\n* `blackbox file remove ...`\n* `blackbox info`\n* `blackbox init`\n* `blackbox reencrypt`\n* `blackbox shred --all| ...`\n* `blackbox status --all| ...`\n\nBackwards compatibility: The old scripts will be rewritten to use the new commands.\n\n## Change the \"keyrings\" directory\n\nThe name `keyrings` was unfortunate. First, it should probably begin with a `.`. Second, it stores more than just keyrings. Lastly, I'm finding that in most cases we want many repos to refer to the same keyring, which is not supported very well.\n\nA better system would be:\n\n1. If `$BLACKBOX_CONFIG` is set, use that directory.\n2. If the repo base directory has a file called `.blackbox_external`, read that file as if you are reading `$BLACKBOX_CONFIG`\n3. If the repo base directory has a `keyrings` directory, use that.\n4. If the repo base directory has a `.blackbox` directory, use that.\n\nSome thoughts on `.blackbox_external`:\nI'm not sure what the format should be, but I want it to be simple and expandable. It should support support `../../dir/name` and `/long/path`. However some day we may want to include a Git URL and have the system automatically get the keychain from it. That means the format has to be something like directory:../dir/name so that later we can add git:the-url.\n\nNOTE: Maybe `.blackbox_external` should be `.blackbox/BLACKBOX_CONFIG`?\n\nBackwards compatibility: `keyrings` would be checked before `.blackbox`.\n\n## System Test\n\nThere needs to be a very complete system test. The `make test` we\nhave now is great for something written in bash.\n\nIt should be easy to make tests. Perhaps a directory of files, each\nspecifying a test. We could make a little language for writing tests.\n\n # This test becomes the user \"alice\" and verifies that she\n # can encrypt a file, and decrypt it, with full fidelity.\n BECOME alice a\n BASH echo \"foo contents\" >foo.txt\n SHOULD_NOT_EXIST foo.txt.gpg\n BASH blackbox encrypt foo.txt\n SHOULD_NOT_EXIST foo.txt\n SHOULD_EXIST foo.txt.gpg\n BASH_WITH_PASSWORD a blackbox decrypt foo.txt\n SHOULD_EXIST foo.txt.gpg\n SHOULD_EXIST foo.txt\n SHOULD_CONTAIN foo.txt \"foo contents\\n\"\n\n## Plug-in support\n\nThere should plug-ins support for:\n\nRepo type:\n\n* Git -- Using /usr/bin/git or git.exe\n* Subversion\n* Mercurial\n* None (repoless)\n* Autodetect\n\nEncryption software:\n\n* GnuPG -- using /usr/bin/gpg{,2} or gpg.exe\n* golang.org/x/crypto/openpgp\n\n## JSON or .txt\n\nThe files in .blackbox are mostly .txt files. Instead we should\ndefine a .json format, and only read the .txt file is the .json file\ndoesn't exist.\n\n\n## Repo-less mode\n\nI can't imagine storing files that aren't in a repo. I just put everything in repos lately. I use it more than I use NFS. That said, I have received feedback that people would like the ability to disable automatic committing of files.\n\nI prefer the file commits to be automatic because when they were manual, people often accidentally committed the plaintext file instead of the GPG file. Fixing such mistakes is a PITA and, of yeah, a big security nightmare.\n\nThat said, I'm willing to have a \"repo-less\" mode.\n\nWhen this mode is triggered, no add/commit/ignore tasks are done. The search for the keyrings directory still uses `$BLACKBOX_CONFIG` but if that is unset it looks for `.blackbox_config` in the current directory, then recursively `..` until we hit `/`.\n\nI think (but I'm not sure) this would benefit the entire system because it would force us to re-think what VCS actions are done when.\n\nI think (but I'm not sure) that a simple way to implement this would be to add an environment variable that overrides the automatic VCS detection. When set to \"none\", all VCS operations would basically become no-ops. (This could be done by writing a plug-in that does nothing for all the `vcs_*` calls)\n\n\nBackwards compatibility: This would add a `none` VCS, not remove any existing functionality.\n\n\n## Is \"bash\" the right language?\n\n`bash` is fairly universal. It even exists on Windows. However it is not the right language for large systems. Writing the acceptance tests is quite a bear. Managing `.gitignore` files in bash is impossible and the current implementation fails in many cases.\n\n`python` is my second favorite language. It would make the code cleaner and more testable. However it is not installed everywhere. I would also want to write it in Python3 (why start a new project in Python2?) but sadly Python3 is less common. It is a chicken vs. egg situation.\n\n`go` is my favorite language. I could probably rewrite this in go in a weekend. However, now the code is compiled, not interpreted. Therefore we lose the ability to just `git clone` and have the tools you want. Not everyone has a Go compiler installed on every machine.\n\nThe system is basically unusable on Windows without Cygwin or MINGW. A rewrite in python or go would make it work better on Windows, which currently requires Cygwin or MinGW (which is a bigger investment than installing Python). On the other hand, maybe Ubuntu-on-Windows makes that a non-issue.\n\nAs long as the code is in `bash` the configuration files like `blackbox-files.txt` and `blackbox-admins.txt` have problems. Filenames with carriage returns aren't supported. If this was in Python/Go/etc. those files could be json or some format with decent quoting and we could handle funny file names better. On the other hand, maybe it is best that we don't support funny filenames... we shouldn't enable bad behavior.\n\nHow important is itto blackbox users that the system is written in `bash`?\n\n\n## Ditch the project and use git-crypt\n\nPeople tell me that git-crypt is better because, as a plug-in, automagically supports `git diff`, `git log` and `git blame`.\n\nHowever, I've never used it so I don't have any idea whether git-crypt is any better than blackbox.\n\nOf course, git-crypt doesn't work with SVN, HG, or any other VCS. Is blackbox's strong point the fact that it support so many VCS systems? To be honest, it originally only supported HG and GIT because I was at a company that used HG but then changed to GIT. Supporting anything else was thanks to contributors. Heck, HG support hasn't even been tested recently (by me) since we've gone all git where I work.\n\nHow important is this to BlackBox users?\n" }, { "path": "bin/Makefile", "content": "all: _stack_lib.sh\n\n# Snatch _stack_lib.sh from another StackExchange project.\n_stack_lib.sh: ../../scripts/misc/_stack_lib.sh\n\tcp ../../scripts/misc/_stack_lib.sh $@\n" }, { "path": "bin/_blackbox_common.sh", "content": "#!/usr/bin/env bash\n\n#\n# Common constants and functions used by the blackbox_* utilities.\n#\n\n# Usage:\n#\n# set -e\n# source \"${0%/*}/_blackbox_common.sh\"\n\n# Load additional useful functions\nsource \"${0%/*}\"/_stack_lib.sh\n\n# Where are we?\n: \"${BLACKBOX_HOME:=\"$(cd \"${0%/*}\" ; pwd)\"}\" ;\n\n# Make grep and sort work like it did in the 1970s:\n# Without this, blackbox fails to match filenames in blackbox-files.txt\nexport LC_ALL='C'\nexport LANG='en_US.UTF-8'\n\n# What are the candidates for the blackbox data directory?\n#\n# The order of candidates matter. The first entry of the array\n# sets the default Blackbox directory for all new repositories.\ndeclare -a BLACKBOXDATA_CANDIDATES\nBLACKBOXDATA_CANDIDATES=(\n '.blackbox'\n 'keyrings/live'\n)\n\n# If $EDITOR is not set, set it to \"vi\":\n: \"${EDITOR:=vi}\" ;\n\n# Allow overriding gpg command\n: \"${GPG:=gpg}\" ;\n\nfunction physical_directory_of() {\n local d=$(dirname \"$1\")\n local f=$(basename \"$1\")\n (cd \"$d\" && echo \"$(pwd -P | sed 's/\\/$//')/$f\" )\n}\n\n# Set REPOBASE to the top of the repository\n# Set VCS_TYPE to 'git', 'hg', 'svn' or 'unknown'\nif which >/dev/null 2>/dev/null git && git rev-parse --show-toplevel >/dev/null 2>&1 ; then\n VCS_TYPE=git\n REPOBASE=$(git rev-parse --show-toplevel)\nelif [ -d \".svn\" ] ; then\n # Find topmost dir with .svn sub-dir\n parent=\"\"\n grandparent=\".\"\n while [ -d \"$grandparent/.svn\" ]; do\n parent=$grandparent\n grandparent=\"$parent/..\"\n done\n\n REPOBASE=$(cd \"$parent\" ; pwd)\n VCS_TYPE=svn\nelif which >/dev/null 2>/dev/null hg && hg root >/dev/null 2>&1 ; then\n # NOTE: hg has to be tested last because it always \"succeeds\".\n VCS_TYPE=hg\n REPOBASE=$(hg root 2>/dev/null)\nelse\n # We aren't in a repo at all. Assume the cwd is the root\n # of the tree.\n VCS_TYPE=unknown\n REPOBASE=\"$(pwd)\"\nfi\nexport VCS_TYPE\nexport REPOBASE=$(physical_directory_of \"$REPOBASE\")\n# FIXME: Verify this function by checking for .hg or .git\n# after determining what we believe to be the answer.\n\nif [[ -n \"$BLACKBOX_REPOBASE\" ]]; then\n\techo \"Using custom repobase: $BLACKBOX_REPOBASE\" >&2\n\texport REPOBASE=\"$BLACKBOX_REPOBASE\"\nfi\n\nif [ -z \"$BLACKBOXDATA\" ] ; then\n BLACKBOXDATA=\"${BLACKBOXDATA_CANDIDATES[0]}\"\n for candidate in ${BLACKBOXDATA_CANDIDATES[@]} ; do\n if [ -d \"$REPOBASE/$candidate\" ] ; then\n BLACKBOXDATA=\"$candidate\"\n break\n fi\n done\nfi\n\nKEYRINGDIR=\"$REPOBASE/$BLACKBOXDATA\"\nBB_ADMINS_FILE=\"blackbox-admins.txt\"\nBB_ADMINS=\"${KEYRINGDIR}/${BB_ADMINS_FILE}\"\nBB_FILES_FILE=\"blackbox-files.txt\"\nBB_FILES=\"${KEYRINGDIR}/${BB_FILES_FILE}\"\nSECRING=\"${KEYRINGDIR}/secring.gpg\"\n: \"${DECRYPT_UMASK:=0022}\" ;\n# : ${DECRYPT_UMASK:=o=} ;\n\n# Checks if $1 is 0 bytes, and if $1/keyrings\n# is a directory\nfunction is_blackbox_repo() {\n if [[ -n \"$1\" ]] && [[ -d \"$1/keyrings\" ]]; then\n return 0 # Yep, its a repo\n else\n return 1\n fi\n}\n\n# Return error if not on cryptlist.\nfunction is_on_cryptlist() {\n # Assumes $1 does NOT have the .gpg extension\n file_contains_line \"$BB_FILES\" \"$(vcs_relative_path \"$1\")\"\n}\n\n# Exit with error if a file exists.\nfunction fail_if_exists() {\n if [[ -f \"$1\" ]]; then\n echo ERROR: \"$1\" exists. \"$2\" >&2\n echo Exiting... >&2\n exit 1\n fi\n}\n\n# Exit with error if a file is missing.\nfunction fail_if_not_exists() {\n if [[ ! -f \"$1\" ]]; then\n echo ERROR: \"$1\" not found. \"$2\" >&2\n echo Exiting... >&2\n exit 1\n fi\n}\n\n# Exit we we aren't in a VCS repo.\nfunction fail_if_not_in_repo() {\n if [[ $VCS_TYPE = \"unknown\" ]]; then\n echo \"ERROR: This must be run in a VCS repo: git, hg, or svn.\" >&2\n echo Exiting... >&2\n exit 1\n fi\n}\n\n# Exit with error if filename is not registered on blackbox list.\nfunction fail_if_not_on_cryptlist() {\n # Assumes $1 does NOT have the .gpg extension\n\n local name=\"$1\"\n\n if ! is_on_cryptlist \"$name\" ; then\n echo \"ERROR: $name not found in $BB_FILES\" >&2\n echo \"PWD=$(/usr/bin/env pwd)\" >&2\n echo 'Exiting...' >&2\n exit 1\n fi\n}\n\n# Exit with error if keychain contains secret keys.\nfunction fail_if_keychain_has_secrets() {\n if [[ -s ${SECRING} ]]; then\n echo 'ERROR: The file' \"$SECRING\" 'should be empty.' >&2\n echo 'Did someone accidentally add this private key to the ring?' >&2\n echo 'Exiting...' >&2\n exit 1\n fi\n}\n\nfunction get_pubring_path() {\n if [[ -f \"${KEYRINGDIR}/pubring.gpg\" ]]; then\n echo \"${KEYRINGDIR}/pubring.gpg\"\n else\n echo \"${KEYRINGDIR}/pubring.kbx\"\n fi\n}\n\n# Output the unencrypted filename.\nfunction get_unencrypted_filename() {\n echo \"$(dirname \"$1\")/$(basename \"$1\" .gpg)\" | sed -e 's#^\\./##'\n}\n\n# Output the encrypted filename.\nfunction get_encrypted_filename() {\n echo \"$(dirname \"$1\")/$(basename \"$1\" .gpg).gpg\" | sed -e 's#^\\./##'\n}\n\n# Prepare keychain for use.\nfunction prepare_keychain() {\n local keyringasc\n echo '========== Importing keychain: START' >&2\n # Works with gpg 2.0\n #$GPG --import \"$(get_pubring_path)\" 2>&1 | egrep -v 'not changed$' >&2\n # Works with gpg 2.0 and 2.1\n # NB: We must export the keys to a format that can be imported.\n make_self_deleting_tempfile keyringasc\n export LANG=\"C.UTF-8\"\n\n #if gpg2 is installed next to gpg like on ubuntu 16\n if [[ \"$GPG\" != \"gpg2\" ]]; then\n $GPG --export --no-default-keyring --keyring \"$(get_pubring_path)\" >\"$keyringasc\"\n $GPG --import \"$keyringasc\" 2>&1 | egrep -v 'not changed$' >&2\n else\n $GPG --keyring \"$(get_pubring_path)\" --export | $GPG --import\n fi\n\n echo '========== Importing keychain: DONE' >&2\n}\n\n# Add file to list of encrypted files.\nfunction add_filename_to_cryptlist() {\n # If the name is already on the list, this is a no-op.\n # However no matter what the datestamp is updated.\n \n # https://github.com/koalaman/shellcheck/wiki/SC2155\n local name\n name=$(vcs_relative_path \"$1\")\n\n if file_contains_line \"$BB_FILES\" \"$name\" ; then\n echo \"========== File is registered. No need to add to list.\"\n else\n echo \"========== Adding file to list.\"\n touch \"$BB_FILES\"\n echo \"$name\" >> \"$BB_FILES\"\n sort -u -o \"$BB_FILES\" \"$BB_FILES\"\n fi\n}\n\n# Removes a file from the list of encrypted files\nfunction remove_filename_from_cryptlist() {\n # If the name is not already on the list, this is a no-op.\n\n # https://github.com/koalaman/shellcheck/wiki/SC2155\n local name\n name=$(vcs_relative_path \"$1\")\n\n if ! file_contains_line \"$BB_FILES\" \"$name\" ; then\n echo \"========== File is not registered. No need to remove from list.\"\n else\n echo \"========== Removing file from list.\"\n remove_line \"$BB_FILES\" \"$name\"\n fi\n}\n\n# Print out who the current BB ADMINS are:\nfunction disclose_admins() {\n echo \"========== blackbox administrators are:\"\n cat \"$BB_ADMINS\"\n}\n\n# Encrypt file, overwriting .gpg if it exists.\nfunction encrypt_file() {\n local unencrypted\n local encrypted\n unencrypted=\"$1\"\n encrypted=\"$2\"\n\n echo \"========== Encrypting: $unencrypted\" >&2\n $GPG --use-agent --yes --encrypt -o \"$encrypted\" $(awk '{ print \"-r\" $1 }' < \"$BB_ADMINS\") \"$unencrypted\" >&2\n echo '========== Encrypting: DONE' >&2\n}\n\n# Decrypt .gpg file, asking \"yes/no\" before overwriting unencrypted file.\nfunction decrypt_file() {\n local encrypted\n local unencrypted\n local old_umask\n encrypted=\"$1\"\n unencrypted=\"$2\"\n\n echo \"========== EXTRACTING $unencrypted\" >&2\n\n old_umask=$(umask)\n umask \"$DECRYPT_UMASK\"\n $GPG --use-agent -q --decrypt -o \"$unencrypted\" \"$encrypted\" >&2\n umask \"$old_umask\"\n}\n\n# Decrypt .gpg file, overwriting unencrypted file if it exists.\nfunction decrypt_file_overwrite() {\n local encrypted\n local unencrypted\n local old_hash\n local new_hash\n local old_umask\n encrypted=\"$1\"\n unencrypted=\"$2\"\n\n if [[ -f \"$unencrypted\" ]]; then\n old_hash=$(md5sum_file \"$unencrypted\")\n else\n old_hash=unmatchable\n fi\n\n old_umask=$(umask)\n umask \"$DECRYPT_UMASK\"\n $GPG --use-agent --yes -q --decrypt -o \"$unencrypted\" \"$encrypted\" >&2\n umask \"$old_umask\"\n\n new_hash=$(md5sum_file \"$unencrypted\")\n if [[ \"$old_hash\" != \"$new_hash\" ]]; then\n echo \"========== EXTRACTED $unencrypted\" >&2\n fi\n}\n\n# Shred a file. If shred binary does not exist, delete it.\nfunction shred_file() {\n local name\n local CMD\n local OPT\n name=\"$1\"\n\n if which shred >/dev/null 2>/dev/null ; then\n CMD=shred\n OPT=-u\n elif which srm >/dev/null 2>/dev/null ; then\n #NOTE: srm by default uses 35-pass Gutmann algorithm\n CMD=srm\n OPT=-f\n elif _F=$(mktemp); rm -P \"${_F}\" >/dev/null 2>/dev/null ; then\n CMD=rm\n OPT=-Pf\n else\n echo \"shred_file: WARNING: No secure deletion utility (shred or srm) present; using insecure rm\" >&2\n CMD=rm\n OPT=-f\n fi\n\n $CMD $OPT -- \"$name\"\n}\n\n# $1 is the name of a file that contains a list of files.\n# For each filename, output the individual subdirectories\n# leading up to that file. i.e. one one/two one/two/three\nfunction enumerate_subdirs() {\n local listfile\n local dir\n local filename\n listfile=\"$1\"\n\n while read filename; do\n dir=$(dirname \"$filename\")\n while [[ $dir != '.' && $dir != '/' ]]; do\n echo \"$dir\"\n dir=$(dirname \"$dir\")\n done\n done <\"$listfile\" | sort -u\n}\n \n\n# chdir to the base of the repo.\nfunction change_to_vcs_root() {\n # if vcs_root not explicitly defined, use $REPOBASE\n\n local rbase=${1:-$REPOBASE} # use $1 but if unset use $REPOBASE\n\n cd \"$rbase\"\n\n}\n\n# $1 is a string pointing to a directory. Outputs a\n# list of valid blackbox repos,relative to $1\nfunction enumerate_blackbox_repos() {\n if [[ -z \"$1\" ]]; then\n echo \"enumerate_blackbox_repos: ERROR: No Repo provided to Enumerate\"\n exit 1\n fi\n\n # https://github.com/koalaman/shellcheck/wiki/Sc2045\n for dir in $1*/; do\n if is_blackbox_repo \"$dir\"; then\n echo \"$dir\"\n fi\n done\n}\n\n# Output the path of a file relative to the repo base\nfunction vcs_relative_path() {\n # Usage: vcs_relative_path file\n local name=\"$1\"\n #python -c 'import os ; print(os.path.relpath(\"'\"$(pwd -P)\"'/'\"$name\"'\", \"'\"$REPOBASE\"'\"))'\n local p=$( printf \"%s\" \"$( pwd -P )/${1}\" | sed 's#//*#/#g' )\n local name=\"${p#$REPOBASE}\"\n name=$( printf \"%s\" \"$name\" | sed 's#^/##g' | sed 's#/$##g' )\n printf \"%s\" \"$name\"\n}\n\n# Removes a line from a text file\nfunction remove_line() {\n local tempfile\n\n make_self_deleting_tempfile tempfile\n\n # Ensure source file exists\n touch \"$1\"\n grep -Fsxv \"$2\" \"$1\" > \"$tempfile\" || true\n\n # Using cat+rm instead of cp will preserve permissions/ownership\n cat \"$tempfile\" > \"$1\"\n}\n\n# Determine if a file contains a given line\nfunction file_contains_line() {\n # $1: the file\n # $2: the line\n grep -xsqF \"$2\" \"$1\"\n}\n\n#\n# Portability Section:\n#\n\n#\n# Abstract the difference between Linux and Mac OS X:\n#\n\nfunction md5sum_file() {\n # Portably generate the MD5 hash of file $1.\n case $(uname -s) in\n Darwin | FreeBSD )\n md5 -r \"$1\" | awk '{ print $1 }'\n ;;\n NetBSD )\n md5 -q \"$1\"\n ;;\n SunOS )\n digest -a md5 \"$1\"\n ;;\n Linux | CYGWIN* | MINGW* )\n md5sum \"$1\" | awk '{ print $1 }'\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting. (md5sum_file)'\n exit 1\n ;;\n esac\n}\n\nfunction cp_permissions() {\n # Copy the perms of $1 onto $2 .. end.\n case $(uname -s) in\n Darwin )\n chmod $( stat -f '%Lp' \"$1\" ) \"${@:2}\"\n ;;\n FreeBSD | NetBSD )\n chmod $( stat -f '%p' \"$1\" | sed -e \"s/^100//\" ) \"${@:2}\"\n ;;\n SunOS )\n chmod $( stat -c '%a' \"$1\" ) \"${@:2}\"\n ;;\n Linux | CYGWIN* | MINGW* | SunOS )\n if [[ -e /etc/alpine-release ]]; then\n chmod $( stat -c '%a' \"$1\" ) \"${@:2}\"\n else\n chmod --reference \"$1\" \"${@:2}\"\n fi\n ;; \n * )\n echo 'ERROR: Unknown OS. Exiting. (cp_permissions)'\n exit 1\n ;;\n esac\n}\n\n\n#\n# Abstract the difference between git and hg:\n#\n\n# Is this file in the current repo?\nfunction is_in_vcs() {\n is_in_$VCS_TYPE \"$@\"\n}\n# Mercurial\nfunction is_in_hg() {\n local filename\n filename=\"$1\"\n\n if hg locate \"$filename\" ; then\n echo true\n else\n echo false\n fi\n}\n# Git:\nfunction is_in_git() {\n local filename\n filename=\"$1\"\n\n if git ls-files --error-unmatch >/dev/null 2>&1 -- \"$filename\" ; then\n echo true\n else\n echo false\n fi\n}\n# Subversion\nfunction is_in_svn() {\n local filename\n filename=\"$1\"\n\n if svn list \"$filename\" ; then\n echo true\n else\n echo false\n fi\n}\n# Perforce\nfunction is_in_p4() {\n local filename\n filename=\"$1\"\n\n if p4 list \"$filename\" ; then\n echo true\n else\n echo false\n fi\n}\n# No repo\nfunction is_in_unknown() {\n echo true\n}\n\n\n# Add a file to the repo (but don't commit it).\nfunction vcs_add() {\n vcs_add_$VCS_TYPE \"$@\"\n}\n# Mercurial\nfunction vcs_add_hg() {\n hg add \"$@\"\n}\n# Git\nfunction vcs_add_git() {\n git add \"$@\"\n}\n# Subversion\nfunction vcs_add_svn() {\n svn add --parents \"$@\"\n}\n# Perfoce\nfunction vcs_add_p4() {\n p4 add \"$@\"\n}\n# No repo\nfunction vcs_add_unknown() {\n :\n}\n\n\n# Commit a file to the repo\nfunction vcs_commit() {\n vcs_commit_$VCS_TYPE \"$@\"\n}\n# Mercurial\nfunction vcs_commit_hg() {\n hg commit -m \"$@\"\n}\n# Git\nfunction vcs_commit_git() {\n git commit -m \"$@\"\n}\n# Subversion\nfunction vcs_commit_svn() {\n svn commit -m \"$@\"\n}\n# Perforce\nfunction vcs_commit_p4() {\n p4 submit -d \"$@\"\n}\n# No repo\nfunction vcs_commit_unknown() {\n :\n}\n\n\n# Remove file from repo, even if it was deleted locally already.\n# If it doesn't exist yet in the repo, it should be a no-op.\nfunction vcs_remove() {\n vcs_remove_$VCS_TYPE \"$@\"\n}\n# Mercurial\nfunction vcs_remove_hg() {\n hg rm -A -- \"$@\"\n}\n# Git\nfunction vcs_remove_git() {\n git rm --ignore-unmatch -f -- \"$@\"\n}\n# Subversion\nfunction vcs_remove_svn() {\n svn delete \"$@\"\n}\n# Perforce\nfunction vcs_remove_p4() {\n p4 delete \"$@\"\n}\n# No repo\nfunction vcs_remove_unknown() {\n :\n}\n\n# Get a path for the ignore file if possible in current vcs\nfunction vcs_ignore_file_path() {\n vcs_ignore_file_path_$VCS_TYPE\n}\n# Mercurial\nfunction vcs_ignore_file_path_hg() {\n echo \"$REPOBASE/.hgignore\"\n}\n# Git\nfunction vcs_ignore_file_path_git() {\n echo \"$REPOBASE/.gitignore\"\n}\n\n\n# Ignore a file in a repo. If it was already ignored, this is a no-op.\nfunction vcs_ignore() {\n local file\n for file in \"$@\"; do\n vcs_ignore_$VCS_TYPE \"$file\"\n done\n}\n# Mercurial\nfunction vcs_ignore_hg() {\n vcs_ignore_generic_file \"$(vcs_ignore_file_path)\" \"$file\"\n}\n# Git\nfunction vcs_ignore_git() {\n vcs_ignore_generic_file \"$(vcs_ignore_file_path)\" \"$file\"\n git add \"$REPOBASE/.gitignore\"\n}\n# Subversion\nfunction vcs_ignore_svn() {\n svn propset svn:ignore \"$file\" \"$(vcs_relative_path)\"\n}\n# Perforce\nfunction vcs_ignore_p4() {\n :\n}\n# No repo\nfunction vcs_ignore_unknown() {\n :\n}\n# Generic - add line to file\nfunction vcs_ignore_generic_file() {\n local file\n file=\"$(vcs_relative_path \"$2\")\"\n file=\"${file/\\$\\//}\"\n file=\"$(echo \"/$file\" | sed 's/\\([\\*\\?]\\)/\\\\\\1/g')\"\n if ! file_contains_line \"$1\" \"$file\" ; then\n echo \"$file\" >> \"$1\"\n vcs_add \"$1\"\n fi\n}\n\n\n# Notice (un-ignore) a file in a repo. If it was not ignored, this is\n# a no-op\nfunction vcs_notice() {\n local file\n for file in \"$@\"; do\n vcs_notice_$VCS_TYPE \"$file\"\n done\n}\n# Mercurial\nfunction vcs_notice_hg() {\n vcs_notice_generic_file \"$REPOBASE/.hgignore\" \"$file\"\n}\n# Git\nfunction vcs_notice_git() {\n vcs_notice_generic_file \"$REPOBASE/.gitignore\" \"$file\"\n git add \"$REPOBASE/.gitignore\"\n}\n# Subversion\nfunction vcs_notice_svn() {\n svn propdel svn:ignore \"$(vcs_relative_path \"$file\")\"\n}\n# Perforce\nfunction vcs_notice_p4() {\n :\n}\n# No repo\nfunction vcs_notice_unknown() {\n :\n}\n# Generic - remove line to file\nfunction vcs_notice_generic_file() {\n local file\n file=\"$(vcs_relative_path \"$2\")\"\n file=\"${file/\\$\\//}\"\n file=\"$(echo \"/$file\" | sed 's/\\([\\*\\?]\\)/\\\\\\1/g')\"\n if file_contains_line \"$1\" \"$file\" ; then\n remove_line \"$1\" \"$file\"\n vcs_add \"$1\"\n fi\n if file_contains_line \"$1\" \"${file:1}\" ; then\n echo \"WARNING: Found a non-absolute ignore match in $1\"\n echo \"WARNING: Confirm the pattern is intended to only exclude $file\"\n echo \"WARNING: If so, manually update the ignore file\"\n fi\n}\n\nfunction gpg_agent_version_check() {\n if ! hash 'gpg-agent' &> /dev/null; then\n return 1\n fi\n local gpg_agent_version=$(gpg-agent --version | head -1 | awk '{ print $3 }' | tr -d '\\n')\n semverLT $gpg_agent_version \"2.1.0\"\n}\n\nfunction gpg_agent_notice() {\n if [[ $(gpg_agent_version_check) == '0' && -z $GPG_AGENT_INFO ]];then\n echo 'WARNING: You probably want to run gpg-agent as'\n echo 'you will be asked for your passphrase many times.'\n echo 'Example: $ eval $(gpg-agent --daemon)'\n read -r -p 'Press CTRL-C now to stop. ENTER to continue: '\n fi\n}\n" }, { "path": "bin/_blackbox_common_test.sh", "content": "#!/usr/bin/env bash\n\n#\n# _blackbox_common_test.sh -- Unit tests of functions from _blackbox_common.sh\n#\n\nset -e\n. \"${0%/*}/_blackbox_common.sh\"\n. tools/test_functions.sh\n\nPHASE 'Test cp-permissions: TestA'\ntouch TestA TestB TestC TestD\nchmod 0347 TestA\nchmod 0700 TestB\nchmod 0070 TestC\nchmod 0070 TestD\ncp_permissions TestA TestB TestC\n# NOTE: cp_permissions is not touching TestD.\nassert_file_perm '--wxr--rwx' TestA\nassert_file_perm '--wxr--rwx' TestB\nassert_file_perm '--wxr--rwx' TestC\nassert_file_perm '----rwx---' TestD # TestD doesn't change.\nrm -f TestA TestB TestC TestD\n\necho '========== DONE.'\n" }, { "path": "bin/_stack_lib.sh", "content": "# Library functions for bash scripts at Stack Exchange.\n\n# NOTE: This file is open sourced. Do not put Stack-proprietary code here.\n\n# Usage:\n#\n# set -e\n# . _stack_lib.sh\n\n# ----- Utility Functions -----\n\nfunction debugmsg() {\n # Log to stderr.\n echo 1>&2 LOG: \"$@\"\n :\n}\n\nfunction logit() {\n # Log to stderr.\n echo 1>&2 LOG: \"$@\"\n}\n\nfunction fail_out() {\n echo \"FAILED:\" \"$*\"\n echo 'Exiting...'\n exit 1\n}\n\n# on_exit and add_on_exit from http://www.linuxjournal.com/content/use-bash-trap-statement-cleanup-temporary-files\n# Usage:\n# add_on_exit rm -f /tmp/foo\n# add_on_exit echo \"I am exiting\"\n# tempfile=$(mktemp)\n# add_on_exit rm -f \"$tempfile\"\nfunction on_exit()\n{\n for i in \"${on_exit_items[@]}\"\n do\n eval $i\n done\n}\n\nfunction add_on_exit()\n{\n local n=${#on_exit_items[*]}\n on_exit_items[$n]=\"$*\"\n if [[ $n -eq 0 ]]; then\n trap on_exit EXIT\n fi\n}\n\nfunction create_self_deleting_tempfile() {\n local filename\n\n case $(uname -s) in\n Darwin | FreeBSD )\n : \"${TMPDIR:=/tmp}\" ;\n filename=$(mktemp -t _stacklib_.XXXXXXXX )\n ;;\n Linux | CYGWIN* | MINGW* | NetBSD | SunOS )\n filename=$(mktemp)\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting. (create_self_deleting_tempfile)'\n exit 1\n ;;\n esac\n\n add_on_exit rm -f \"$filename\"\n echo \"$filename\"\n}\n\nfunction create_self_deleting_tempdir() {\n local filename\n\n case $(uname -s) in\n Darwin | FreeBSD )\n : \"${TMPDIR:=/tmp}\" ;\n filename=$(mktemp -d -t _stacklib_.XXXXXXXX )\n ;;\n Linux | CYGWIN* | MINGW* | NetBSD | SunOS )\n filename=$(mktemp -d)\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting. (create_self_deleting_tempdir)'\n exit 1\n ;;\n esac\n\n add_on_exit rm -rf \"$filename\"\n echo \"$filename\"\n}\n\n# Securely and portably create a temporary file that will be deleted\n# on EXIT. $1 is the variable name to store the result.\nfunction make_self_deleting_tempfile() {\n local __resultvar=\"$1\"\n local name\n\n case $(uname -s) in\n Darwin | FreeBSD )\n : \"${TMPDIR:=/tmp}\" ;\n name=$(mktemp -t _stacklib_.XXXXXXXX )\n ;;\n Linux | CYGWIN* | MINGW* | NetBSD | SunOS )\n name=$(mktemp)\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting. (make_self_deleting_tempfile)'\n exit 1\n ;;\n esac\n\n add_on_exit rm -f \"$name\"\n eval $__resultvar=\"$name\"\n}\n\nfunction make_tempdir() {\n local __resultvar=\"$1\"\n local name\n\n case $(uname -s) in\n Darwin | FreeBSD )\n : \"${TMPDIR:=/tmp}\" ;\n # The full path to the temp directory must be short.\n # This is used by blackbox's testing suite to make a fake GNUPGHOME,\n # which needs to fit within sockaddr_un.sun_path (see unix(7)).\n name=$(mktemp -d -t SO )\n ;;\n Linux | CYGWIN* | MINGW* | NetBSD | SunOS )\n name=$(mktemp -d)\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting. (make_tempdir)'\n exit 1\n ;;\n esac\n\n eval $__resultvar=\"$name\"\n}\n\nfunction make_self_deleting_tempdir() {\n local __resultvar=\"$1\"\n local dname\n\n make_tempdir dname\n\n add_on_exit rm -rf \"$dname\"\n eval $__resultvar=\"$dname\"\n}\n\nfunction fail_if_not_running_as_root() {\n if [[ $EUID -ne 0 ]]; then\n echo 'ERROR: This command should only be run as root.'\n echo 'Exiting...'\n exit 1\n fi\n}\n\nfunction fail_if_in_root_directory() {\n # Verify nobody has tricked us into being in \"/\".\n case $(uname -s) in\n Darwin | FreeBSD | NetBSD )\n if [[ $(stat -f'%i' / ) == $(stat -f'%i' . ) ]] ; then\n echo 'SECURITY ALERT: The current directory is the root directory.'\n echo 'Exiting...'\n exit 1\n fi\n ;;\n Linux | CYGWIN* | MINGW* | SunOS )\n if [[ $(stat -c'%i' / ) == $(stat -c'%i' . ) ]] ; then\n echo 'SECURITY ALERT: The current directory is the root directory.'\n echo 'Exiting...'\n exit 1\n fi\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting. (fail_if_in_root_directory)'\n exit 1\n ;;\n esac\n}\n\nfunction semverParseInto() {\n local RE='[^0-9]*\\([0-9]*\\)[.]\\([0-9]*\\)[.]\\([0-9]*\\)\\([0-9A-Za-z-]*\\)'\n #MAJOR\n eval $2=`echo $1 | sed -e \"s#$RE#\\1#\"`\n #MINOR\n eval $3=`echo $1 | sed -e \"s#$RE#\\2#\"`\n #MINOR\n eval $4=`echo $1 | sed -e \"s#$RE#\\3#\"`\n #SPECIAL\n eval $5=`echo $1 | sed -e \"s#$RE#\\4#\"`\n}\n\nfunction semverEQ() {\n local MAJOR_A=0\n local MINOR_A=0\n local PATCH_A=0\n local SPECIAL_A=0\n\n local MAJOR_B=0\n local MINOR_B=0\n local PATCH_B=0\n local SPECIAL_B=0\n\n semverParseInto $1 MAJOR_A MINOR_A PATCH_A SPECIAL_A\n semverParseInto $2 MAJOR_B MINOR_B PATCH_B SPECIAL_B\n\n if [ $MAJOR_A -ne $MAJOR_B ]; then\n return 1\n fi\n\n if [ $MINOR_A -ne $MINOR_B ]; then\n return 1\n fi\n\n if [ $PATCH_A -ne $PATCH_B ]; then\n return 1\n fi\n\n if [[ \"_$SPECIAL_A\" != \"_$SPECIAL_B\" ]]; then\n return 1\n fi\n\n\n return 0\n\n}\n\nfunction semverLT() {\n local MAJOR_A=0\n local MINOR_A=0\n local PATCH_A=0\n local SPECIAL_A=0\n\n local MAJOR_B=0\n local MINOR_B=0\n local PATCH_B=0\n local SPECIAL_B=0\n\n semverParseInto $1 MAJOR_A MINOR_A PATCH_A SPECIAL_A\n semverParseInto $2 MAJOR_B MINOR_B PATCH_B SPECIAL_B\n\n if [ $MAJOR_A -lt $MAJOR_B ]; then\n return 0\n fi\n\n if [[ $MAJOR_A -le $MAJOR_B && $MINOR_A -lt $MINOR_B ]]; then\n return 0\n fi\n\n if [[ $MAJOR_A -le $MAJOR_B && $MINOR_A -le $MINOR_B && $PATCH_A -lt $PATCH_B ]]; then\n return 0\n fi\n\n if [[ \"_$SPECIAL_A\" == \"_\" ]] && [[ \"_$SPECIAL_B\" == \"_\" ]] ; then\n return 1\n fi\n if [[ \"_$SPECIAL_A\" == \"_\" ]] && [[ \"_$SPECIAL_B\" != \"_\" ]] ; then\n return 1\n fi\n if [[ \"_$SPECIAL_A\" != \"_\" ]] && [[ \"_$SPECIAL_B\" == \"_\" ]] ; then\n return 0\n fi\n\n if [[ \"_$SPECIAL_A\" < \"_$SPECIAL_B\" ]]; then\n return 0\n fi\n\n return 1\n\n}\n\nfunction semverGT() {\n semverEQ $1 $2\n local EQ=$?\n\n semverLT $1 $2\n local LT=$?\n\n if [ $EQ -ne 0 ] && [ $LT -ne 0 ]; then\n return 0\n else\n return 1\n fi\n}\n\n" }, { "path": "bin/blackbox_addadmin", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_addadmin -- Add an admin to the system\n#\n\n# Example:\n# blackbox_addadmin tal@example.com\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nfail_if_not_in_repo\n\nKEYNAME=\"$1\"\n: \"${KEYNAME:?ERROR: First argument must be a keyname (email address)}\" ;\n\n# Add the email address to the BB_ADMINS file. Remove any duplicates.\n# The file must exist for sort to act as we expect.\ntouch \"$BB_ADMINS\"\necho \"$1\" >> \"$BB_ADMINS\"\nsort -fdu -o \"$BB_ADMINS\" \"$BB_ADMINS\"\n\n\n# Add the user's key to the keychain.\n\n# Extract it:\nmake_self_deleting_tempfile pubkeyfile\n\n# The second argument, if present, is the directory to find the GPG keys to be imported.\nif [[ -z $2 ]]; then\n $GPG --export -a \"$KEYNAME\" >\"$pubkeyfile\"\nelse\n # TODO(tlim): This could probably be done with GNUPGHOME\n # but that affects all commands; we just want it to affect the key export.\n $GPG --homedir=\"$2\" --export -a \"$KEYNAME\" >\"$pubkeyfile\"\nfi\n\nif [[ $(wc -l < \"$pubkeyfile\") = 0 ]]; then\n fail_out \"GPG key '$KEYNAME' not found. Please create it with: $GPG --gen-key\"\n exit 1\nfi\n\n# Import it:\n$GPG --no-permission-warning --homedir=\"$KEYRINGDIR\" --import \"$pubkeyfile\"\npubring_path=$(get_pubring_path)\nvcs_add \"$pubring_path\" \"$KEYRINGDIR/trustdb.gpg\" \"$BB_ADMINS\"\n\n# Make a suggestion:\necho\necho\necho 'NEXT STEP: You need to manually check these in:'\necho ' ' $VCS_TYPE commit -m\\'NEW ADMIN: $KEYNAME\\' \"$BLACKBOXDATA/$(basename ${pubring_path})\" \"$BLACKBOXDATA/trustdb.gpg\" \"$BLACKBOXDATA/$BB_ADMINS_FILE\"\n" }, { "path": "bin/blackbox_cat", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_cat -- Decrypt a file, cat it, shred it\n#\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nfor param in \"$@\" ; do\n shreddable=0\n unencrypted_file=$(get_unencrypted_filename \"$param\")\n if [[ ! -e \"$unencrypted_file\" ]]; then\n \"${BLACKBOX_HOME}/blackbox_edit_start\" \"$param\"\n shreddable=1\n fi\n cat \"$unencrypted_file\"\n if [[ $shreddable = 1 ]]; then\n shred_file \"$unencrypted_file\"\n fi\ndone\n" }, { "path": "bin/blackbox_decrypt_all_files", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_decrypt_all_files -- Decrypt all blackbox files (INTERACTIVE).\n#\n\n# Usage:\n# blackbox_decrypt_all_files [GROUP]\n# GROUP is optional. If supplied, the resulting files\n# are chgrp'ed to that group.\n\n# Since this is often run in a security-critical situation, we\n# force /usr/bin and /bin to the front of the PATH.\nexport PATH=/usr/bin:/bin:\"$PATH\"\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\ngpg_agent_notice\nexec blackbox_postdeploy \"$@\"\n" }, { "path": "bin/blackbox_decrypt_file", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_decrypt_file -- Decrypt one or more blackbox files.\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nif [ $# -eq 0 ]; then\n echo >&2 \"Please provide at least one file to decrypt\"\n exit 1\nfi\n\n\"${BLACKBOX_HOME}/blackbox_edit_start\" \"$@\"\n" }, { "path": "bin/blackbox_deregister_file", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_deregister_file -- Remove a file from the blackbox system.\n#\n# Takes an encrypted file and removes it from the blackbox system.\n# The encrypted file will also be removed from the filesystem.\n# The unencrypted file, if it exists, will be left alone.\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nunencrypted_file=$(get_unencrypted_filename \"$1\")\nencrypted_file=$(get_encrypted_filename \"$1\")\n\nif [[ \"$1\" == \"$unencrypted_file\" ]]; then\n echo ERROR: Please only deregister encrypted files.\n exit 1\nfi\n\necho ========== PLAINFILE \"$unencrypted_file\"\necho ========== ENCRYPTED \"$encrypted_file\"\n\nfail_if_not_exists \"$encrypted_file\" \"Please specify an existing file.\"\n\nprepare_keychain\nremove_filename_from_cryptlist \"$unencrypted_file\"\nvcs_remove \"$encrypted_file\"\nvcs_notice \"$unencrypted_file\"\nvcs_add \"$BB_FILES\" \n\nvcs_commit \"Removing from blackbox: ${unencrypted_file}\" \"$BB_FILES\" \"$encrypted_file\" \"$(vcs_ignore_file_path)\"\necho \"========== UPDATING VCS: DONE\"\necho \"Local repo updated. Please push when ready.\"\necho \" $VCS_TYPE push\"\n" }, { "path": "bin/blackbox_diff", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_diff -- Show all differences.\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\ngpg_agent_notice\nprepare_keychain\n\nmodified_files=()\nmodifications=()\necho '========== DIFFING FILES: START'\nwhile IFS= read <&99 -r unencrypted_file; do\n unencrypted_file=$(get_unencrypted_filename \"$unencrypted_file\")\n encrypted_file=$(get_encrypted_filename \"$unencrypted_file\")\n fail_if_not_on_cryptlist \"$unencrypted_file\"\n if [[ -f \"$unencrypted_file\" ]]; then\n out=$(diff -u <($GPG --yes -q --decrypt \"$encrypted_file\") \"$unencrypted_file\" || true)\n if [ \"$out\" != \"\" ]; then\n modified_files+=(\"$unencrypted_file\")\n modifications+=(\"$out\")\n fi\n fi\ndone 99<\"$BB_FILES\"\nmodified_files_number=${#modified_files[@]}\nfor (( i=0; i<${modified_files_number}; i++ )); do\n echo ========== PROCESSING '\"'${modified_files[$i]}'\"'\n echo -e \"${modifications[$i]}\\n\"\ndone\necho '========== DIFFING FILES: DONE'\n\nfail_if_keychain_has_secrets\n\necho '========== DONE.'\n\nif [ ${#modified_files[@]} -eq 0 ] ; then\n exit 0\nfi\n\necho 'Likely next steps:'\nfor f in \"${modified_files[@]}\" ; do\n echo \" blackbox_edit_end\" '\"'$f'\"'\ndone\n" }, { "path": "bin/blackbox_edit", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_edit -- Decrypt a file temporarily for edition, then re-encrypts it again\n#\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nfor param in \"$@\" ; do\n\n unencrypted_file=$(get_unencrypted_filename \"$param\")\n encrypted_file=$(get_encrypted_filename \"$param\")\n\n echo >&2 ========== PLAINFILE '\"'$unencrypted_file'\"'\n echo >&2 ========== ENCRYPTED '\"'$encrypted_file'\"'\n\n if ! is_on_cryptlist \"$encrypted_file\" && ! is_on_cryptlist \"$unencrypted_file\" ; then\n read -r -p \"Encrypt file $param? (y/n) \" ans\n case \"$ans\" in\n y* | Y*)\n \"${BLACKBOX_HOME}/blackbox_register_new_file\" \"$unencrypted_file\"\n ;;\n *)\n echo >&2 'Skipping...'\n continue\n ;;\n esac\n fi\n \"${BLACKBOX_HOME}/blackbox_edit_start\" \"$unencrypted_file\"\n $EDITOR \"$(get_unencrypted_filename \"$unencrypted_file\")\"\n \"${BLACKBOX_HOME}/blackbox_edit_end\" \"$unencrypted_file\"\n\ndone\n" }, { "path": "bin/blackbox_edit_end", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_edit_end -- Re-encrypt file after edits.\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nnext_steps=()\n\nif [ $# -eq 0 ]; then\n echo >&2 \"Please provide at least one file for which editing has finished\"\n exit 1\nfi\n\nfor param in \"$@\" ; do\n\n unencrypted_file=$(get_unencrypted_filename \"$param\")\n encrypted_file=$(get_encrypted_filename \"$param\")\n\n echo >&2 ========== PLAINFILE '\"'$unencrypted_file'\"'\n echo >&2 ========== ENCRYPTED '\"'$encrypted_file'\"'\n\n fail_if_not_on_cryptlist \"$unencrypted_file\"\n fail_if_not_exists \"$unencrypted_file\" \"No unencrypted version to encrypt!\"\n fail_if_keychain_has_secrets\n\n encrypt_file \"$unencrypted_file\" \"$encrypted_file\"\n shred_file \"$unencrypted_file\"\n echo >&2 ========== UPDATED '\"'$encrypted_file'\"'\n next_steps+=( \" $VCS_TYPE commit -m\\\"${encrypted_file} updated\\\" \\\"$encrypted_file\\\"\" )\n\ndone\n\necho >&2 \"Likely next step:\"\nfor x in \"${next_steps[@]}\"\ndo\n echo >&2 \"$x\"\ndone\n" }, { "path": "bin/blackbox_edit_start", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_edit_start -- Decrypt a file for editing.\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nif [ $# -eq 0 ]; then\n echo >&2 \"Please provide at least one file to start editing\"\n exit 1\nfi\n\nfor param in \"$@\" ; do\n\n unencrypted_file=$(get_unencrypted_filename \"$param\")\n encrypted_file=$(get_encrypted_filename \"$param\")\n\n echo >&2 ========== PLAINFILE '\"'$unencrypted_file'\"'\n\n fail_if_not_on_cryptlist \"$unencrypted_file\"\n fail_if_not_exists \"$encrypted_file\" \"This should not happen.\"\n if [[ ! -s \"$unencrypted_file\" ]]; then\n rm -f \"$unencrypted_file\"\n fi\n if [[ -f \"$unencrypted_file\" ]]; then\n echo >&2 SKIPPING: \"$1\" \"Will not overwrite non-empty files.\"\n continue\n fi\n\n prepare_keychain\n # FIXME(tlim): prepare_keychain only needs to run once, outside of the loop.\n decrypt_file \"$encrypted_file\" \"$unencrypted_file\"\n\ndone\n" }, { "path": "bin/blackbox_initialize", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_initialize -- Enable blackbox for a GIT or HG repo.\n#\n#\n# Example:\n# blackbox_initialize\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nif [[ $1 != 'yes' ]]; then\n read -r -p \"Enable blackbox for this $VCS_TYPE repo? (yes/no) \" ans\n if [[ $ans = 'no' || $ans = 'n' || $ans = '' ]]; then\n echo 'Exiting...'\n exit 1\n fi\nfi\n\nif [[ $VCS_TYPE = \"unknown\" ]]; then\n\techo 'Not in a known VCS directory'\n\texit 1\nfi\n\nchange_to_vcs_root\n\necho VCS_TYPE: $VCS_TYPE\nvcs_ignore \"${BLACKBOXDATA}/pubring.gpg~\" \"${BLACKBOXDATA}/pubring.kbx~\" \"${BLACKBOXDATA}/secring.gpg\"\n\n# Make directories\nmkdir -p \"${KEYRINGDIR}\"\nvcs_add \"${KEYRINGDIR}\"\ntouch \"$BLACKBOXDATA/$BB_ADMINS_FILE\" \"$BLACKBOXDATA/$BB_FILES_FILE\"\nvcs_add \"$BLACKBOXDATA/$BB_ADMINS_FILE\" \"$BLACKBOXDATA/$BB_FILES_FILE\"\n\nif [[ $VCS_TYPE = \"git\" ]]; then\n\n # Set .gitattributes so that Windows users don't break the admin files.\n FILE=\"$BLACKBOXDATA/.gitattributes\"\n touch \"$FILE\"\n LINE='blackbox-admins.txt text eol=lf'\n grep -qF \"$LINE\" \"$FILE\" || echo \"$LINE\" >> \"$FILE\"\n LINE='blackbox-files.txt text eol=lf'\n grep -qF \"$LINE\" \"$FILE\" || echo \"$LINE\" >> \"$FILE\"\n vcs_add \"$FILE\"\nfi\n\nif [[ $VCS_TYPE = \"svn\" ]]; then\n\techo\n\techo\n\techo '`subversion` automatically tracks the ignored files; you just need to commit.'\nelse\n\tIGNOREFILE=\"$(vcs_ignore_file_path)\"\n\ttest -f \"$IGNOREFILE\" && vcs_add \"$IGNOREFILE\"\n\n\t# Make a suggestion:\n\techo\n\techo\n\techo 'NEXT STEP: You need to manually check these in:'\n\techo ' ' $VCS_TYPE commit -m\\'INITIALIZE BLACKBOX\\' \"$BLACKBOXDATA\" \"$IGNOREFILE\"\nfi\n" }, { "path": "bin/blackbox_list_admins", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_list_admins -- List authorized admins\n#\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\ncat \"$BB_ADMINS\"\n" }, { "path": "bin/blackbox_list_files", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_list_files -- List files that black box is tracking\n#\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\ncat \"$BB_FILES\"\n" }, { "path": "bin/blackbox_listadmins", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_listadmins -- List active admins for keyring\n#\n\n# Example:\n# blackbox_listadmins\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nfail_if_not_in_repo\n\n\n# simply display the contents of the admins file\ncat \"$BB_ADMINS\"\n" }, { "path": "bin/blackbox_postdeploy", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_postdeploy -- Decrypt all blackbox files.\n#\n\n# Usage:\n# blackbox_postdeploy.sh [GROUP]\n# GROUP is optional. If supplied, the resulting files\n# are chgrp'ed to that group.\n\n# Since this is often run in a security-critical situation, we\n# force /usr/bin and /bin to the front of the PATH.\nexport PATH=/usr/bin:/bin:\"$PATH\"\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nif [[ \"$1\" == \"\" ]]; then\n FILE_GROUP=\"\"\nelse\n FILE_GROUP=\"$1\"\nfi\n\nchange_to_vcs_root\nprepare_keychain\n\n# Decrypt:\necho '========== Decrypting new/changed files: START'\nwhile IFS= read <&99 -r unencrypted_file; do\n encrypted_file=$(get_encrypted_filename \"$unencrypted_file\")\n decrypt_file_overwrite \"$encrypted_file\" \"$unencrypted_file\"\n cp_permissions \"$encrypted_file\" \"$unencrypted_file\"\n if [[ ! -z \"$FILE_GROUP\" ]]; then\n chmod g+r \"$unencrypted_file\"\n chgrp \"$FILE_GROUP\" \"$unencrypted_file\"\n fi\ndone 99<\"$BB_FILES\"\n\necho '========== Decrypting new/changed files: DONE'\n" }, { "path": "bin/blackbox_recurse", "content": "#!/usr/bin/env bash\n# proposed space for blackbox recurion...coming soon\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\necho \"$REBOBASE\"\n" }, { "path": "bin/blackbox_register_new_file", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_register_new_file -- Enroll new file(s) in the blackbox system.\n#\n# Takes previously unencrypted file(s) and enrolls them into the blackbox\n# system. Each file will be kept in the repo as an encrypted file. On deployment\n# to systems that need the plaintext (unencrypted) versions, run\n# blackbox_postdeploy.sh to decrypt all the files.\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nfunction register_new_file() {\n unencrypted_file=$(get_unencrypted_filename \"$1\")\n encrypted_file=$(get_encrypted_filename \"$1\")\n\n if [[ \"$1\" == \"$encrypted_file\" ]]; then\n echo ERROR: Please only register unencrypted files.\n exit 1\n fi\n\n echo \"========== PLAINFILE $unencrypted_file\"\n echo \"========== ENCRYPTED $encrypted_file\"\n\n fail_if_not_exists \"$unencrypted_file\" \"Please specify an existing file.\"\n fail_if_exists \"$encrypted_file\" \"Will not overwrite.\"\n\n prepare_keychain\n encrypt_file \"$unencrypted_file\" \"$encrypted_file\"\n add_filename_to_cryptlist \"$unencrypted_file\"\n vcs_ignore \"$unencrypted_file\"\n\n # Is the unencrypted file already in HG? (ie. are we correcting a bad situation)\n SECRETSEXPOSED=$(is_in_vcs \"${unencrypted_file}\")\n echo \"========== CREATED: ${encrypted_file}\"\n echo \"========== UPDATING REPO:\"\n shred_file \"$unencrypted_file\"\n\n if [[ \"$SECRETSEXPOSED\" == \"true\" ]] ; then\n vcs_remove \"$unencrypted_file\"\n vcs_add \"$encrypted_file\"\n fi\n\n echo 'NOTE: \"already tracked!\" messages are safe to ignore.'\n vcs_add \"$BB_FILES\" \"$encrypted_file\"\n vcs_commit \"registered in blackbox: ${unencrypted_file}\" \"$BB_FILES\" \"$encrypted_file\" \"$(vcs_ignore_file_path)\"\n}\n\nfor target in \"$@\"; do\n register_new_file \"$target\"\ndone\n\necho \"========== UPDATING VCS: DONE\"\nif [[ $VCS_TYPE = \"svn\" ]]; then\n\techo \"Local repo updated and file pushed to source control (unless an error was displayed).\"\nelse\n\techo \"Local repo updated. Please push when ready.\"\n\techo \" $VCS_TYPE push\"\nfi\n" }, { "path": "bin/blackbox_removeadmin", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_removeadmin -- Remove an admin to the system\n# NOTE: Does not remove admin from the keyring.\n#\n\n# Example:\n# blackbox_removeadmin tal@example.com\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nfail_if_not_in_repo\n\nKEYNAME=\"$1\"\n: \"${KEYNAME:?ERROR: First argument must be a keyname (email address)}\" ;\n\n# Remove the email address from the BB_ADMINS file.\nremove_line \"$BB_ADMINS\" \"$KEYNAME\"\n\n\n# remove the admin key from the pubring\n$GPG --no-permission-warning --homedir=\"$KEYRINGDIR\" --batch --yes --delete-key \"$KEYNAME\" || true\npubring_path=$(get_pubring_path)\nvcs_add \"$pubring_path\" \"$KEYRINGDIR/trustdb.gpg\" \"$BB_ADMINS\"\n\n\n# Make a suggestion:\necho\necho\necho 'NEXT STEP: Check these into the repo. Probably with a command like...'\necho $VCS_TYPE commit -m\\'REMOVED ADMIN: $KEYNAME\\' \"$BLACKBOXDATA/$(basename ${pubring_path})\" \"$BLACKBOXDATA/trustdb.gpg\" \"$BLACKBOXDATA/$BB_ADMINS_FILE\"\n" }, { "path": "bin/blackbox_shred_all_files", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_shred_all_files -- shred all decrypted versions of encrypted files\n#\n# Shred: To securely delete a file.\n#\n# Typical uses:\n# After running blackbox_edit_start, deciding not to edit the file.\n# A developer that wants to securely clean up a workspace before deleting it.\n# An automated process that doesn't want to leave\n# plaintext (unencrypted) files laying around.\n#\n# NOTE: The output lists files that were decrypted and are being\n# shredded. For example, if you have many encrypted files but none\n# have been decrypted for editing, you will see an empty list.\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nchange_to_vcs_root\n\necho '========== FILES BEING SHREDDED:'\n\nexported_internal_shred_file() {\n source \"$1/_blackbox_common.sh\"\n #unencrypted_file=$(get_unencrypted_filename \"$2\")\n unencrypted_file=\"$2\"\n if [[ -f \"$unencrypted_file\" ]]; then\n echo \" SHRED: $unencrypted_file\"\n shred_file \"$unencrypted_file\"\n else\n echo \"NOT FOUND: $unencrypted_file\"\n fi\n}\n\nexport -f exported_internal_shred_file\n\nDEREFERENCED_BIN_DIR=\"${0%/*}\"\nMAX_PARALLEL_SHRED=10\n\nbash_args=\nif bash --help | grep import-functions >/dev/null 2>/dev/null; then\n bash_args=--import-functions\nfi\n\nexport IFS=\ntr '\\n' '\\0' <\"$BB_FILES\" | xargs -0 -I{} -P $MAX_PARALLEL_SHRED bash $bash_args -c \"exported_internal_shred_file $DEREFERENCED_BIN_DIR \\\"{}\\\"\" $DEREFERENCED_BIN_DIR/fake\n\necho '========== DONE.'\n" }, { "path": "bin/blackbox_update_all_files", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_update_all_files -- Decrypt then re-encrypt all files. Useful after keys are changed.\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\ngpg_agent_notice\ndisclose_admins\nprepare_keychain\n\necho '========== ENCRYPTED FILES TO BE RE-ENCRYPTED:'\nwhile IFS= read <&99 -r unencrypted_file; do\n echo \" $unencrypted_file.gpg\"\ndone 99<\"$BB_FILES\"\n\necho '========== FILES IN THE WAY:'\nneed_warning=false\nwhile IFS= read <&99 -r unencrypted_file; do\n unencrypted_file=$(get_unencrypted_filename \"$unencrypted_file\")\n encrypted_file=$(get_encrypted_filename \"$unencrypted_file\")\n if [[ -f \"$unencrypted_file\" ]]; then\n need_warning=true\n echo \" $unencrypted_file\"\n fi\ndone 99<\"$BB_FILES\"\nif \"$need_warning\" ; then\n echo\n echo 'WARNING: This will overwrite any unencrypted files laying about.'\n read -r -p 'Press CTRL-C now to stop. ENTER to continue: '\nelse\n echo 'All OK.'\nfi\n\necho '========== RE-ENCRYPTING FILES:'\nwhile IFS= read <&99 -r unencrypted_file; do\n unencrypted_file=$(get_unencrypted_filename \"$unencrypted_file\")\n encrypted_file=$(get_encrypted_filename \"$unencrypted_file\")\n echo ========== PROCESSING '\"'$unencrypted_file'\"'\n fail_if_not_on_cryptlist \"$unencrypted_file\"\n decrypt_file_overwrite \"$encrypted_file\" \"$unencrypted_file\"\n encrypt_file \"$unencrypted_file\" \"$encrypted_file\"\n shred_file \"$unencrypted_file\"\ndone 99<\"$BB_FILES\"\n\nfail_if_keychain_has_secrets\n\necho '========== COMMITING TO VCS:'\nwhile IFS= read <&99 -r unencrypted_file; do\n vcs_add \"$unencrypted_file.gpg\"\ndone 99<\"$BB_FILES\"\nvcs_commit 'Re-encrypted keys'\n\necho '========== DONE.'\necho 'Likely next step:'\necho \" $VCS_TYPE push\"\n" }, { "path": "bin/blackbox_view", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_view -- Decrypt a file, view it, shred it\n#\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nfor param in \"$@\" ; do\n shreddable=0\n unencrypted_file=$(get_unencrypted_filename \"$param\")\n if [[ ! -e \"$unencrypted_file\" ]]; then\n \"${BLACKBOX_HOME}/blackbox_edit_start\" \"$param\"\n shreddable=1\n fi\n ${PAGER:-less} \"$unencrypted_file\"\n if [[ $shreddable = 1 ]]; then\n shred_file \"$unencrypted_file\"\n fi\ndone\n" }, { "path": "bin/blackbox_whatsnew", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_whatsnew - show what has changed in the last commit for a given file\n#\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nif [[ $# -ne 1 ]]\nthen\n echo \"Pass only 1 file at a time\"\n exit 1\nfi\n\nfail_if_not_in_repo\ngpg_agent_notice\n\nCOLUMNS=`tput cols`\nFILE=$1\nGIT=\"git log --abbrev-commit --pretty=oneline\"\nCURR_COMMIT=`$GIT $FILE | head -1 | awk '{print $1}'`\nPREV_COMMIT=`$GIT ${CURR_COMMIT}~1 $FILE | head -1 | awk '{print $1}'`\n# Use colordiff if available\nif which colordiff > /dev/null 2>&1\n then DIFF=\"colordiff\"\n else DIFF=\"diff\"\nfi\n\ncat_commit()\n{\n COMMIT=$1\n git checkout $COMMIT $FILE\n echo \"[$COMMIT] $FILE\"\n echo \"---------------------\"\n \"${BLACKBOX_HOME}/blackbox_cat\" $FILE | sed '/========== PLAINFILE/,/========== EXTRACTING/d'\n}\n\nCURR_CONTENT=`cat_commit $CURR_COMMIT`\nPREV_CONTENT=`cat_commit $PREV_COMMIT`\nclear\n\n# For some unknown reason this command executes fine but return exit code 1\n$DIFF -y --width $COLUMNS \\\n <(echo \"CURRENT\" \"$CURR_CONTENT\" | fold -w $(( $COLUMNS / 2 - 4 )) ) \\\n <(echo \"PREVIOUS\" \"$PREV_CONTENT\" | fold -w $(( $COLUMNS / 2 - 4 )) )\n\ngit checkout $CURR_COMMIT $FILE\necho\n" }, { "path": "binv2/blackbox_addadmin", "content": "#!/usr/bin/env bash\nexec blackbox admin add \"$@\"\n" }, { "path": "binv2/blackbox_cat", "content": "#!/usr/bin/env bash\nexec blackbox cat \"$@\"\n" }, { "path": "binv2/blackbox_decrypt_all_files", "content": "#!/usr/bin/env bash\nexec blackbox decrypt --all --agentcheck=true --overwrite \"@\"\n" }, { "path": "binv2/blackbox_decrypt_file", "content": "#!/usr/bin/env bash\nexec blackbox decrypt --overwrite \"$@\"\n" }, { "path": "binv2/blackbox_deregister_file", "content": "#!/usr/bin/env bash\nexec blackbox file remove --safe \"$@\"\n" }, { "path": "binv2/blackbox_diff", "content": "#!/usr/bin/env bash\nexec blackbox diff --diff \"$@\"\n" }, { "path": "binv2/blackbox_edit", "content": "#!/usr/bin/env bash\nexec blackbox edit \"$@\"\n" }, { "path": "binv2/blackbox_edit_end", "content": "#!/usr/bin/env bash\nexec blackbox encrypt --shred \"$@\"\n" }, { "path": "binv2/blackbox_edit_start", "content": "#!/usr/bin/env bash\nexec blackbox decrypt \"$@\"\n" }, { "path": "binv2/blackbox_initialize", "content": "#!/usr/bin/env bash\nexec blackbox init \"$@\"\n" }, { "path": "binv2/blackbox_list_admins", "content": "#!/usr/bin/env bash\nexec blackbox admin list\n" }, { "path": "binv2/blackbox_list_files", "content": "#!/usr/bin/env bash\nexec blackbox file list\n" }, { "path": "binv2/blackbox_listadmins", "content": "#!/usr/bin/env bash\nexec blackbox admin list\n" }, { "path": "binv2/blackbox_postdeploy", "content": "#!/usr/bin/env bash\nblackbox decrypt --all --overwrite --group \"$1\"\n" }, { "path": "binv2/blackbox_register_new_file", "content": "#!/usr/bin/env bash\nexec blackbox file add --shred \"$@\"\n" }, { "path": "binv2/blackbox_removeadmin", "content": "#!/usr/bin/env bash\nexec blackbox admin remove \"$@\"\n" }, { "path": "binv2/blackbox_shred_all_files", "content": "#!/usr/bin/env bash\nexec blackbox shred --all\n" }, { "path": "binv2/blackbox_update_all_files", "content": "#!/usr/bin/env bash\nexec blackbox reencrypt --all --agentcheck\n" }, { "path": "binv2/blackbox_view", "content": "#!/usr/bin/env bash\nblackbox cat \"$@\" | ${PAGER:-less}\n" }, { "path": "binv2/blackbox_whatsnew", "content": "#!/usr/bin/env bash\n\n#\n# blackbox_whatsnew - show what has changed in the last commit for a given file\n#\nexec blackbox whatsnew \"$@\"\nexit 0\n\nset -e\nsource \"${0%/*}/_blackbox_common.sh\"\n\nif [[ $# -ne 1 ]]\nthen\n echo \"Pass only 1 file at a time\"\n exit 1\nfi\n\nfail_if_not_in_repo\ngpg_agent_notice\n\nCOLUMNS=`tput cols`\nFILE=$1\nGIT=\"git log --abbrev-commit --pretty=oneline\"\nCURR_COMMIT=`$GIT $FILE | head -1 | awk '{print $1}'`\nPREV_COMMIT=`$GIT ${CURR_COMMIT}~1 $FILE | head -1 | awk '{print $1}'`\n# Use colordiff if available\nif which colordiff > /dev/null 2>&1\n then DIFF=\"colordiff\"\n else DIFF=\"diff\"\nfi\n\ncat_commit()\n{\n COMMIT=$1\n git checkout $COMMIT $FILE\n echo \"[$COMMIT] $FILE\"\n echo \"---------------------\"\n \"${BLACKBOX_HOME}/blackbox_cat\" $FILE | sed '/========== PLAINFILE/,/========== EXTRACTING/d'\n}\n\nCURR_CONTENT=`cat_commit $CURR_COMMIT`\nPREV_CONTENT=`cat_commit $PREV_COMMIT`\nclear\n\n# For some unknown reason this command executes fine but return exit code 1\n$DIFF -y --width $COLUMNS \\\n <(echo \"CURRENT\" \"$CURR_CONTENT\" | fold -w $(( $COLUMNS / 2 - 4 )) ) \\\n <(echo \"PREVIOUS\" \"$PREV_CONTENT\" | fold -w $(( $COLUMNS / 2 - 4 )) )\n\ngit checkout $CURR_COMMIT $FILE\necho\n" }, { "path": "blackbox.plugin.zsh", "content": "#!/usr/bin/env zsh\n# The MIT License (MIT)\n\n# Copyright (c) 2014 Stack Exchange, Inc.\n\n# Permission is hereby granted, free of charge, to any person obtaining a copy\n# of this software and associated documentation files (the \"Software\"), to deal\n# in the Software without restriction, including without limitation the rights\n# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n# copies of the Software, and to permit persons to whom the Software is\n# furnished to do so, subject to the following conditions:\n\n# The above copyright notice and this permission notice shall be included in\n# all copies or substantial portions of the Software.\n\n# THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\n# THE SOFTWARE.\n\n# Make it easy to install with antigen and other frameworks that can cope\n# with antigen/oh-my-zsh bundles\n#\n# antigen bundle StackExchange/blackbox\n\n# Add our plugin's bin diretory to user's path\nPLUGIN_BIN=\"$(dirname $0)/bin\"\nexport PATH=\"${PATH}:${PLUGIN_BIN}\"\n" }, { "path": "build/build.go", "content": "package main\n\nimport (\n\t\"flag\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\t\"os/exec\"\n\t\"strings\"\n\t\"time\"\n)\n\nvar sha = flag.String(\"sha\", \"\", \"SHA of current commit\")\n\nvar goos = flag.String(\"os\", \"\", \"OS to build (linux, windows, or darwin) Defaults to all.\")\n\nfunc main() {\n\tflag.Parse()\n\tflags := fmt.Sprintf(`-s -w -X main.SHA=\"%s\" -X main.BuildTime=%d`, getVersion(), time.Now().Unix())\n\tpkg := \"github.com/StackExchange/blackbox/v2/cmd/blackbox\"\n\n\tbuild := func(out, goos string) {\n\t\tlog.Printf(\"Building %s\", out)\n\t\tcmd := exec.Command(\"go\", \"build\", \"-o\", out, \"-ldflags\", flags, pkg)\n\t\tos.Setenv(\"GOOS\", goos)\n\t\tos.Setenv(\"GO111MODULE\", \"on\")\n\t\tcmd.Stderr = os.Stderr\n\t\tcmd.Stdout = os.Stdout\n\t\terr := cmd.Run()\n\t\tif err != nil {\n\t\t\tlog.Fatal(err)\n\t\t}\n\t}\n\n\tfor _, env := range []struct {\n\t\tbinary, goos string\n\t}{\n\t\t{\"blackbox-Linux\", \"linux\"},\n\t\t{\"blackbox.exe\", \"windows\"},\n\t\t{\"blackbox-Darwin\", \"darwin\"},\n\t} {\n\t\tif *goos == \"\" || *goos == env.goos {\n\t\t\tbuild(env.binary, env.goos)\n\t\t}\n\t}\n}\n\nfunc getVersion() string {\n\tif *sha != \"\" {\n\t\treturn *sha\n\t}\n\t// check teamcity build version\n\tif v := os.Getenv(\"BUILD_VCS_NUMBER\"); v != \"\" {\n\t\treturn v\n\t}\n\t// check git\n\tcmd := exec.Command(\"git\", \"rev-parse\", \"HEAD\")\n\tv, err := cmd.CombinedOutput()\n\tif err != nil {\n\t\treturn \"\"\n\t}\n\tver := strings.TrimSpace(string(v))\n\t// see if dirty\n\tcmd = exec.Command(\"git\", \"diff-index\", \"--quiet\", \"HEAD\", \"--\")\n\terr = cmd.Run()\n\t// exit status 1 indicates dirty tree\n\tif err != nil {\n\t\tif err.Error() == \"exit status 1\" {\n\t\t\tver += \"[dirty]\"\n\t\t} else {\n\t\t\tlog.Printf(\"!%s!\", err.Error())\n\t\t}\n\t}\n\treturn ver\n}\n" }, { "path": "cmd/blackbox/blackbox.go", "content": "package main\n\nimport (\n\t\"fmt\"\n\t\"os\"\n\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/crypters\"\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/crypters/_all\"\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/vcs\"\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/vcs/_all\"\n)\n\nvar dryRun bool\n\nfunc main() {\n\tapp := flags()\n\terr := app.Run(os.Args)\n\tif err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"ERROR: %s\\n\", err)\n\t\tos.Exit(1)\n\t}\n}\n" }, { "path": "cmd/blackbox/cli.go", "content": "package main\n\n// cli.go -- Create urfave/cli datastructures and apply them.\n\nimport (\n\t\"fmt\"\n\n\t\"github.com/urfave/cli/v2\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/bbutil\"\n)\n\nfunc flags() *cli.App {\n\tapp := cli.NewApp()\n\tapp.Version = \"2.0.0\"\n\tapp.Usage = \"Maintain encrypted files in a VCS (Git, Hg, Svn)\"\n\n\tdefUmask := bbutil.Umask(0)\n\tbbutil.Umask(defUmask)\n\tdefUmaskS := fmt.Sprintf(\"%04o\", defUmask)\n\n\tapp.Flags = []cli.Flag{\n\t\t//\t\t&cli.BoolFlag{\n\t\t//\t\t\tName: \"dry-run\",\n\t\t//\t\t\tAliases: []string{\"n\"},\n\t\t//\t\t\tUsage: \"show what would have been done\",\n\t\t//\t\t\tDestination: &dryRun,\n\t\t//\t\t},\n\t\t&cli.StringFlag{\n\t\t\tName: \"vcs\",\n\t\t\tUsage: \"Use this VCS (GIT, NONE) rather than autodetect\",\n\t\t\tEnvVars: []string{\"BLACKBOX_VCS\"},\n\t\t},\n\t\t&cli.StringFlag{\n\t\t\tName: \"crypto\",\n\t\t\tUsage: \"Crypto back-end plugin\",\n\t\t\tValue: \"GnuPG\",\n\t\t\tEnvVars: []string{\"BLACKBOX_CRYPTO\"},\n\t\t},\n\t\t&cli.StringFlag{\n\t\t\tName: \"config\",\n\t\t\tUsage: \"Path to config\",\n\t\t\t//Value: \".blackbox\",\n\t\t\tEnvVars: []string{\"BLACKBOX_CONFIGDIR\", \"BLACKBOXDATA\"},\n\t\t},\n\t\t&cli.StringFlag{\n\t\t\tName: \"team\",\n\t\t\tUsage: \"Use .blackbox-$TEAM as the configdir\",\n\t\t\tEnvVars: []string{\"BLACKBOX_TEAM\"},\n\t\t},\n\t\t&cli.StringFlag{\n\t\t\tName: \"editor\",\n\t\t\tUsage: \"editor to use\",\n\t\t\tValue: \"vi\",\n\t\t\tEnvVars: []string{\"EDITOR\", \"BLACKBOX_EDITOR\"},\n\t\t},\n\t\t&cli.StringFlag{\n\t\t\tName: \"umask\",\n\t\t\tUsage: \"umask to set when decrypting\",\n\t\t\tValue: defUmaskS,\n\t\t\tEnvVars: []string{\"BLACKBOX_UMASK\", \"DECRYPT_UMASK\"},\n\t\t},\n\t\t&cli.BoolFlag{\n\t\t\tName: \"debug\",\n\t\t\tUsage: \"Show debug output\",\n\t\t\tEnvVars: []string{\"BLACKBOX_DEBUG\"},\n\t\t},\n\t}\n\n\tapp.Commands = []*cli.Command{\n\n\t\t// List items in the order they appear in the help menu.\n\n\t\t{\n\t\t\tName: \"decrypt\",\n\t\t\tAliases: []string{\"de\", \"start\"},\n\t\t\tUsage: \"Decrypt file(s)\",\n\t\t\tFlags: []cli.Flag{\n\t\t\t\t&cli.BoolFlag{Name: \"all\", Usage: \"All registered files\"},\n\t\t\t\t&cli.BoolFlag{Name: \"agentcheck\", Usage: \"Do not check for gpg-agent when using --all\"},\n\t\t\t\t&cli.StringFlag{Name: \"group\", Usage: \"Set group ownership\"},\n\t\t\t\t&cli.BoolFlag{Name: \"overwrite\", Usage: \"Overwrite plaintext if it exists\"},\n\t\t\t},\n\t\t\tAction: func(c *cli.Context) error { return cmdDecrypt(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"encrypt\",\n\t\t\tAliases: []string{\"en\", \"end\"},\n\t\t\tUsage: \"Encrypts file(s)\",\n\t\t\tFlags: []cli.Flag{\n\t\t\t\t&cli.BoolFlag{Name: \"shred\", Usage: \"Remove plaintext afterwards\"},\n\t\t\t},\n\t\t\tAction: func(c *cli.Context) error { return cmdEncrypt(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"edit\",\n\t\t\tAliases: []string{\"vi\"},\n\t\t\tUsage: \"Runs $EDITOR on file(s) (decrypt if needed)\",\n\t\t\tAction: func(c *cli.Context) error { return cmdEdit(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"cat\",\n\t\t\tUsage: \"Output plaintext to stderr (decrypt if needed)\",\n\t\t\tAction: func(c *cli.Context) error { return cmdCat(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"diff\",\n\t\t\tUsage: \"Diffs against encrypted version\",\n\t\t\tFlags: []cli.Flag{\n\t\t\t\t&cli.BoolFlag{Name: \"all\", Usage: \"all files\"},\n\t\t\t},\n\t\t\tAction: func(c *cli.Context) error { return cmdDiff(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"init\",\n\t\t\tCategory: \"ADMINISTRATIVE\",\n\t\t\tUsage: \"Initialized blackbox for this repo\",\n\t\t\tAction: func(c *cli.Context) error { return cmdInit(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"admin\",\n\t\t\tCategory: \"ADMINISTRATIVE\",\n\t\t\tUsage: \"Add/list/remove administrators\",\n\t\t\tSubcommands: []*cli.Command{\n\t\t\t\t{\n\t\t\t\t\tName: \"add\",\n\t\t\t\t\tUsage: \"Adds admin(s)\",\n\t\t\t\t\tAction: func(c *cli.Context) error { return cmdAdminAdd(c) },\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tName: \"list\",\n\t\t\t\t\tUsage: \"Lists admins\",\n\t\t\t\t\tAction: func(c *cli.Context) error { return cmdAdminList(c) },\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tName: \"remove\",\n\t\t\t\t\tUsage: \"Remove admin(s)\",\n\t\t\t\t\tAction: func(c *cli.Context) error { return cmdAdminRemove(c) },\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\n\t\t{\n\t\t\tName: \"file\",\n\t\t\tCategory: \"ADMINISTRATIVE\",\n\t\t\tUsage: \"Add/list/remove files from the registry\",\n\t\t\tSubcommands: []*cli.Command{\n\t\t\t\t{\n\t\t\t\t\tName: \"add\",\n\t\t\t\t\tUsage: \"Registers file with the system\",\n\t\t\t\t\tFlags: []cli.Flag{\n\t\t\t\t\t\t&cli.BoolFlag{Name: \"shred\", Usage: \"Remove plaintext afterwords\"},\n\t\t\t\t\t},\n\t\t\t\t\tAction: func(c *cli.Context) error { return cmdFileAdd(c) },\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tName: \"list\",\n\t\t\t\t\tUsage: \"Lists the registered files\",\n\t\t\t\t\tAction: func(c *cli.Context) error { return cmdFileList(c) },\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tName: \"remove\",\n\t\t\t\t\tUsage: \"Deregister file from the system\",\n\t\t\t\t\tAction: func(c *cli.Context) error { return cmdFileRemove(c) },\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\n\t\t{\n\t\t\tName: \"info\",\n\t\t\tCategory: \"DEBUG\",\n\t\t\tUsage: \"Report what we know about this repo\",\n\t\t\tAction: func(c *cli.Context) error { return cmdInfo(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"shred\",\n\t\t\tUsage: \"Shred files, or --all for all registered files\",\n\t\t\tFlags: []cli.Flag{\n\t\t\t\t&cli.BoolFlag{Name: \"all\", Usage: \"All registered files\"},\n\t\t\t},\n\t\t\tAction: func(c *cli.Context) error { return cmdShred(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"status\",\n\t\t\tCategory: \"ADMINISTRATIVE\",\n\t\t\tUsage: \"Print status of files\",\n\t\t\tFlags: []cli.Flag{\n\t\t\t\t&cli.BoolFlag{Name: \"name-only\", Usage: \"Show only names of the files\"},\n\t\t\t\t&cli.BoolFlag{Name: \"all\", Usage: \"All registered files\"},\n\t\t\t\t&cli.StringFlag{Name: \"type\", Usage: \"only list if status matching this string\"},\n\t\t\t},\n\t\t\tAction: func(c *cli.Context) error { return cmdStatus(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"reencrypt\",\n\t\t\tUsage: \"Decrypt then re-encrypt files (erases any plaintext)\",\n\t\t\tCategory: \"ADMINISTRATIVE\",\n\t\t\tFlags: []cli.Flag{\n\t\t\t\t&cli.BoolFlag{Name: \"all\", Usage: \"All registered files\"},\n\t\t\t\t&cli.BoolFlag{Name: \"overwrite\", Usage: \"Overwrite plaintext if it exists\"},\n\t\t\t\t&cli.BoolFlag{Name: \"agentcheck\", Usage: \"Do not check for gpg-agent when using --all\"},\n\t\t\t},\n\t\t\tAction: func(c *cli.Context) error { return cmdReencrypt(c) },\n\t\t},\n\n\t\t{\n\t\t\tName: \"testing_init\",\n\t\t\tUsage: \"For use with integration test\",\n\t\t\tCategory: \"INTEGRATION TEST\",\n\t\t\tAction: func(c *cli.Context) error { return testingInit(c) },\n\t\t},\n\n\t\t//\n\n\t}\n\n\treturn app\n}\n" }, { "path": "cmd/blackbox/drive.go", "content": "package main\n\n// Now that cli.go has processed the flags, validate there are no\n// conflicts and drive to the business logic.\n\nimport (\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/bblog\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/box\"\n\t\"github.com/urfave/cli/v2\"\n)\n\nvar logErr *log.Logger\n\nfunc init() {\n\tif logErr == nil {\n\t\tlogErr = log.New(os.Stderr, \"\", 0)\n\t}\n}\n\nfunc allOrSomeFiles(c *cli.Context) error {\n\tif c.Bool(\"all\") && c.Args().Present() {\n\t\treturn fmt.Errorf(\"Can not specify filenames and --all\")\n\t}\n\tif (!c.Args().Present()) && (!c.Bool(\"all\")) {\n\t\treturn fmt.Errorf(\"Must specify at least one file name or --all\")\n\t}\n\treturn nil\n}\n\nconst roError = `This command is disabled due to --config flag being used.\nWe can not determine if the flag's value is in or out of the repo, and\nBlackbox can only work on one repo at a time. If the value is inside the\nrepo, and you'd like to suggest an algorithm that would let us determine that\nautomatically, please file a bug. We'd love to have this work better. In the\nmeanwhile, run this command without the --config flag, perhaps after cd'ing\nto the base of the repo.`\n\n// Keep these functions in alphabetical order.\n\nfunc cmdAdminAdd(c *cli.Context) error {\n\tif c.NArg() == 0 || c.NArg() > 2 {\n\t\treturn fmt.Errorf(\n\t\t\t\"Must specify one admin's GnuPG user-id (i.e. email address) and optionally the directory of the pubkey data (default ~/.GnuPG)\")\n\t}\n\tbx := box.NewFromFlags(c)\n\tif bx.ConfigRO {\n\t\treturn fmt.Errorf(roError)\n\t}\n\terr := bx.AdminAdd(c.Args().Get(0), c.Args().Get(1))\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdAdminList(c *cli.Context) error {\n\tif c.Args().Present() {\n\t\treturn fmt.Errorf(\"This command takes zero arguments\")\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.AdminList()\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdAdminRemove(c *cli.Context) error {\n\tif !c.Args().Present() {\n\t\treturn fmt.Errorf(\"Must specify at least one admin's GnuPG user-id (i.e. email address)\")\n\t}\n\tbx := box.NewFromFlags(c)\n\tif bx.ConfigRO {\n\t\treturn fmt.Errorf(roError)\n\t}\n\terr := bx.AdminRemove(c.Args().Slice())\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdCat(c *cli.Context) error {\n\tif !c.Args().Present() {\n\t\treturn fmt.Errorf(\"Must specify at least one file name\")\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.Cat(c.Args().Slice())\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdDecrypt(c *cli.Context) error {\n\tif err := allOrSomeFiles(c); err != nil {\n\t\treturn err\n\t}\n\n\t// The default for --agentcheck is off normally, and on when using --all.\n\tpauseNeeded := c.Bool(\"all\")\n\t// If the user used the flag, abide by it.\n\tif c.IsSet(\"agentcheck\") {\n\t\tpauseNeeded = c.Bool(\"agentcheck\")\n\t}\n\n\tbx := box.NewFromFlags(c)\n\terr := bx.Decrypt(c.Args().Slice(),\n\t\tc.Bool(\"overwrite\"),\n\t\tpauseNeeded,\n\t\tc.String(\"group\"),\n\t)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdDiff(c *cli.Context) error {\n\tif err := allOrSomeFiles(c); err != nil {\n\t\treturn err\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.Diff(c.Args().Slice())\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdEdit(c *cli.Context) error {\n\tif !c.Args().Present() {\n\t\treturn fmt.Errorf(\"Must specify at least one file name\")\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.Edit(c.Args().Slice())\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdEncrypt(c *cli.Context) error {\n\tif err := allOrSomeFiles(c); err != nil {\n\t\treturn err\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.Encrypt(c.Args().Slice(), c.Bool(\"shred\"))\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdFileAdd(c *cli.Context) error {\n\tif !c.Args().Present() {\n\t\treturn fmt.Errorf(\"Must specify at least one file name\")\n\t}\n\tbx := box.NewFromFlags(c)\n\tif bx.ConfigRO {\n\t\treturn fmt.Errorf(roError)\n\t}\n\terr := bx.FileAdd(c.Args().Slice(), c.Bool(\"shred\"))\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdFileList(c *cli.Context) error {\n\tif c.Args().Present() {\n\t\treturn fmt.Errorf(\"This command takes zero arguments\")\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.FileList()\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdFileRemove(c *cli.Context) error {\n\tif !c.Args().Present() {\n\t\treturn fmt.Errorf(\"Must specify at least one file name\")\n\t}\n\tbx := box.NewFromFlags(c)\n\tif bx.ConfigRO {\n\t\treturn fmt.Errorf(roError)\n\t}\n\terr := bx.FileRemove(c.Args().Slice())\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdInfo(c *cli.Context) error {\n\tif c.Args().Present() {\n\t\treturn fmt.Errorf(\"This command takes zero arguments\")\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.Info()\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdInit(c *cli.Context) error {\n\tif c.Args().Len() > 1 {\n\t\treturn fmt.Errorf(\"This command takes one or two arguments\")\n\t}\n\tbx := box.NewUninitialized(c)\n\tif bx.ConfigRO {\n\t\treturn fmt.Errorf(roError)\n\t}\n\terr := bx.Init(c.Args().First(), c.String(\"vcs\"))\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdReencrypt(c *cli.Context) error {\n\tif err := allOrSomeFiles(c); err != nil {\n\t\treturn err\n\t}\n\n\t// The default for --agentcheck is off normally, and on when using --all.\n\tpauseNeeded := c.Bool(\"all\")\n\t// If the user used the flag, abide by it.\n\tif c.IsSet(\"agentcheck\") {\n\t\tpauseNeeded = c.Bool(\"agentcheck\")\n\t}\n\n\tbx := box.NewFromFlags(c)\n\terr := bx.Reencrypt(c.Args().Slice(),\n\t\tc.Bool(\"overwrite\"),\n\t\tpauseNeeded,\n\t)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdShred(c *cli.Context) error {\n\tif err := allOrSomeFiles(c); err != nil {\n\t\treturn err\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.Shred(c.Args().Slice())\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\nfunc cmdStatus(c *cli.Context) error {\n\tif c.Bool(\"all\") && c.Args().Present() {\n\t\treturn fmt.Errorf(\"Can not specify filenames and --all\")\n\t}\n\tbx := box.NewFromFlags(c)\n\terr := bx.Status(c.Args().Slice(), c.Bool(\"name-only\"), c.String(\"type\"))\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n\n// These are \"secret\" commands used by the integration tests.\n\nfunc testingInit(c *cli.Context) error {\n\tif c.Args().Present() {\n\t\treturn fmt.Errorf(\"No args required\")\n\t}\n\n\tlogDebug := bblog.GetDebug(c.Bool(\"debug\"))\n\tlogDebug.Printf(\n\t\t\"c.String(vcs) reports %q\\n\",\n\t\tc.String(\"vcs\"),\n\t)\n\tbx := box.NewForTestingInit(c.String(\"vcs\"))\n\tif bx.ConfigRO {\n\t\treturn fmt.Errorf(roError)\n\t}\n\terr := bx.TestingInitRepo()\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn bx.Vcs.FlushCommits()\n}\n" }, { "path": "docs/README.md", "content": "BlackBox\n========\n\nBlackbox is an open source tool that enables you to safe store sensitive information in\nGit (or other) repos by encrypting them with GPG. Only the encrypted\nversion of the file is available. You can be free to provide access\nto the repo, as but only people with the right GPG keys can access the\nencrypted data.\n\nThings you should **never** store in a repo without encryption:\n\n* TLS (SSL) certificates\n* Passwords\n* API keys\n* And more!\n\nProject Info:\n\n* [Overview](user-overview.md)\n* [Why is this important?](why-is-this-important.md)\n* [Support/Community](support.md)\n* [How BB encrypts](encryption.md)\n* [OS Compatibility](compatibility.md)\n* [Installation Instructions](installation.md)\n* [Alternatives](alternatives.md)\n\nUser Info:\n\n* [Enabling Blackbox on a Repo](enable-repo.md)\n* [Enroll a file](enable-repo.md)\n* [Full Command List](full-command-list.md)\n* [Add/Remove users](admin-ops.md)\n* [Add/Remove files](file-ops.md)\n* [Advanced techiques](advanced.md)\n* [Use with Role Accounts](role-accounts.md)\n* [Backwards Compatibility](backwards-compatibility.md)\n* [Replacing expired keys](expired-keys.md)\n* [Git Tips](git-tips.md)\n* [SubVersion Tips](subversion-tips.md)\n* [GnuPG tips](gnupg-tips.md)\n* [Use with Ansible](with-ansible.md)\n* [Use with Puppet](with-puppet.md)\n\nFor contributors:\n\n* [Developer Info](dev.md)\n* [Code overview](dev-code-overview.md)\n* [HOWTO: Add new OS support](dev-add-os-support.md)\n* [HOWTO: Add new VCS support](dev-add-vcs-support.md)\n\n\nA slide presentation about an older release [is on SlideShare](http://www.slideshare.net/TomLimoncelli/the-blackbox-project-sfae).\n\nJoin our mailing list: [https://groups.google.com/d/forum/blackbox-project](https://groups.google.com/d/forum/blackbox-project)\n\n\nLicense\n=======\n\nThis content is released under the MIT License.\nSee the [LICENSE.txt](LICENSE.txt) file.\n" }, { "path": "docs/admin-ops.md", "content": "User Management\n===============\n\n\n# Who are the current admins?\n\n```\nblackbox admin list\n```\n\n\n# Add a new user (admin)\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\n`.blackbox/blackbox-admins.txt` is a file that lists which users are able to decrypt files. (More pedantically, it is a list of the GnuPG key names that the file is encrypted for.)\n\nTo join the list of people that can edit the file requires three steps; You create a GPG key and add it to the key ring. Then, someone that already has access adds you to the system. Lastly, you should test your access.\n\n## Step 1: NEWPERSON creates a GPG key pair on a secure machine and add to public keychain.\n\nIf you don't already have a GPG key, here's how to generate one:\n\n```\ngpg --gen-key\n```\n\nWARNING: New versions of GPG generate keys which are not understood by\nold versions of GPG. If you generate a key with a new version of GPG,\nthis will cause problems for users of older versions of GPG.\nTherefore it is recommended that you either assure that everyone using\nBlackbox have the exact same version of GPG, or generate GPG keys\nusing a version of GPG as old as the oldest version of GPG used by\neveryone using Blackbox.\n\nPick defaults for encryption settings, 0 expiration. Pick a VERY GOOD\npassphrase. Store a backup of the private key someplace secure. For\nexample, keep the backup copy on a USB drive that is locked in safe.\nOr, at least put it on a secure machine with little or no internet\naccess, full-disk-encryption, etc. Your employer probably has rules\nabout how to store such things.\n\nFYI: If generating the key is slow, this is usually because the system\nisn't generating enough entropy. Tip: Open another window on that\nmachine and run this command: `ls -R /`\n\nNow that you have a GPG key, add yourself as an admin:\n\n```\nblackbox admin add KEYNAME\n```\n\n...where \"KEYNAME\" is the email address listed in the gpg key you created previously. For example:\n\n```\nblackbox admin add tal@example.com\n```\n\nWhen the command completes successfully, instructions on how to commit these changes will be output. Run the command as given to commit the changes. It will look like this:\n\n```\ngit commit -m'NEW ADMIN: tal@example.com' .blackbox/pubring.gpg .blackbox/trustdb.gpg .blackbox/blackbox-admins.txt\n```\n\n\nThen push it to the repo:\n\n```\ngit push\n\nor\n\nht push\n\n(or whatever is appropriate)\n```\n\nNOTE: Creating a Role Account? If you are adding the pubring.gpg of a role account, you can specify the directory where the pubring.gpg file can be found as a 2nd parameter: `blackbox admin add puppetmaster@puppet-master-1.example.com /path/to/the/dir`\n\n## Step 2: AN EXISTING ADMIN accepts you into the system.\n\nAsk someone that already has access to re-encrypt the data files. This\ngives you access. They simply decrypt and re-encrypt the data without\nmaking any changes.\n\nPre-check: Verify the new keys look good.\n\n```\ngit pull # Or whatever is required for your system\ngpg --homedir=.blackbox --list-keys\n```\n\nFor example, examine the key name (email address) to make sure it conforms to corporate standards.\n\nImport the keychain into your personal keychain and reencrypt:\n\n```\ngpg --import .blackbox/pubring.gpg\nblackbox reencrypt --all shred\n```\n\nPush the re-encrypted files:\n\n```\ngit commit -a\ngit push\n\nor\n\nhg commit\nhg push\n```\n\n### Step 3: NEWPERSON tests.\n\nMake sure you can decrypt a file. (Suggestion: Keep a dummy file in\nVCS just for new people to practice on.)\n\n\n# Remove a user\n\nSimply run `blackbox admin remove` with their keyname then re-encrypt:\n\nExample:\n\n```\nblackbox admin remove olduser@example.com\nblackbox reencrypt --all shred\n```\n\nWhen the command completes, you will be given a reminder to check in the change and push it.\n\nNote that their keys will still be in the key ring, but they will go unused. If you'd like to clean up the keyring, use the normal GPG commands and check in the file.\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\n```\ngpg --homedir=.blackbox --list-keys\ngpg --homedir=.blackbox --delete-key olduser@example.com\ngit commit -m'Cleaned olduser@example.com from keyring' .blackbox/*\n```\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\nThe key ring only has public keys. There are no secret keys to delete.\n\nRemember that this person did have access to all the secrets at one time. They could have made a copy. Therefore, to be completely secure, you should change all passwords, generate new SSL keys, and so on just like when anyone that had privileged access leaves an organization.\n\n" }, { "path": "docs/advanced.md", "content": "Advanced Techniques\n===================\n\n\n# Using Blackbox without a repo\n\nIf the files are copied out of a repo they can still be decrypted and\nedited. Obviously edits, changes to keys, and such will be lost if\nthey are made outside the repo. Also note that commands are most\nlikely to only work if run from the base directory (i.e. the parent to\nthe .blackbox directory).\n\nWithout a repo, all commands must be run from the same directory\nas the \".blackbox\" directory. It might work otherwise but no\npromises.\n\n\n# Mixing gpg 1.x/2.0 and 2.2\n\nWARNING: Each version of GnuPG uses a different, and incompatible,\nbinary format to store the keychain. When Blackbox was originally\ncreated, I didn't know this. Things are mostly upwards compatible.\nThat said, if you have some admins with GnuPG 1.x and others with GnuPG 2.2,\nyou may corrupt the keychain.\n\nA future version will store the keychain in an GnuPG-approved\nversion-neutral format.\n\n\n# Having gpg and gpg2 on the same machine\n\nNOTE: This is not implemented at this time. TODO(tlim) Use GPG to find\nthe binary.\n\nIn some situations, team members or automated roles need to install gpg\n2.x alongside the system gpg version 1.x to catch up with the team's gpg\nversion. On Ubuntu 16, you can ```apt-get install gnupg2``` which\ninstalls the binary gpg2. If you want to use this gpg2 binary, run every\nblackbox command with GPG=gpg2.\n\nFor example:\n\n```\nGPG=gpg2 blackbox_postdeploy\n```\n\n" }, { "path": "docs/alternatives.md", "content": "Alternatives\n============\n\nHere are other open source packages that do something similar to\nBlackBox. If you like them better than BlackBox, please use them.\n\n- [git-crypt](https://www.agwa.name/projects/git-crypt/)\n- [Pass](http://www.zx2c4.com/projects/password-store/)\n- [Transcrypt](https://github.com/elasticdog/transcrypt)\n- [Keyringer](https://keyringer.pw/)\n- [git-secret](https://github.com/sobolevn/git-secret)\n\ngit-crypt has the best git integration. Once set up it is nearly\ntransparent to the users. However it only works with git.\n" }, { "path": "docs/backwards-compatibility.md", "content": "Backwards Compatibility\n=======================\n\n# Where is the configuration stored? .blackbox vs. keyrings/live\n\nBlackbox stores its configuration data in the `.blackbox` subdirectory. Older\nrepos use `keyrings/live`. For backwards compatibility either will work.\n\nAll documentation refers to `.blackbox`.\n\nYou can convert an old repo by simply renaming the directory:\n\n```\nmv keyrings/live .blackbox\nrmdir keyrings\n```\n\nThere is no technical reason to convert old repos except that it is less\nconfusing to users.\n\nThis change was made in commit 60e782a0, release v1.20180615.\n\n\n# How blackbox fines the config directory:\n\n## Creating the repo:\n\n`blackbox init` creates the config directory in the root\nof the repo. Here's how it picks the name:\n\n- If `$BLACKBOX_TEAM` is set, `.blackbox-$BLACKBOX_TEAM` is used.\n- If the flag `--team ` is set, it uses `.blackbox-`\n- Otherwise, it uses `.blackbox`\n\nWhen searching for the configuration directory, the following\nlocations are checked. First match wins.\n\n- `.blackbox-$BLACKBOX_TEAM` (only if `$BLACKBOX_TEAM` is set)\n- The value of `--config value` (if the flag is set)\n- `$BLACKBOX_CONFIGDIR` (the preferred env. variable to use)\n- `$BLACKBOXDATA` (for backwards compatibility with v1)\n- `.blackbox`\n- `keyrings/live` (for backwards compatibility)\n\nNOTE: The env variables and `--config` should be set to the full path\nto the config directory (i.e.: `/Users/tom/gitstuff/myrepo/.blackbox`).\nIf it is set to a relative directory (i.e. `.blackbox` or\n`../myrepo/.blackbox`) most commands will break.\n\nNOTE: Why the change from `$BLACKBOXDATA` to `$BLACKBOX_CONFIGDIR`? We want\nall the env. variables to begin with the prefix `BLACKBOX_`. If v1\nsupported another name, that is still supported. If you are starting\nwith v2 and have no other users using v1, please use the `BLACKBOX_`\nprefix.\n\n" }, { "path": "docs/compatibility.md", "content": "Compatibility\n=============\n\n# Compatibility with Blackbox v1\n\nThe command names all changed from v1 to v2. The `binv2` directory\nincludes shell scripts that provide full backwards compatibility.\n\n# Supported Architectures\n\nBlackbox supports a plug-in archtecture to easily support multiple VCS\nsystem. Current support is for:\n\n## Supported VCS/DVCS systems\n\n* git\n* \"none\" (repo-less use is supported)\n* WOULD LOVE VOLUNTEERS TO HELP ADD SUPPORT FOR: hg, svn, p4\n\n## Supported GPG versions\n\n* Git 1.x and 2.0\n* Git 2.2 and higher\n* WOULD LOVE VOLUNTEERS TO HELP ADD SUPPORT FOR:\n golang.org/x/crypto/openpgp (this would make the code have no\n external dependencies)\n\n## Supported Operating systems\n\nBlackbox should work on any Linux system with GnuPG installed.\nBlackbox simply looks for `gpg` in `$PATH`.\n\nWindows: It should work (but has not been extensively tested) on\nWindows WSL2.\n\n# Automated testing\n\nWhile many combinations work, we do automated tests\non these combinations. If any of these fail it blocks the release:\n\n* macOS: GnuPG 2.2 executables from https://gpgtools.org/\n* CentOS: GnuPG 2.0.x executables from the \"base\" or \"updates\" repo.\n\nWindows native: VOLUNTEER NEEDED to make a native Windows version\n(should be rather simple as Go does most of the work)\n\nNOTE: Version 1 worked on CentOS/RedHat, macOS, Gygwin, WinGW, NetBSD,\nand SmartOS. Hopefully we can achieve that broad level of support in\nthe future. Any system that is supported by the Go language and\nhas GuPG 2.0.x or higher binaries available should be easy to achieve.\nWe'd also like to have automated testing for the same.\n\n# Windows Support\n\nBlackBox assumes that `blackbox-admins.txt` and `blackbox-files.txt` will have\nLF line endings. Windows users should be careful to configure Git or other systems\nto not convert or \"fix\" those files.\n\nIf you use Git, add the following lines to your `.gitattributes` file:\n\n **/blackbox-admins.txt text eol=lf\n **/blackbox-files.txt text eol=lf\n\nThe `blackbox init` (and newer versions of `blackbox_initialize`)\nwill create an appropriate `.gitattributes` file for you.\n\n# Cygwin\n\nTODO: List what packages are required for building the software.\n\nTODO: List what packages are required for running the software.\n\n\n# MinGW\n\nMinGW (comes with Git for Windows) support requires the following:\n\nTODO: FILL IN any requirements\n" }, { "path": "docs/dev-code-overview.md", "content": "Code Overview\n=============\n\nHere is how the code is laid out.\n\nTODO(tlim): Add a diagram of the layers\n\n```\ncmd/blackbox/ The command line tool.\n blackbox.go main()\n cli.go Definition of all subcommands and flags\n drive.go Processes flags and calls functions in verbs.go\n NOTE: These are the only files that are aware of the\n flags. Everything else gets the flag data passed to it\n as a parameter. This way the remaining system can be\n used as a module.\n\npkg/box/ High-level functions related to \"the black box\".\n verbs.go One function per subcommand.\n box.go Functions for manipulating the files in .blackbox\n boxutils.go Helper functions for the above.\n\npkg/bblog/ Module that provides logging facilities.\npkg/bbutil/ Functions that are useful to box, plug-ins, etc.\npkg/tainedname/ Module for printing filenames escaped for Bash.\n\nmodels/vcs.go The interface that defines a VCS plug-in.\nmodels/crypters.go The interface that defines a GPG plug-in.\n\npkg/crypters/ Plug-ins for GPG functionality.\npkg/crypters/gnupg Plug-in that runs an external gpg binary (found via $PATH)\n\npkg/vcs/ Plug-ins for VCS functionality.\npkg/vcs/none Repo-less mode.\npkg/vcs/git Git mode.\n```\n" }, { "path": "docs/dev.md", "content": "Developer Info\n==============\n\nCode submissions are gladly welcomed! The code is fairly easy to read.\n\nGet the code:\n\n```\ngit clone git@github.com:StackExchange/blackbox.git\n```\n\nTest your changes:\n\n```\ngo test ./...\n```\n\nThis runs through a number of system tests. It creates a repo,\nencrypts files, decrypts files, and so on. You can run these tests to\nverify that the changes you made didn't break anything. You can also\nuse these tests to verify that the system works with a new operating\nsystem.\n\nPlease submit tests with code changes:\n\nThe best way to change BlackBox is via Test Driven Development. First\nadd a test to `tools/confidence.sh`. This test should fail, and\ndemonstrate the need for the change you are about to make. Then fix\nthe bug or add the feature you want. When you are done, `make\nconfidence` should pass all tests. The PR you submit should include\nyour code as well as the new test. This way the confidence tests\naccumulate as the system grows as we know future changes don't break\nold features.\n\nNote: More info about compatibility are on the [Compatibility Page](compatibility.md)\n\n" }, { "path": "docs/enable-repo.md", "content": "Enabling Blackbox on a Repo\n===========================\n\nOverview:\n1. Run the initialization command\n2. Add at least one admin.\n3. Add files. (don't add files before the admins)\n\nThe long version:\n\n1. If you don't have a GPG key, set it up using instructions such as:\n[Set up GPG key](https://help.github.com/articles/generating-a-new-gpg-key/). \\\nNow you are ready to go.\n\n1. `cd` into a Git, Mercurial, Subversion or Perforce repository and run `blackbox init`.\n\n1. Add yourself with `blackbox admin add YOUR@EMAIL`\n\n1. Commit the files as directed.\n\nThat's it!\n\nAt this point you should encrypt a file and make sure you can decrypt\nit. This verifies that everything is working as expected.\n\n\n1. Pick a file to be encrypted. Since this is a test, you might want\n to create a test file. Call it `secret.txt` and edit the file\n so that it includes your mother's maiden name. Just kidding!\n Store this sentence: `This is my test file.`\n\n2. Run `blackbox file add secret.txt`\n\n3. Decode the encrypted version: `blackbox cat secret.txt`\n\nThe \"cat\" subcommand only accesses the encrypted (`.gpg`) file and is\na good way to see that the file was encrypted properly. You should\nsee `This is my test file.` \n\n4 Verify that editing the file works.\n\nTo view and/or edit a file, run `blackbox edit --shred secret.txt`\n\nNow encrypt it and shred the original:\n\n```\nblackbox encrypt --shred secret.txt\n```\n\nNow make sure you can decrypt the new file:\n\n```\nblackbox cat secret.txt\n```\n\nYou should see the changed text.\n\nNow commit and push `secret.txt.gpg` and you are done!\n" }, { "path": "docs/encryption.md", "content": "How is the encryption done?\n===========================\n\nGPG has many different ways to encrypt a file. BlackBox uses the mode\nthat lets you specify a list of keys that can decrypt the message.\n\nIf you have 5 people (\"admins\") that should be able to access the\nsecrets, each creates a GPG key and adds their public key to the\nkeychain. The GPG command used to encrypt the file lists all 5 key\nnames, and therefore any 1 key can decrypt the file.\n\nBlackbox stores a copy of the public keys of all admins. It never\nstores the private keys.\n\nTo remove someone's access, remove that admin's key name (i.e. email\naddress) from the list of admins and re-encrypt all the files. They\ncan still read the .gpg file (assuming they have access to the\nrepository) but they can't decrypt it any more.\n\n*What if they kept a copy of the old repo before you removed access?*\nYes, they can decrypt old versions of the file. This is why when an\nadmin leaves the team, you should change all your passwords, SSL\ncerts, and so on. You should have been doing that before BlackBox,\nright?\n\n*Why don't you use symmetric keys?* In other words, why mess with all\nthis GPG key stuff and instead why don't we just encrypt all the files\nwith a single passphrase. Yes, GPG supports that, but then we are\nmanaging a shared password, which is fraught with problems. If someone\n\"leaves the team\" we would have to communicate to everyone a new\npassword. Now we just have to remove their key. This scales better.\n\n*How do automated processes decrypt without asking for a password?*\nGPG requires a passphrase on a private key. However, it permits the\ncreation of subkeys that have no passphrase. For automated processes,\ncreate a subkey that is only stored on the machine that needs to\ndecrypt the files. For example, at Stack Exchange, when our Continuous\nIntegration (CI) system pushes a code change to our Puppet masters,\nthey run `blackbox decrypt --all --overwrite` to decrypt all the files.\nThe user that\nruns this code has a subkey that doesn't require a passphrase. Since\nwe have many masters, each has its own key. And, yes, this means our\nPuppet Masters have to be very secure. However, they were already\nsecure because, like, dude... if you can break into someone's puppet\nmaster you own their network.\n\n*If you use Puppet, why didn't you just use hiera-eyaml?* There are 4\nreasons:\n\n1. This works with any Git or Mercurial repo, even if you aren't using Puppet.\n2. hiera-eyaml decrypts \"on demand\" which means your Puppet Master now uses a lot of CPU to decrypt keys every time it is contacted. It slows down your master, which, in my case, is already slow enough.\n3. This works with binary files, without having to ASCIIify them and paste them into a YAML file. Have you tried to do this with a cert that is 10K long and changes every few weeks? Ick.\n4. hiera-eyaml didn't exist when I wrote this. (That's the real reason.)\n\n" }, { "path": "docs/expired-keys.md", "content": "Replacing expired keys\n======================\n\nIf someone's key has already expired, blackbox will stop\nencrypting. You see this error:\n\n```\n$ blackbox_edit_end modified_file.txt\n--> Error: can't re-encrypt because a key has expired.\n```\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\nYou can also detect keys that are about to expire by issuing this command and manually reviewing the \"expired:\" dates:\n\n gpg --homedir=.blackbox --list-keys\n\nor... list UIDs that will expire within 1 month from today: (Warning: this also lists keys without an expiration date)\n\n gpg --homedir=.blackbox --list-keys --with-colons --fixed-list-mode | grep ^uid | awk -F: '$6 < '$(( $(date +%s) + 2592000))\n\nHere's how to replace the key:\n\n- Step 1. Administrator removes expired user:\n\nWarning: This process will erase any unencrypted files that you were in the process of editing. Copy them elsewhere and restore the changes when done.\n\n```\nblackbox_removeadmin expired_user@example.com\n# This next command overwrites any changed unencrypted files. See warning above.\nblackbox_update_all_files\ngit commit -m \"Re-encrypt all files\"\ngpg --homedir=.blackbox --delete-key expired_user@example.com\ngit commit -m 'Cleaned expired_user@example.com from keyring' .blackbox/*\ngit push\n```\n\n- Step 2. Expired user adds an updated key:\n\n```\ngit pull\nblackbox_addadmin updated_user@example.com\ngit commit -m'NEW ADMIN: updated_user@example.com .blackbox/pubring.gpg .blackbox/trustdb.gpg .blackbox/blackbox-admins.txt\ngit push\n```\n\n- Step 3. Administrator re-encrypts all files with the updated key of the expired user:\n\n```\ngit pull\ngpg --import .blackbox/pubring.gpg\nblackbox_update_all_files\ngit commit -m \"Re-encrypt all files\"\ngit push\n```\n\n- Step 4: Clean up:\n\nAny files that were temporarily copied in the first step so as to not be overwritten can now be copied back and re-encrypted with the `blackbox_edit_end` command.\n\n(Thanks to @chishaku for finding a solution to this problem!)\n\n" }, { "path": "docs/file-ops.md", "content": "How to add/remove a file into the system?\n=========================================\n\n# Adding files:\n\n- If you need to, start the GPG Agent: `eval $(gpg-agent --daemon)`\n- Add the file to the system:\n\n```\nblackbox file add path/to/file.name.key\n\n# If you want to delete the old plaintext:\nblackbox file add --shred path/to/file.name.key\n```\n\nMultiple file names can be specified on the command line:\n\nExample 1: Register 2 files:\n\n```\nblackbox file add --shred file1.txt file2.txt\n```\n\nExample 2: Register all the files in `$DIR`:\n\n```\nfind $DIR -type f -not -name '*.gpg' -print0 | xargs -0 blackbox file add\n```\n\n\n# Removing files\n\nThis command\n\n```\nblackbox file remove path/to/file.name.key\n```\n\nTODO(tlim): Add examples.\n\n# List files\n\nTo see what files are currently enrolled in the system:\n\n```\nblackbox file list\n```\n\nYou can also see their status:\n\n```\nblackbox status\nblackbox status just_one_file.txt\nblackbox status --type ENCRYPTED\n```\n" }, { "path": "docs/full-command-list.md", "content": "Blackbox Command List\n=====================\n\n## Global Flags\n### `--vcs`\n### `--crypto`\n### `--config`\n### `--team`\n### `--editor`\n### `--umask`\n### `--debug`\n### `--help`\n### `--help`\n### `--version`\n## User Commands\n### `blackbox decrypt`\n### `blackbox encrypt`\n### `blackbox edit`\n### `blackbox cat`\n### `blackbox diff`\n### `blackbox shred`\n### `blackbox help`\n## User Commands\n### `blackbox init`\n### `blackbox admin`\n### `blackbox file`\n### `blackbox status`\n### `blackbox reencrypt`\n## Debug\n### `blackbox info`\n## Integration Test (secret menu)\n### `blackbox testing_init`\n\nTODO(tlim): Can we automatically generate this? The data is all in cli.go\n" }, { "path": "docs/git-tips.md", "content": "GIT tips\n========\n\n\n# Configure git to show diffs in encrypted files\n\nIt's possible to tell Git to decrypt versions of the file before running them through `git diff` or `git log`. To achieve this do:\n\n- Add the following to `.gitattributes` at the top of the git repository:\n\n```\n*.gpg diff=blackbox\n```\n\n- Add the following to `.git/config`:\n\n```\n[diff \"blackbox\"]\n textconv = gpg --use-agent -q --batch --decrypt\n````\n\nCommands like `git log -p file.gpg` and `git diff master --` will display as expected.\n" }, { "path": "docs/gnupg-tips.md", "content": "GnuPG tips\n==========\n\n# Common error messages\n\n* Message: `gpg: filename: skipped: No public key`\n* Solution: Usually this means there is an item in\n `.blackbox/blackbox-admins.txt` that is not the name of the key.\n Either something invalid was inserted (like a filename instead of a\n username) or a user has left the organization and their key was\n removed from the keychain, but their name wasn't removed from the\n blackbox-admins.txt file.\n\n* Message: `gpg: decryption failed: No secret key`\n* Solution: Usually means you forgot to re-encrypt the file with the new key.\n\n* Message: `Error: can't re-encrypt because a key has expired.`\n* Solution: A user's key has expired and can't be used to encrypt any more. Follow the [Replace expired keys](expired-keys.md) page.\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\n# GnuPG problems\n\nBlackbox is just a front-end to GPG. If you get into a problem with a\nkey or file, you'll usually have better luck asking for advice on\nthe gnupg users mailing list TODO: Get link to this list\n\n\nThe author of Blackbox is not a GnuPG expert. He wrote Blackbox\nbecause it was better than trying to remember GPG's horrible flag\nnames.\n" }, { "path": "docs/installation.md", "content": "Installation Instructions\n=========================\n\nCurrently blackbox v2 is installed by compiling the code and\ncopying the binary someplace:\n\nTODO:\n\n```\ngit clone FILL IN\n```\n\nFuture: We will have RPM, DEB, Chocolately packages.\n\n\nNext step: [Enable on a repo](enable-repo.md)\n\n" }, { "path": "docs/role-accounts.md", "content": "Set up automated users or \"role accounts\"\n=========================================\n\nTODO(tlim): I think this is overly complex. With GnuPG 2.2 and later,\nyou can use `--password '' --quick-generate-key userid` and you are\ndone. No need for subkeys. Maybe rework this?\n\nWith role accounts, you have an automated system that needs to be able\nto decrypt secrets without a password. This means the security of your\nrepo is based on how locked down the automation system is. This\nis risky, so be careful.\n\n\ni.e. This is how a Puppet Master can have access to the unencrypted data.\n\nFYI: Your repo may use `keyrings/live` instead of `.blackbox`. See \"Where is the configuration stored?\"\n\nAn automated user (a \"role account\") is one that that must be able to decrypt without a passphrase. In general you'll want to do this for the user that pulls the files from the repo to the master. This may be automated with Jenkins CI or other CI system.\n\nGPG keys have to have a passphrase. However, passphrases are optional on subkeys. Therefore, we will create a key with a passphrase then create a subkey without a passphrase. Since the subkey is very powerful, it should be created on a very secure machine.\n\nThere's another catch. The role account probably can't check files into Git/Mercurial. It probably only has read-only access to the repo. That's a good security policy. This means that the role account can't be used to upload the subkey public bits into the repo.\n\nTherefore, we will create the key/subkey on a secure machine as yourself. From there we can commit the public portions into the repo. Also from this account we will export the parts that the role account needs, copy them to where the role account can access them, and import them as the role account.\n\nProTip: If asked to generate entropy, consider running this on the same machine in another window: `sudo dd if=/dev/sda of=/dev/null`\n\nFor the rest of this doc, you'll need to make the following substitutions:\n\n- ROLEUSER: svc_deployacct or whatever your role account's name is.\n- NEWMASTER: the machine this role account exists on.\n- SECUREHOST: The machine you use to create the keys.\n\nNOTE: This should be more automated/scripted. Patches welcome.\n\nOn SECUREHOST, create the puppet master's keys:\n\n```\n$ mkdir /tmp/NEWMASTER\n$ cd /tmp/NEWMASTER\n$ gpg --homedir . --gen-key\nYour selection?\n (1) RSA and RSA (default)\nWhat keysize do you want? (2048) DEFAULT\nKey is valid for? (0) DEFAULT\n\n# Real name: Puppet CI Deploy Account\n# Email address: svc_deployacct@hostname.domain.name\n```\n\nNOTE: Rather than a real email address, use the username@FQDN of the host the key will be used on. If you use this role account on many machines, each should have its own key. By using the FQDN of the host, you will be able to know which key is which. In this doc, we'll refer to username@FQDN as $KEYNAME\n\nSave the passphrase somewhere safe!\n\nCreate a sub-key that has no password:\n\n```\n$ gpg --homedir . --edit-key svc_deployacct\ngpg> addkey\n(enter passphrase)\n Please select what kind of key you want:\n (3) DSA (sign only)\n (4) RSA (sign only)\n (5) Elgamal (encrypt only)\n (6) RSA (encrypt only)\nYour selection? 6\nWhat keysize do you want? (2048)\nKey is valid for? (0)\nCommand> key 2\n(the new subkey has a \"*\" next to it)\nCommand> passwd\n(enter the main key's passphrase)\n(enter an empty passphrase for the subkey... confirm you want to do this)\nCommand> save\n```\n\nNow securely export this directory to NEWMASTER:\n\n```\ngpg --homedir . --export -a svc_sadeploy >/tmp/NEWMASTER/pubkey.txt\ntar cvf /tmp/keys.tar .\nrsync -avP /tmp/keys.tar NEWMASTER:/tmp/.\n```\n\nOn NEWMASTER, receive the new GnuPG config:\n\n```\nsudo -u svc_deployacct bash\nmkdir -m 0700 -p ~/.gnupg\ncd ~/.gnupg && tar xpvf /tmp/keys.tar\n```\n\n\n\nBack on SECUREHOST, add the new email address to .blackbox/blackbox-admins.txt:\n\n```\ncd /path/to/the/repo\nblackbox_addadmin $KEYNAME /tmp/NEWMASTER\n```\n\nVerify that secring.gpg is a zero-length file. If it isn't, you have somehow added a private key to the keyring. Start over.\n\n```\ncd .blackbox\nls -l secring.gpg\n```\n\nCommit the recent changes:\n\n```\ncd .blackbox\ngit commit -m\"Adding key for KEYNAME\" pubring.gpg trustdb.gpg blackbox-admins.txt\n```\n\nRegenerate all encrypted files with the new key:\n\n```\nblackbox_update_all_files\ngit status\ngit commit -m\"updated encryption\" -a\ngit push\n```\n\nOn NEWMASTER, import the keys and decrypt the files:\n\n```\nsudo -u svc_sadeploy bash # Become the role account.\ngpg --import /etc/puppet/.blackbox/pubring.gpg\nexport PATH=$PATH:/path/to/blackbox/bin\nblackbox_postdeploy\nsudo -u puppet cat /etc/puppet/hieradata/blackbox.yaml # or any encrypted file.\n```\n\nProTip: If you get \"gpg: decryption failed: No secret key\" then you forgot to re-encrypt blackbox.yaml with the new key.\n\nOn SECUREHOST, securely delete your files:\n\n```\ncd /tmp/NEWMASTER\n# On machines with the \"shred\" command:\nshred -u /tmp/keys.tar\nfind . -type f -print0 | xargs -0 shred -u\n# All else:\nrm -rf /tmp/NEWMASTER\n```\n\nAlso shred any other temporary files you may have made.\n\n\n\n" }, { "path": "docs/subversion-tips.md", "content": "Subversion Tips\n===============\n\nNOTE: This is from v1. Can someone that uses Subversion check\nthis and update it?\n\n\nThe current implementation will store the blackbox in `/keyrings` at\nthe root of the entire repo. This will create an issue between\nenvironments that have different roots (i.e. checking out `/` on\ndevelopment vs `/releases/foo` in production). To get around this, you\ncan `export BLACKBOX_REPOBASE=/path/to/repo` and set a specific base\nfor your repo.\n\nThis was originally written for git and supports a two-phase commit,\nin which `commit` is a local commit and \"push\" sends the change\nupstream to the version control server when something is registered or\nderegistered with the system. The current implementation will\nimmediately `commit` a file (to the upstream subversion server) when\nyou execute a `blackbox_*` command.\n\n" }, { "path": "docs/support.md", "content": "Support\n=======\n\n# Join our community!\n\nJoin the [blackbox-project mailing list](https://groups.google.com/d/forum/blackbox-project)!\n\n\n\n# How to submit bugs or ask questions?\n\nWe welcome questions, bug reports and feedback!\n\nThe best place to start is to join the [blackbox-project mailing list](https://groups.google.com/d/forum/blackbox-project) and ask there.\n\nBugs are tracked here in Github. Please feel free to [report bugs](https://github.com/StackExchange/blackbox/issues) yourself.\n" }, { "path": "docs/user-overview.md", "content": "User Guide\n==========\n\n# Overview\n\nSuppose you have a VCS repository (i.e. a Git or Mercurial repo) and\ncertain files contain secrets such as passwords or SSL private keys.\nOften people just store such files \"and hope that nobody finds them in\nthe repo\". That's not safe. Hope is not a strategy.\n\nWith BlackBox, those files are stored encrypted using GPG. Access to\nthe repo without also having the right GPG keys makes those files as worthless\nas random bits. As long as you keep your GPG keys safe, you don't\nhave to worry about storing your VCS repo on an untrusted server or\nletting anyone clone the repo.\n\nHeck, even if you trust your server, now you don't have to trust the\npeople that do backups of that server!\n\nEach person (\"admin\") of the system can decrypt all the files using\ntheir GPG key, which has its own passphrase. The authorized GPG keys\ncan decrypt any file. This is better than systems that use one\nGPG key (and passphrase) that must be shared among a group of people.\nIt is much better than having one passphrase for each file (I don't\nthink anyone actually does that).\n\nSince any admin's GPG key can decrypt the files, if one person leaves\nthe company, you don't have to communicate a new passphrase to everyone.\nSimply disable the one key that should no longer have access.\nThe process for doing this is as easy as running 2 commands (1 to\ndisable their key, 1 to re-encrypt all files.) Obviously if they kept\na copy of the repo (and their own passphrase) before leaving the\ncompany, they have access to the secrets. However, you should rotate\nthose secrets anyway. (\"rotate secrets\" means changing the passwords,\nregenerating TLS certs, and so on).\n\n# Sample session:\n\nFirst we are going to list the files currently in the blackbox. In\nthis case, it is an SSH private key.\n\n```\n$ blackbox file list\nmodules/log_management/files/id_rsa\n```\n\nExcellent! Our coworkers have already registered a file with the\nsystem. Let's decrypt it, edit it, and re-encrypt it.\n\n```\n$ blackbox decrypt modules/log_management/files/id_rsa\n========== DECRYPTING \"modules/log_management/files/id_rsa\"\n$ vi modules/log_management/files/id_rsa\n```\n\nThat was easy so far!\n\nWhen we encrypt it, Blackbox will not commit the changes, but it\nwill give a hint that you should. It spells out the exact command you\nneed to type and even proposes a commit message.\n\n```\n$ blackbox encrypt modules/log_management/files/id_rsa\n========== ENCRYPTING \"modules/log_management/files/id_rsa\"\n\nNEXT STEP: You need to manually check these in:\n git commit -m\"ENCRYPTED modules/log_management/files/id_rsa\" modules/log_management/files/id_rsa.gpg\n```\n\nYou can also use `blackbox edit ` to decrypt a file, edit it\n(it will call `$EDITOR`) and re-encrypt it.\n\n\nNow let's register a new file with the blackbox system.\n`data/pass.yaml` is a small file that stores a very important\npassword. In this example, we had just stored the unecrypted\npassword in our repo. That's bad. Let's encrypt it.\n\n```\n$ blackbox file add data/pass.yaml\n========== SHREDDING (\"/bin/rm\", \"-f\"): \"data/pass.yaml\"\n\nNEXT STEP: You need to manually check these in:\n git commit -m\"NEW FILES: data/pass.yaml\" .gitignore keyrings/live/blackbox-files.txt modules/stacklb/pass.yaml modules/stacklb/pass.yaml.gpg\n```\n\nBefore we commit the change, let's do a `git status` to see what else\nhas changed.\n\n```\n$ git status\nOn branch master\nChanges to be committed:\n (use \"git restore --staged ...\" to unstage)\n\tmodified: .gitignore\n\tmodified: keyrings/live/blackbox-files.txt\n\tdeleted: modules/stacklb/pass.yaml\n\tnew file: modules/stacklb/pass.yaml.gpg\n\n```\n\nNotice that a number of files were modified:\n\n* `.gitignore`: This file is updated to include the plaintext\n filename, so that you don't accidentally add it to the repo in the\n future.\n* `.blackbox/blackbox-files.txt`: The list of files that are registered with the system.\n* `data/pass.yaml`: The file we encrypted is deleted from the repo.\n* `data/pass.yaml.gpg`: The encrypted file is added to the repo.\n\nEven though pass.yaml was deleted from the repo, it is still in the\nrepo's history. Anyone with an old copy of the repo, or a new copy\nthat knows how to view the repo's history, can see the secret\npassword. For that reason, you should change the password and\nre-encrypt the file. This is an important point. Blackbox is not\nmagic and it doesn't have a \"Men In Black\"-style neuralizer that\ncan make people forget the past. If someone leaves a project, you\nhave to change the old passwords, etc.\n\nThose are the basics. Your next step might be:\n\n* TODO: How to enable Blackbox for a repo.\n* TODO: How to add yourself as an admin to a repo.\n* TODO: Complete list of [all blackbox commands](all-commands)\n" }, { "path": "docs/why-is-this-important.md", "content": "Why encrypt your secrets?\n=========================\n\nOBVIOUSLY we don't want secret things like SSL private keys and\npasswords to be leaked.\n\nNOT SO OBVIOUSLY when we store \"secrets\" in a VCS repo like Git or\nMercurial, suddenly we are less able to share our code with other\npeople. Communication between subteams of an organization is hurt. You\ncan't collaborate as well. Either you find yourself emailing\nindividual files around (yuck!), making a special repo with just the\nfiles needed by your collaborators (yuck!!), or just deciding that\ncollaboration isn't worth all that effort (yuck!!!).\n\nThe ability to be open and transparent about our code, with the\nexception of a few specific files, is key to the kind of collaboration\nthat DevOps and modern IT practitioners need to do.\n" }, { "path": "docs/with-ansible.md", "content": "How to use the secrets with Ansible?\n===================================\n\nAnsible Vault provides functionality for encrypting both entire files\nand strings stored within files; however, keeping track of the\npassword(s) required for decryption is not handled by this module.\n\nInstead one must specify a password file when running the playbook.\n\nAnsible example for password file: `my_secret_password.txt.gpg`\n\n```\nansible-playbook --vault-password-file my_secret_password.txt site.yml\n```\n\nAlternatively, one can specify this in the\n`ANSIBLE_VAULT_PASSWORD_FILE` environment variable.\n\n" }, { "path": "docs/with-puppet.md", "content": "How to use the secrets with Puppet?\n===================================\n\n# Entire files:\n\nEntire files, such as SSL certs and private keys, are treated just\nlike regular files. You decrypt them any time you push a new release\nto the puppet master.\n\nExample of an encrypted file named `secret_file.key.gpg`\n\n* Plaintext file is: `modules/${module_name}/files/secret_file.key`\n* Encrypted file is: `modules/${module_name}/files/secret_file.key.gpg`\n* Puppet sees it as: `puppet:///modules/${module_name}/secret_file.key`\n\nPuppet code that stores `secret_file.key` in `/etc/my_little_secret.key`:\n\n```\nfile { '/etc/my_little_secret.key':\n ensure => 'file',\n owner => 'root',\n group => 'puppet',\n mode => '0760',\n source => \"puppet:///modules/${module_name}/secret_file.key\", # No \".gpg\"\n}\n```\n\n# Small strings:\n\nFor small strings such as passwords and API keys, it makes sense\nto store them in an (encrypted) YAML file which is then made\navailable via hiera.\n\nFor example, we use a file called `blackbox.yaml`. You can access the\ndata in it using the hiera() function.\n\n*Setup:*\n\nEdit `hiera.yaml` to include \"blackbox\" to the search hierarchy:\n\n```\n:hierarchy:\n - ...\n - blackbox\n - ...\n```\n\nIn blackbox.yaml specify:\n\n```\n---\nmodule::test_password: \"my secret password\"\n```\n\nIn your Puppet Code, access the password as you would any hiera data:\n\n```\n$the_password = hiera('module::test_password', 'fail')\n\nfile {'/tmp/debug-blackbox.txt':\n content => $the_password,\n owner => 'root',\n group => 'root',\n mode => '0600',\n}\n```\n\nThe variable `$the_password` will contain \"my secret password\" and can be used anywhere strings are used.\n" }, { "path": "go.mod", "content": "module github.com/StackExchange/blackbox/v2\n\ngo 1.14\n\nrequire (\n\tgithub.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883\n\tgithub.com/mattn/go-runewidth v0.0.9 // indirect\n\tgithub.com/olekukonko/tablewriter v0.0.4\n\tgithub.com/sergi/go-diff v1.2.0 // indirect\n\tgithub.com/urfave/cli/v2 v2.2.0\n)\n" }, { "path": "go.sum", "content": "github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=\ngithub.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=\ngithub.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=\ngithub.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=\ngithub.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=\ngithub.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=\ngithub.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=\ngithub.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=\ngithub.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=\ngithub.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=\ngithub.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=\ngithub.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=\ngithub.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=\ngithub.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=\ngithub.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=\ngithub.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=\ngithub.com/olekukonko/tablewriter v0.0.4 h1:vHD/YYe1Wolo78koG299f7V/VAS08c6IpCLn+Ejf/w8=\ngithub.com/olekukonko/tablewriter v0.0.4/go.mod h1:zq6QwlOf5SlnkVbMSr5EoBv3636FWnp+qbPhuoO21uA=\ngithub.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=\ngithub.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=\ngithub.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=\ngithub.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=\ngithub.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=\ngithub.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=\ngithub.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=\ngithub.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=\ngithub.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=\ngithub.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=\ngithub.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=\ngithub.com/urfave/cli/v2 v2.2.0 h1:JTTnM6wKzdA0Jqodd966MVj4vWbbquZykeX1sKbe2C4=\ngithub.com/urfave/cli/v2 v2.2.0/go.mod h1:SE9GqnLQmjVa0iPEY0f1w3ygNIYcIJ0OKPMoW2caLfQ=\ngopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=\ngopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=\ngopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=\ngopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=\ngopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=\ngopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=\n" }, { "path": "integrationTest/NOTES.txt", "content": "\nThis should accept VCS-type and --crypto flags.\nThen a shell script should run various combinations of VCS and crypters.\n\n# Startup\n* Create a repo (git, none)\n\n# Test basic operations:\n* As Alice:\n * initialize blackbox, add her keys to it, see that the usual files\n exist. See her name in bb-admins.txt\n * encrypt a file, see that the plaintext is deleted, see the file in bb-files.txt\n * decrypt the file, see the original plaintext is recovered.\n * Encrypt a file --noshred.\n * Decrypt the file, it should fail as the plaintext exists.\n * Remove the plaintext.\n * Decrypt the file, it should fail as the plaintext exists.\n\n# Test hand-off from Alice to Bob.\n* As Bob\n * add himself to the admins.\n* As Alice\n * Update-all-files\n * Create a new file. Encrypt it.\n* As Bob\n * Decrypt both files\n * Verify contents of the new file, and the file from previous.\n * Create a new file. Encrypt it.\n* As Alice:\n * Decrypt all files.\n * Verify contents of the 3 plaintext files.\n\n# Test a git-less directory\n* Copy the old repo somewhere. Remove the .git directory.\n* As Alice:\n * Decrypt all\n * Verify plaintext contents\n\n# Test post-deploy with/without GID\n* Back at the original repo:\n* Shred all\n* Run post-deploy. Verify.\n* Shred all\n* Run post-deploy with a custom GID. Verify.\n\n# Test removing an admin\n* As Bob:\n * removes Alice. (Verify)\n * Re-encrypt\n * Decrypt all & verify.\n* As alice\n * Decrypting should fail.\n\n# Test funny names and paths\n * my/path/to/relsecrets.txt\n * cwd=other/place ../../my/path/to/relsecrets.txt\n * !important!.txt\n * #andpounds.txt\n * stars*bars?.txt\n * space space.txt\n* Do add/encrypt/decrypt\n* Do blackbox_update_all_files\n* Do remove them all\n\n# When people start asking for commands to work with relative paths\n# Test from outside the repo\n* mkdir ../other/place\n* cd ../other/place\n* decrypt ../../secret1.txt\n* encrypt ../../secret1.txt\n\n# Test specific commands:\n# blackbox admins list\n# blackbox file list\n# blackbox status --name-only (create 1 of each \"type\")\n# blackbox status --type=FOO\n\n# These should all fail:\n# blackbox file list --all\n# blackbox file list blah\n# blackbox shred list --all\n# blackbox shred list blah\n\n\n\nrm -rf /tmp/bbhome-* && BLACKBOX_DEBUG=true go test -verbose -long -nocleanup\nrm -rf /tmp/bbhome-* && go test -long -nocleanup\n\n( gbb && cd cmd/blackbox && go install ) && blackbox\n\ncd /tmp && rm -rf /tmp/bbhome-* ; mkdir /tmp/bbhome-1 ; cd /tmp/bbhome-1 && git init ; gitmeWork ; ( gbb && cd cmd/blackbox && go install ) && blackbox init yes && gitmeWork ; git commit -mm -a ; blackbox admin add tlimoncelli ; git commit -mnewadmin -a ; echo secrt > secret.txt ; blackbox file add secret.txt\n" }, { "path": "integrationTest/README.txt", "content": "\nEach test does the following:\n1. Copy the files from testdata/NNNN\n2. Run the command in test_NNNN.sh\n3. \n\n\nTEST ENROLLMENT:\n\nPHASE 'Alice creates a repo. She creates secret.txt.'\nPHASE 'Alice wants to be part of the secret system.'\nPHASE 'She creates a GPG key...'\nPHASE 'Initializes BB...'\nPHASE 'and adds herself as an admin.'\nPHASE 'Bob arrives.'\nPHASE 'Bob creates a gpg key.'\nPHASE 'Alice does the second part to enroll bob.'\nPHASE 'She enrolls bob.'\nPHASE 'She enrolls secrets.txt.'\nPHASE 'She decrypts secrets.txt.'\nPHASE 'She edits secrets.txt.'\nPHASE 'Alice copies files to a non-repo directory. (NO REPO)'\nPHASE 'Alice shreds these non-repo files. (NO REPO)'\nPHASE 'Alice decrypts secrets.txt (NO REPO).'\nPHASE 'Alice edits secrets.txt. (NO REPO EDIT)'\nPHASE 'Alice decrypts secrets.txt (NO REPO EDIT).'\nPHASE 'appears.'\n#PHASE 'Bob makes sure he has all new keys.'\n\nTEST INDIVIDUAL COMMANDS:\n\nPHASE 'Bob postdeploys... default.'\nPHASE 'Bob postdeploys... with a GID.'\nPHASE 'Bob cleans up the secret.'\nPHASE 'Bob removes Alice.'\nPHASE 'Bob reencrypts files so alice can not access them.'\nPHASE 'Bob decrypts secrets.txt.'\nPHASE 'Bob edits secrets.txt.'\nPHASE 'Bob decrypts secrets.txt VERSION 3.'\nPHASE 'Bob exposes a secret in the repo.'\nPHASE 'Bob corrects it by registering it.'\nPHASE 'Bob enrolls my/path/to/relsecrets.txt.'\nPHASE 'Bob decrypts relsecrets.txt.'\nPHASE 'Bob enrolls !important!.txt'\nPHASE 'Bob enrolls #andpounds.txt'\nPHASE 'Bob enrolls stars*bars?.txt'\nPHASE 'Bob enrolls space space.txt'\nPHASE 'Bob checks out stars*bars?.txt.'\nPHASE 'Bob checks out space space.txt.'\nPHASE 'Bob shreds all exposed files.'\nPHASE 'Bob updates all files.'\nPHASE 'Bob DEregisters mistake.txt'\nPHASE 'Bob enrolls multiple files: multi1.txt and multi2.txt'\nPHASE 'Alice returns. She should be locked out'\nPHASE 'Alice tries to decrypt secret.txt. Is blocked.'\n" }, { "path": "integrationTest/asserts.go", "content": "package main\n\nimport (\n\t\"io/ioutil\"\n\t\"os\"\n\t\"testing\"\n\n\t\"github.com/andreyvit/diff\"\n)\n\nfunc assertFileMissing(t *testing.T, name string) {\n\tt.Helper()\n\t_, err := os.Stat(name)\n\tif err != nil && os.IsNotExist(err) {\n\t\treturn\n\t}\n\tif err == nil {\n\t\tt.Fatalf(\"assertFileMissing failed: %v exists\", name)\n\t}\n\tt.Fatalf(\"assertFileMissing: %q: %v\", name, err)\n}\n\nfunc assertFileExists(t *testing.T, name string) {\n\tt.Helper()\n\t_, err := os.Stat(name)\n\tif err == nil {\n\t\treturn\n\t}\n\tif os.IsNotExist(err) {\n\t\tt.Fatalf(\"assertFileExists failed: %v not exist\", name)\n\t}\n\tt.Fatalf(\"assertFileExists: file can't be accessed: %v: %v\", name, err)\n}\n\nfunc assertFileEmpty(t *testing.T, name string) {\n\tt.Helper()\n\tc, err := ioutil.ReadFile(name)\n\tif err != nil {\n\t\tt.Fatal(err)\n\t}\n\tif len(c) != 0 {\n\t\tt.Fatalf(\"got=%v want=%v: %v\", len(c), 0, name)\n\t}\n}\n\nfunc assertFileContents(t *testing.T, name string, contents string) {\n\tt.Helper()\n\tc, err := ioutil.ReadFile(name)\n\tif err != nil {\n\t\tt.Fatal(err)\n\t}\n\n\tif w, g := contents, string(c); w != g {\n\t\tt.Errorf(\"assertFileContents(%q) mismatch (-got +want):\\n%s\",\n\t\t\tname, diff.LineDiff(g, w))\n\t}\n}\n\nfunc assertFilePerms(t *testing.T, name string, perms os.FileMode) {\n\tt.Helper()\n\ts, err := os.Stat(name)\n\tif err != nil {\n\t\tt.Fatal(err)\n\t}\n\tif s.Mode() != perms {\n\t\tt.Fatalf(\"got=%#o want=%#o: %v\", s.Mode(), perms, name)\n\t}\n}\n" }, { "path": "integrationTest/integration_test.go", "content": "package main\n\nimport (\n\t\"flag\"\n\t\"fmt\"\n\t\"os\"\n\t\"os/exec\"\n\t\"path/filepath\"\n\t\"testing\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/bblog\"\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/bblog\"\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/vcs/_all\"\n)\n\nvar vcsToTest = flag.String(\"testvcs\", \"GIT\", \"VCS to test\")\nvar longTests = flag.Bool(\"long\", false, \"Run long version of tests\")\n\n//var crypterToTest = flag.String(\"crypter\", \"GnuPG\", \"crypter to test\")\n\nfunc init() {\n\ttesting.Init()\n\tflag.Parse()\n\n\top, err := os.Getwd()\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\toriginPath = op\n}\n\nfunc compile(t *testing.T) {\n\tif PathToBlackBox() != \"\" {\n\t\t// It's been compiled already.\n\t\treturn\n\t}\n\t// Make sure we have the latest binary\n\tfmt.Println(\"========== Compiling\")\n\tcmd := exec.Command(\"go\", \"build\", \"-o\", \"../bbintegration\", \"../cmd/blackbox\")\n\tcmd.Stdout = os.Stdout\n\tcmd.Stderr = os.Stderr\n\terr := cmd.Run()\n\tif err != nil {\n\t\tt.Fatalf(\"setup_compile: %v\", err)\n\t}\n\tcwd, err := os.Getwd()\n\tif err != nil {\n\t\tt.Fatal(err)\n\t}\n\tSetPathToBlackBox(filepath.Join(cwd, \"../bbintegration\"))\n}\n\nfunc setup(t *testing.T) {\n\tlogDebug := bblog.GetDebug(*verbose)\n\n\tlogDebug.Printf(\"flag.testvcs is %v\", *vcsToTest)\n\tvh := getVcs(t, *vcsToTest)\n\tlogDebug.Printf(\"Using BLACKBOX_VCS=%v\", vh.Name())\n\tos.Setenv(\"BLACKBOX_VCS\", vh.Name())\n\n}\n\nfunc TestInit(t *testing.T) {\n\tif !*longTests {\n\t\treturn\n\t}\n\tcompile(t)\n\tmakeHomeDir(t, \"init\")\n\n\t// Only zero or one args are permitted.\n\tinvalidArgs(t, \"init\", \"one\", \"two\")\n\tinvalidArgs(t, \"init\", \"one\", \"two\", \"three\")\n\n\trunBB(t, \"init\", \"yes\")\n\tassertFileEmpty(t, \".blackbox/blackbox-admins.txt\")\n\tassertFileEmpty(t, \".blackbox/blackbox-files.txt\")\n\tassertFilePerms(t, \".blackbox/blackbox-admins.txt\", 0o640)\n\tassertFilePerms(t, \".blackbox/blackbox-files.txt\", 0o640)\n}\n\nfunc TestList(t *testing.T) {\n\tif !*longTests {\n\t\treturn\n\t}\n\tcompile(t)\n\tmakeHomeDir(t, \"init\")\n\n\trunBB(t, \"init\", \"yes\")\n\tcreateDummyFilesAdmin(t)\n\tcheckOutput(\"000-admin-list.txt\", t, \"admin\", \"list\")\n\tcheckOutput(\"000-file-list.txt\", t, \"file\", \"list\")\n\n\tinvalidArgs(t, \"file\", \"list\", \"extra\")\n\tinvalidArgs(t, \"admin\", \"list\", \"extra\")\n}\n\nfunc TestStatus(t *testing.T) {\n\tif !*longTests {\n\t\treturn\n\t}\n\tcompile(t)\n\tmakeHomeDir(t, \"init\")\n\n\trunBB(t, \"init\", \"yes\")\n\tcreateFilesStatus(t)\n\tcheckOutput(\"000-status.txt\", t, \"status\")\n}\n\nfunc TestShred(t *testing.T) {\n\tif !*longTests {\n\t\treturn\n\t}\n\tcompile(t)\n\tmakeHomeDir(t, \"shred\")\n\trunBB(t, \"init\", \"yes\")\n\n\tmakeFile(t, \"shredme.txt\", \"File with SHREDME in it.\\n\")\n\tassertFileExists(t, \"shredme.txt\")\n\trunBB(t, \"shred\", \"shredme.txt\")\n\tassertFileMissing(t, \"shredme.txt\")\n}\n\nfunc TestStatus_notreg(t *testing.T) {\n\tif !*longTests {\n\t\treturn\n\t}\n\tcompile(t)\n\tmakeHomeDir(t, \"init\")\n\n\trunBB(t, \"init\", \"yes\")\n\tcreateFilesStatus(t)\n\tcheckOutput(\"status-noreg.txt\", t, \"status\", \"status-ENCRYPTED.txt\", \"blah.txt\")\n}\n\n// TestHard tests the functions using a fake homedir and repo.\nfunc TestHard(t *testing.T) {\n\tif !*longTests {\n\t\treturn\n\t}\n\t// These are basic tests that work on a fake repo.\n\t// The repo has mostly real data, except any .gpg file\n\t// is just garbage.\n\tcompile(t)\n\tsetup(t)\n\n\tfor _, cx := range []struct{ subname, prefix string }{\n\t\t//{subname: \".\", prefix: \".\"},\n\t\t{subname: \"mysub\", prefix: \"..\"},\n\t} {\n\t\tsubname := cx.subname\n\t\tprefix := cx.prefix\n\t\t_ = prefix\n\n\t\tphase(\"========== SUBDIR = \" + subname + \" ==========\")\n\n\t\tmakeHomeDir(t, \"BasicAlice\")\n\n\t\tplaintextFoo := \"I am the foo.txt file!\\n\"\n\t\tplainAltered := \"I am the altered file!\\n\"\n\n\t\trunBB(t, \"testing_init\") // Runs \"git init\" or equiv\n\t\tassertFileExists(t, \".git\")\n\t\trunBB(t, \"init\", \"yes\") // Creates .blackbox or equiv\n\n\t\tif subname != \".\" {\n\t\t\terr := os.Mkdir(subname, 0770)\n\t\t\tif err != nil {\n\t\t\t\tt.Fatal(fmt.Errorf(\"hard-mk-home %q: %v\", subname, err))\n\t\t\t}\n\t\t}\n\t\tolddir, err := os.Getwd()\n\t\tif err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\n\t\tos.Chdir(subname)\n\t\tos.Chdir(olddir)\n\n\t\tphase(\"Alice creates a GPG key\")\n\t\tgpgdir := makeAdmin(t, \"alice\", \"Alice Example\", \"alice@example.com\")\n\t\tbecome(t, \"alice\")\n\n\t\tphase(\"Alice enrolls as an admin\")\n\t\t//os.Chdir(subname)\n\t\trunBB(t, \"admin\", \"add\", \"alice@example.com\", gpgdir)\n\t\t//os.Chdir(olddir)\n\n\t\t// encrypt\n\t\tphase(\"Alice registers foo.txt\")\n\t\tmakeFile(t, \"foo.txt\", plaintextFoo)\n\t\t//os.Chdir(subname)\n\t\t//runBB(t, \"file\", \"add\", \"--shred\", filepath.Join(prefix, \"foo.txt\"))\n\t\trunBB(t, \"file\", \"add\", \"--shred\", \"foo.txt\")\n\t\t//os.Chdir(olddir)\n\t\t// \"file add\" encrypts the file.\n\t\t// We shred the plaintext so that we are sure that when Decrypt runs,\n\t\t// we can verify the contents wasn't just sitting there all the time.\n\t\tassertFileMissing(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\n\t\tphase(\"Alice decrypts foo.txt\")\n\t\t// decrypt\n\t\t//os.Chdir(subname)\n\t\trunBB(t, \"decrypt\", \"foo.txt\")\n\t\t//runBB(t, \"decrypt\", filepath.Join(prefix, \"foo.txt\"))\n\t\t//os.Chdir(olddir)\n\t\tassertFileExists(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\t\tassertFileContents(t, \"foo.txt\", plaintextFoo)\n\n\t\t// encrypts (without shredding)\n\t\tphase(\"Alice encrypts foo.txt (again)\")\n\t\trunBB(t, \"encrypt\", \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\t\tassertFileContents(t, \"foo.txt\", plaintextFoo)\n\n\t\t// reencrypt\n\t\tphase(\"Alice reencrypts\")\n\t\tcheckOutput(\"basic-status.txt\", t, \"status\")\n\t\trunBB(t, \"reencrypt\", \"--overwrite\", \"foo.txt\")\n\n\t\t// Test variations of cat\n\n\t\t// foo.txt=plain result=plain\n\t\tphase(\"Alice cats plain:plain\")\n\t\tmakeFile(t, \"foo.txt\", plaintextFoo)\n\t\tassertFileExists(t, \"foo.txt\")\n\t\trunBB(t, \"encrypt\", \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\t\tcheckOutput(\"alice-cat-plain.txt\", t, \"cat\", \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\n\t\t// foo.txt=altered result=plain\n\t\tphase(\"Alice cats altered:plain\")\n\t\tmakeFile(t, \"foo.txt\", plainAltered)\n\t\tassertFileExists(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\t\tcheckOutput(\"alice-cat-plain.txt\", t, \"cat\", \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\n\t\t// foo.txt=missing result=plain\n\t\tphase(\"Alice cats missing:plain\")\n\t\tremoveFile(t, \"foo.txt\")\n\t\tassertFileMissing(t, \"foo.txt\")\n\t\tassertFileMissing(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\t\tcheckOutput(\"alice-cat-plain.txt\", t, \"cat\", \"foo.txt\")\n\t\tassertFileMissing(t, \"foo.txt\")\n\t\tassertFileExists(t, \"foo.txt.gpg\")\n\n\t\t// Chapter 2: Bob\n\t\t// Alice adds Bob.\n\t\t// Bob encrypts a file.\n\t\t// Bob makes sure he can decrypt alice's file.\n\t\t// Bob removes Alice.\n\t\t// Alice verifies she CAN'T decrypt files.\n\t\t// Bob adds Alice back.\n\t\t// Alice verifies she CAN decrypt files.\n\t\t// Bob adds an encrypted file by mistake, \"bb add\" and fixes it.\n\t\t// Bob corrupts the blackbox-admins.txt file, verifies that commands fail.\n\n\t}\n\n}\n\n// TestEvilFilenames verifies commands work with \"difficult\" file names\nfunc TestEvilFilenames(t *testing.T) {\n\tif !*longTests {\n\t\treturn\n\t}\n\tcompile(t)\n\tsetup(t)\n\tmakeHomeDir(t, \"Mallory\")\n\n\trunBB(t, \"testing_init\") // Runs \"git init\" or equiv\n\tassertFileExists(t, \".git\")\n\trunBB(t, \"init\", \"yes\") // Creates .blackbox or equiv\n\n\tphase(\"Malory creates a GPG key\")\n\tgpgdir := makeAdmin(t, \"mallory\", \"Mallory Evil\", \"mallory@example.com\")\n\tbecome(t, \"mallory\")\n\n\tphase(\"Mallory enrolls as an admin\")\n\trunBB(t, \"admin\", \"add\", \"mallory@example.com\", gpgdir)\n\n\t_ = os.MkdirAll(\"my/path/to\", 0o770)\n\t_ = os.Mkdir(\"other\", 0o770)\n\n\tfor i, name := range []string{\n\t\t\"!important!.txt\",\n\t\t\"#andpounds.txt\",\n\t\t\"stars*bars?.txt\",\n\t\t\"space space.txt\",\n\t\t\"tab\\ttab.txt\",\n\t\t\"ret\\rret.txt\",\n\t\t\"smile😁eyes\",\n\t\t\"¡que!\",\n\t\t\"thé\",\n\t\t\"pound£\",\n\t\t\"*.go\",\n\t\t\"rm -f erase ; echo done\",\n\t\t`smile☺`,\n\t\t`dub𝓦`,\n\t\t\"my/path/to/relsecrets.txt\",\n\t\t//\"my/../my/path/../path/to/myother.txt\", // Not permitted yet\n\t\t//\"other/../my//path/../path/to/otherother.txt\", // Not permitted yet\n\t\t//\"new\\nnew.txt\", // \\n not permitted\n\t\t//\"two\\n\", // \\n not permitted (yet)\n\t\t//\"four\\U0010FFFF\", // Illegal byte sequence. git won't accept.\n\t} {\n\t\tphase(fmt.Sprintf(\"Mallory tries %02d: %q\", i, name))\n\t\tcontents := \"the name of this file is the talking heads... i mean, \" + name\n\t\tmakeFile(t, name, contents)\n\t\tassertFileExists(t, name)\n\t\tassertFileMissing(t, name+\".gpg\")\n\t\tassertFileContents(t, name, contents)\n\n\t\trunBB(t, \"file\", \"add\", name)\n\t\tassertFileMissing(t, name)\n\t\tassertFileExists(t, name+\".gpg\")\n\n\t\trunBB(t, \"decrypt\", name)\n\t\tassertFileExists(t, name)\n\t\tassertFileExists(t, name+\".gpg\")\n\t\tassertFileContents(t, name, contents)\n\n\t\trunBB(t, \"encrypt\", name)\n\t\tassertFileExists(t, name)\n\t\tassertFileExists(t, name+\".gpg\")\n\t\tassertFileContents(t, name, contents)\n\n\t\trunBB(t, \"shred\", name)\n\t\tassertFileMissing(t, name)\n\t\tassertFileExists(t, name+\".gpg\")\n\t}\n}\n\n// More tests to implement.\n// 1. Verify that the --gid works (blackbox decrypt --gid)\n" }, { "path": "integrationTest/ithelpers.go", "content": "package main\n\nimport (\n\t\"flag\"\n\t\"fmt\"\n\t\"io/ioutil\"\n\t\"log\"\n\t\"os\"\n\t\"os/exec\"\n\t\"path/filepath\"\n\t\"runtime\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/bblog\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/bbutil\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/vcs\"\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/vcs/_all\"\n\n\t\"github.com/andreyvit/diff\"\n)\n\nvar verbose = flag.Bool(\"verbose\", false, \"reveal stderr\")\nvar nocleanup = flag.Bool(\"nocleanup\", false, \"do not delete the tmp directory\")\n\ntype userinfo struct {\n\tname string\n\tdir string // .gnupg-$name\n\tagentInfo string // GPG_AGENT_INFO\n\temail string\n\tfullname string\n}\n\nvar users = map[string]*userinfo{}\n\nfunc init() {\n\ttesting.Init()\n\tflag.Parse()\n}\n\nvar logErr *log.Logger\nvar logDebug *log.Logger\n\nfunc init() {\n\tlogErr = bblog.GetErr()\n\tlogDebug = bblog.GetDebug(*verbose)\n}\n\nfunc getVcs(t *testing.T, name string) vcs.Vcs {\n\tt.Helper()\n\t// Set up the vcs\n\tfor _, v := range vcs.Catalog {\n\t\tlogDebug.Printf(\"Testing vcs: %v == %v\", name, v.Name)\n\t\tif strings.ToLower(v.Name) == strings.ToLower(name) {\n\t\t\th, err := v.New()\n\t\t\tif err != nil {\n\t\t\t\treturn nil // No idea how that would happen.\n\t\t\t}\n\t\t\treturn h\n\t\t}\n\t\tlogDebug.Println(\"...Nope.\")\n\n\t}\n\treturn nil\n}\n\n// TestBasicCommands's helpers\n\nfunc makeHomeDir(t *testing.T, testname string) {\n\tt.Helper()\n\tvar homedir string\n\tvar err error\n\n\tif *nocleanup {\n\t\t// Make a predictable location; don't deleted.\n\t\thomedir = \"/tmp/bbhome-\" + testname\n\t\tos.RemoveAll(homedir)\n\t\terr = os.Mkdir(homedir, 0770)\n\t\tif err != nil {\n\t\t\tt.Fatal(fmt.Errorf(\"mk-home %q: %v\", homedir, err))\n\t\t}\n\t} else {\n\t\t// Make a random location that is deleted automatically\n\t\thomedir, err = ioutil.TempDir(\"\", filepath.Join(\"bbhome-\"+testname))\n\t\tdefer os.RemoveAll(homedir) // clean up\n\t\tif err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\t}\n\n\terr = os.Setenv(\"HOME\", homedir)\n\tif err != nil {\n\t\tt.Fatal(err)\n\t}\n\tlogDebug.Printf(\"TESTING DIR HOME: cd %v\\n\", homedir)\n\n\trepodir := filepath.Join(homedir, \"repo\")\n\terr = os.Mkdir(repodir, 0770)\n\tif err != nil {\n\t\tt.Fatal(fmt.Errorf(\"mk-repo %q: %v\", repodir, err))\n\t}\n\terr = os.Chdir(repodir)\n\tif err != nil {\n\t\tt.Fatal(err)\n\t}\n}\n\nfunc createDummyFilesAdmin(t *testing.T) {\n\t// This creates a repo with real data, except any .gpg file\n\t// is just garbage.\n\taddLineSorted(t, \".blackbox/blackbox-admins.txt\", \"user1@example.com\")\n\taddLineSorted(t, \".blackbox/blackbox-admins.txt\", \"user2@example.com\")\n\taddLineSorted(t, \".blackbox/blackbox-files.txt\", \"foo.txt\")\n\taddLineSorted(t, \".blackbox/blackbox-files.txt\", \"bar.txt\")\n\tmakeFile(t, \"foo.txt\", \"I am the foo.txt file!\")\n\tmakeFile(t, \"bar.txt\", \"I am the foo.txt file!\")\n\tmakeFile(t, \"foo.txt.gpg\", \"V nz gur sbb.gkg svyr!\")\n\tmakeFile(t, \"bar.txt.gpg\", \"V nz gur one.gkg svyr!\")\n}\n\nfunc createFilesStatus(t *testing.T) {\n\t// This creates a few files with real plaintext but fake cyphertext.\n\t// There are a variety of timestamps to enable many statuses.\n\tt.Helper()\n\n\t// DECRYPTED: File is decrypted and ready to edit (unknown if it has been edited).\n\t// ENCRYPTED: GPG file is newer than plaintext. Indicates recented edited then encrypted.\n\t// SHREDDED: Plaintext is missing.\n\t// GPGMISSING: The .gpg file is missing. Oops?\n\t// PLAINERROR: Can't access the plaintext file to determine status.\n\t// GPGERROR: Can't access .gpg file to determine status.\n\n\taddLineSorted(t, \".blackbox/blackbox-files.txt\", \"status-DECRYPTED.txt\")\n\taddLineSorted(t, \".blackbox/blackbox-files.txt\", \"status-ENCRYPTED.txt\")\n\taddLineSorted(t, \".blackbox/blackbox-files.txt\", \"status-SHREDDED.txt\")\n\taddLineSorted(t, \".blackbox/blackbox-files.txt\", \"status-GPGMISSING.txt\")\n\t// addLineSorted(t, \".blackbox/blackbox-files.txt\", \"status-PLAINERROR.txt\")\n\t// addLineSorted(t, \".blackbox/blackbox-files.txt\", \"status-GPGERROR.txt\")\n\taddLineSorted(t, \".blackbox/blackbox-files.txt\", \"status-BOTHMISSING.txt\")\n\n\t// Combination of age difference either missing, file error, both missing.\n\tmakeFile(t, \"status-DECRYPTED.txt\", \"File with DECRYPTED in it.\")\n\tmakeFile(t, \"status-DECRYPTED.txt.gpg\", \"Svyr jvgu QRPELCGRQ va vg.\")\n\n\tmakeFile(t, \"status-ENCRYPTED.txt\", \"File with ENCRYPTED in it.\")\n\tmakeFile(t, \"status-ENCRYPTED.txt.gpg\", \"Svyr jvgu RAPELCGRQ va vg.\")\n\n\t// Plaintext intentionally missing.\n\tmakeFile(t, \"status-SHREDDED.txt.gpg\", \"Svyr jvgu FUERQQRQ va vg.\")\n\n\tmakeFile(t, \"status-GPGMISSING.txt\", \"File with GPGMISSING in it.\")\n\t// gpg file intentionally missing.\n\n\t// Plaintext intentionally missing. (\"status-BOTHMISSING.txt\")\n\t// gpg file intentionally missing. (\"status-BOTHMISSING.txt.gpg\")\n\n\t// NB(tlim): commented out. I can't think of an error I can reproduce.\n\t// makeFile(t, \"status-PLAINERROR.txt\", \"File with PLAINERROR in it.\")\n\t// makeFile(t, \"status-PLAINERROR.txt.gpg\", \"Svyr jvgu CYNVAREEBE va vg.\")\n\t// setFilePerms(t, \"status-PLAINERROR.txt\", 0000)\n\n\t// NB(tlim): commented out. I can't think of an error I can reproduce.\n\t// makeFile(t, \"status-GPGERROR.txt\", \"File with GPGERROR in it.\")\n\t// makeFile(t, \"status-GPGERROR.txt.gpg\", \"Svyr jvgu TCTREEBE va vg.\")\n\t// setFilePerms(t, \"status-GPGERROR.txt.gpg\", 0000)\n\n\ttime.Sleep(200 * time.Millisecond)\n\n\tif err := bbutil.Touch(\"status-DECRYPTED.txt\"); err != nil {\n\t\tt.Fatal(err)\n\t}\n\tif err := bbutil.Touch(\"status-ENCRYPTED.txt.gpg\"); err != nil {\n\t\tt.Fatal(err)\n\t}\n}\n\nfunc addLineSorted(t *testing.T, filename, line string) {\n\terr := bbutil.AddLinesToSortedFile(filename, line)\n\tif err != nil {\n\t\tt.Fatalf(\"addLineSorted failed: %v\", err)\n\t}\n}\n\nfunc removeFile(t *testing.T, name string) {\n\tos.RemoveAll(name)\n}\n\nfunc makeFile(t *testing.T, name string, content string) {\n\tt.Helper()\n\n\terr := ioutil.WriteFile(name, []byte(content), 0666)\n\tif err != nil {\n\t\tt.Fatalf(\"makeFile can't create %q: %v\", name, err)\n\t}\n}\n\nfunc setFilePerms(t *testing.T, name string, perms int) {\n\tt.Helper()\n\n\terr := os.Chmod(name, os.FileMode(perms))\n\tif err != nil {\n\t\tt.Fatalf(\"setFilePerms can't chmod %q: %v\", name, err)\n\t}\n}\n\nvar originPath string // CWD when program started.\n\n// checkOutput runs blackbox with args, the last arg is the filename\n// of the expected output. Error if output is not expected.\nfunc checkOutput(name string, t *testing.T, args ...string) {\n\tt.Helper()\n\n\tcmd := exec.Command(PathToBlackBox(), args...)\n\tcmd.Stdin = nil\n\tcmd.Stdout = nil\n\tcmd.Stderr = os.Stderr\n\tvar gb []byte\n\tgb, err := cmd.Output()\n\tif err != nil {\n\t\tt.Fatal(fmt.Errorf(\"checkOutput(%q): %w\", args, err))\n\t}\n\tgot := string(gb)\n\n\twb, err := ioutil.ReadFile(filepath.Join(originPath, \"test_data\", name))\n\tif err != nil {\n\t\tt.Fatalf(\"checkOutput can't read %v: %v\", name, err)\n\t}\n\twant := string(wb)\n\n\t//fmt.Printf(\"CHECKOUTPUT g: %v\\n\", got)\n\t//fmt.Printf(\"CHECKOUTPUT w: %v\\n\", want)\n\n\tif g, w := got, want; g != w {\n\t\tt.Errorf(\"checkOutput(%q) mismatch (-got +want):\\n%s\",\n\t\t\targs, diff.LineDiff(g, w))\n\t}\n\n}\n\nfunc invalidArgs(t *testing.T, args ...string) {\n\tt.Helper()\n\n\tlogDebug.Printf(\"invalidArgs(%q): \\n\", args)\n\tcmd := exec.Command(PathToBlackBox(), args...)\n\tcmd.Stdin = nil\n\tif *verbose {\n\t\tcmd.Stdout = os.Stdout\n\t\tcmd.Stderr = os.Stderr\n\t}\n\terr := cmd.Run()\n\tif err == nil {\n\t\tlogDebug.Println(\"BAD\")\n\t\tt.Fatal(fmt.Errorf(\"invalidArgs(%q): wanted failure but got success\", args))\n\t}\n\tlogDebug.Printf(\"^^^^ (correct error received): err=%q\\n\", err)\n}\n\n// TestAliceAndBob's helpers.\n\nfunc setupUser(t *testing.T, user, passphrase string) {\n\tt.Helper()\n\tlogDebug.Printf(\"DEBUG: setupUser %q %q\\n\", user, passphrase)\n}\n\nvar pathToBlackBox string\n\n// PathToBlackBox returns the path to the executable we compile for integration testing.\nfunc PathToBlackBox() string { return pathToBlackBox }\n\n// SetPathToBlackBox sets the path.\nfunc SetPathToBlackBox(n string) {\n\tlogDebug.Printf(\"PathToBlackBox=%q\\n\", n)\n\tpathToBlackBox = n\n}\n\nfunc runBB(t *testing.T, args ...string) {\n\tt.Helper()\n\n\tlogDebug.Printf(\"runBB(%q)\\n\", args)\n\tcmd := exec.Command(PathToBlackBox(), args...)\n\tcmd.Stdin = nil\n\tcmd.Stdout = os.Stdout\n\tcmd.Stderr = os.Stderr\n\terr := cmd.Run()\n\tif err != nil {\n\t\tt.Fatal(fmt.Errorf(\"runBB(%q): %w\", args, err))\n\t}\n}\n\nfunc phase(msg string) {\n\tlogDebug.Println(\"********************\")\n\tlogDebug.Println(\"********************\")\n\tlogDebug.Printf(\"********* %v\\n\", msg)\n\tlogDebug.Println(\"********************\")\n\tlogDebug.Println(\"********************\")\n}\n\nfunc makeAdmin(t *testing.T, name, fullname, email string) string {\n\ttesting.Init()\n\n\tdir, err := filepath.Abs(filepath.Join(os.Getenv(\"HOME\"), \".gnupg-\"+name))\n\tif err != nil {\n\t\tt.Fatal(err)\n\t}\n\tos.Mkdir(dir, 0700)\n\n\tu := &userinfo{\n\t\tname: name,\n\t\tdir: dir,\n\t\tfullname: fullname,\n\t\temail: email,\n\t}\n\tusers[name] = u\n\n\t// GNUPGHOME=u.dir\n\t// echo 'pinentry-program' \"$(which pinentry-tty)\" >> \"$GNUPGHOME/gpg-agent.conf\"\n\tos.Setenv(\"GNUPGHOME\", u.dir)\n\tif runtime.GOOS != \"darwin\" {\n\t\tai, err := bbutil.RunBashOutput(\"gpg-agent\", \"--homedir\", u.dir, \"--daemon\")\n\t\t// NB(tlim): It should return something like:\n\t\t// `GPG_AGENT_INFO=/home/tlimoncelli/.gnupg/S.gpg-agent:18548:1; export GPG_AGENT_INFO;`\n\t\tif err != nil {\n\t\t\t//t.Fatal(err)\n\t\t}\n\t\tif !strings.HasPrefix(ai, \"GPG_AGENT_INFO=\") {\n\t\t\tfmt.Println(\"WARNING: gpg-agent didn't output what we expected. Assumed dead.\")\n\t\t} else {\n\t\t\tu.agentInfo = ai[15:strings.Index(ai, \";\")]\n\t\t\tos.Setenv(\"GPG_AGENT_INFO\", u.agentInfo)\n\t\t\tfmt.Printf(\"GPG_AGENT_INFO=%q (was %q)\\n\", ai, u.agentInfo)\n\t\t}\n\t}\n\n\tos.Setenv(\"GNUPGHOME\", u.dir)\n\t// Generate key:\n\tif hasQuick(t) {\n\t\tfmt.Println(\"DISCOVERED: NEW GPG\")\n\t\tfmt.Printf(\"Generating %q using --qgk\\n\", u.email)\n\t\tbbutil.RunBash(\"gpg\",\n\t\t\t\"--homedir\", u.dir,\n\t\t\t\"--batch\",\n\t\t\t\"--passphrase\", \"\",\n\t\t\t\"--quick-generate-key\", u.email,\n\t\t)\n\t\tif err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\n\t} else {\n\n\t\tfmt.Println(\"DISCOVERED: OLD GPG\")\n\t\tfmt.Println(\"MAKING KEY\")\n\n\t\ttmpfile, err := ioutil.TempFile(\"\", \"example\")\n\t\tif err != nil {\n\t\t\tlog.Fatal(err)\n\t\t}\n\t\tdefer os.Remove(tmpfile.Name()) // clean up\n\n\t\tbatch := `%echo Generating a basic OpenPGP key\nKey-Type: RSA\nKey-Length: 2048\nSubkey-Type: RSA\nSubkey-Length: 2048\nName-Real: ` + u.fullname + `\nName-Comment: Not for actual use\nName-Email: ` + u.email + `\nExpire-Date: 0\n%pubring ` + filepath.Join(u.dir, `pubring.gpg`) + `\n%secring ` + filepath.Join(u.dir, `secring.gpg`) + `\n# Do a commit here, so that we can later print \"done\"\n%commit\n%echo done`\n\t\t//fmt.Printf(\"BATCH START\\n%s\\nBATCH END\\n\", batch)\n\t\tfmt.Fprintln(tmpfile, batch)\n\n\t\t// FIXME(tlim): The batch file should include a password, but then\n\t\t// we need to figure out how to get \"blackbox encrypt\" and other\n\t\t// commands to input a password in an automated way.\n\t\t// To experiment with this, add after \"Expire-Date:\" a line like:\n\t\t// Passphrase: kljfhslfjkhsaljkhsdflgjkhsd\n\t\t// Current status: without that line GPG keys have no passphrase\n\t\t// and none is requested.\n\n\t\tbbutil.RunBash(\"gpg\",\n\t\t\t\"--homedir\", u.dir,\n\t\t\t\"--verbose\",\n\t\t\t\"--batch\",\n\t\t\t\"--gen-key\",\n\t\t\ttmpfile.Name(),\n\t\t)\n\t\tif err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\t\tif err := tmpfile.Close(); err != nil {\n\t\t\tlog.Fatal(err)\n\t\t}\n\n\t\t// We do this just to for gpg to create trustdb.gpg\n\t\tbbutil.RunBash(\"gpg\",\n\t\t\t\"--homedir\", u.dir,\n\t\t\t\"--list-keys\",\n\t\t)\n\t\tif err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\n\t\tbbutil.RunBash(\"gpg\",\n\t\t\t\"--homedir\", u.dir,\n\t\t\t\"--list-secret-keys\",\n\t\t)\n\t\tif err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\n\t}\n\n\treturn u.dir\n}\n\nfunc hasQuick(t *testing.T) bool {\n\ttesting.Init()\n\tfmt.Println(\"========== Do we run gpg2?\")\n\terr := bbutil.RunBash(\"gpg2\", \"--version\")\n\tfmt.Println(\"========== Done\")\n\tif err == nil {\n\t\treturn true\n\t}\n\t//fmt.Printf(\"DISCOVER GPG: %d\", err.ExitCode())\n\tif exitError, ok := err.(*exec.ExitError); ok {\n\t\tif exitError.ExitCode() == 0 {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n\nfunc become(t *testing.T, name string) {\n\ttesting.Init()\n\tu := users[name]\n\n\tos.Setenv(\"GNUPGHOME\", u.dir)\n\tos.Setenv(\"GPG_AGENT_INFO\", u.agentInfo)\n\tbbutil.RunBash(\"git\", \"config\", \"user.name\", u.name)\n\tbbutil.RunBash(\"git\", \"config\", \"user.email\", u.fullname)\n}\n\n//\t// Get fingerprint:\n//\t// Retrieve fingerprint of generated key.\n//\t// Use it to extract the secret/public keys.\n//\t// (stolen from https://raymii.org/s/articles/GPG_noninteractive_batch_sign_trust_and_send_gnupg_keys.html)\n//\n//\t// fpr=`gpg --homedir /tmp/blackbox_createrole --fingerprint --with-colons \"$ROLE_NAME\" | awk -F: '/fpr:/ {print $10}' | head -n 1`\n//\tvar fpr string\n//\tbbutil.RunBashOutput(\"gpg\",\n//\t\t\"--homedir\", \"/tmp/blackbox_createrole\",\n//\t\t\"--fingerprint\",\n//\t\t\"--with-colons\",\n//\t\tu.email,\n//\t)\n//\tfor i, l := range string.Split(out, \"\\n\") {\n//\t\tif string.HasPrefix(l, \"fpr:\") {\n//\t\t\tfpr = strings.Split(l, \":\")[9]\n//\t\t}\n//\t\tbreak\n//\t}\n//\n//\t// Create key key:\n//\t// gpg --homedir \"$gpghomedir\" --batch --passphrase '' --quick-add-key \"$fpr\" rsa encr\n//\tbbutil.RunBash(\"gpg\",\n//\t\t\"--homedir\", u.dir,\n//\t\t\"--batch\",\n//\t\t\"--passphrase\", \"\",\n//\t\t\"--quick-add-key\", fpr,\n//\t\t\"rsa\", \"encr\",\n//\t)\n\n// function md5sum_file() {\n// # Portably generate the MD5 hash of file $1.\n// case $(uname -s) in\n// Darwin | FreeBSD )\n// md5 -r \"$1\" | awk '{ print $1 }'\n// ;;\n// NetBSD )\n// md5 -q \"$1\"\n// ;;\n// SunOS )\n// digest -a md5 \"$1\"\n// ;;\n// Linux )\n// md5sum \"$1\" | awk '{ print $1 }'\n// ;;\n// CYGWIN* )\n// md5sum \"$1\" | awk '{ print $1 }'\n// ;;\n// * )\n// echo 'ERROR: Unknown OS. Exiting.'\n// exit 1\n// ;;\n// esac\n// }\n//\n// function assert_file_missing() {\n// if [[ -e \"$1\" ]]; then\n// echo \"ASSERT FAILED: ${1} should not exist.\"\n// exit 1\n// fi\n// }\n//\n// function assert_file_exists() {\n// if [[ ! -e \"$1\" ]]; then\n// echo \"ASSERT FAILED: ${1} should exist.\"\n// echo \"PWD=$(/usr/bin/env pwd -P)\"\n// #echo \"LS START\"\n// #ls -la\n// #echo \"LS END\"\n// exit 1\n// fi\n// }\n// function assert_file_md5hash() {\n// local file=\"$1\"\n// local wanted=\"$2\"\n// assert_file_exists \"$file\"\n// local found\n// found=$(md5sum_file \"$file\")\n// if [[ \"$wanted\" != \"$found\" ]]; then\n// echo \"ASSERT FAILED: $file hash wanted=$wanted found=$found\"\n// exit 1\n// fi\n// }\n// function assert_file_group() {\n// local file=\"$1\"\n// local wanted=\"$2\"\n// local found\n// assert_file_exists \"$file\"\n//\n// case $(uname -s) in\n// Darwin | FreeBSD | NetBSD )\n// found=$(stat -f '%Dg' \"$file\")\n// ;;\n// Linux | SunOS )\n// found=$(stat -c '%g' \"$file\")\n// ;;\n// CYGWIN* )\n// echo \"ASSERT_FILE_GROUP: Running on Cygwin. Not being tested.\"\n// return 0\n// ;;\n// * )\n// echo 'ERROR: Unknown OS. Exiting.'\n// exit 1\n// ;;\n// esac\n//\n// echo \"DEBUG: assert_file_group X${wanted}X vs. X${found}X\"\n// echo \"DEBUG:\" $(which stat)\n// if [[ \"$wanted\" != \"$found\" ]]; then\n// echo \"ASSERT FAILED: $file chgrp group wanted=$wanted found=$found\"\n// exit 1\n// fi\n// }\n// function assert_file_perm() {\n// local wanted=\"$1\"\n// local file=\"$2\"\n// local found\n// assert_file_exists \"$file\"\n//\n// case $(uname -s) in\n// Darwin | FreeBSD | NetBSD )\n// found=$(stat -f '%Sp' \"$file\")\n// ;;\n// # NB(tlim): CYGWIN hasn't been tested. It might be more like Darwin.\n// Linux | CYGWIN* | SunOS )\n// found=$(stat -c '%A' \"$file\")\n// ;;\n// * )\n// echo 'ERROR: Unknown OS. Exiting.'\n// exit 1\n// ;;\n// esac\n//\n// echo \"DEBUG: assert_file_perm X${wanted}X vs. X${found}X\"\n// echo \"DEBUG:\" $(which stat)\n// if [[ \"$wanted\" != \"$found\" ]]; then\n// echo \"ASSERT FAILED: $file chgrp perm wanted=$wanted found=$found\"\n// exit 1\n// fi\n// }\n// function assert_line_not_exists() {\n// local target=\"$1\"\n// local file=\"$2\"\n// assert_file_exists \"$file\"\n// if grep -F -x -s -q >/dev/null \"$target\" \"$file\" ; then\n// echo \"ASSERT FAILED: line '$target' should not exist in file $file\"\n// echo \"==== file contents: START $file\"\n// cat \"$file\"\n// echo \"==== file contents: END $file\"\n// exit 1\n// fi\n// }\n// function assert_line_exists() {\n// local target=\"$1\"\n// local file=\"$2\"\n// assert_file_exists \"$file\"\n// if ! grep -F -x -s -q >/dev/null \"$target\" \"$file\" ; then\n// echo \"ASSERT FAILED: line '$target' should exist in file $file\"\n// echo \"==== file contents: START $file\"\n// cat \"$file\"\n// echo \"==== file contents: END $file\"\n// exit 1\n// fi\n// }\n" }, { "path": "integrationTest/test_data/000-admin-list.txt", "content": "user1@example.com\nuser2@example.com\n" }, { "path": "integrationTest/test_data/000-file-list.txt", "content": "bar.txt\nfoo.txt\n" }, { "path": "integrationTest/test_data/000-status.txt", "content": "+-------------+------------------------+\n| STATUS | NAME |\n+-------------+------------------------+\n| BOTHMISSING | status-BOTHMISSING.txt |\n| DECRYPTED | status-DECRYPTED.txt |\n| ENCRYPTED | status-ENCRYPTED.txt |\n| GPGMISSING | status-GPGMISSING.txt |\n| SHREDDED | status-SHREDDED.txt |\n+-------------+------------------------+\n" }, { "path": "integrationTest/test_data/alice-cat-plain.txt", "content": "I am the foo.txt file!\n" }, { "path": "integrationTest/test_data/basic-status.txt", "content": "+-----------+---------+\n| STATUS | NAME |\n+-----------+---------+\n| ENCRYPTED | foo.txt |\n+-----------+---------+\n" }, { "path": "integrationTest/test_data/reencrypt-plain.txt", "content": "I am the foo.txt file!\n" }, { "path": "integrationTest/test_data/status-noreg.txt", "content": "+-----------+----------------------+\n| STATUS | NAME |\n+-----------+----------------------+\n| ENCRYPTED | status-ENCRYPTED.txt |\n| NOTREG | blah.txt |\n+-----------+----------------------+\n" }, { "path": "models/crypters.go", "content": "package models\n\n// Crypter is gpg binaries, go-opengpg, etc.\ntype Crypter interface {\n\t// Name returns the plug-in's canonical name.\n\tName() string\n\t// Decrypt name+\".gpg\", possibly overwriting name.\n\tDecrypt(filename string, umask int, overwrite bool) error\n\t// Encrypt name, overwriting name+\".gpg\"\n\tEncrypt(filename string, umask int, receivers []string) (string, error)\n\t// Cat outputs a file, unencrypting if needed.\n\tCat(filename string) ([]byte, error)\n\t// AddNewKey extracts keyname from sourcedir's GnuPG chain to destdir keychain.\n\tAddNewKey(keyname, repobasename, sourcedir, destdir string) ([]string, error)\n}\n" }, { "path": "models/vcs.go", "content": "package models\n\nimport \"github.com/StackExchange/blackbox/v2/pkg/commitlater\"\n\n// Vcs is git/hg/etc.\ntype Vcs interface {\n\t// Name returns the plug-in's canonical name.\n\tName() string\n\t// Discover returns true if we are a repo of this type; along with the Abs path to the repo root (or \"\" if we don't know).\n\tDiscover() (bool, string)\n\n\t// SetFileTypeUnix informs the VCS that files should maintain unix-style line endings.\n\tSetFileTypeUnix(repobasedir string, files ...string) error\n\t// IgnoreAnywhere tells the VCS to ignore these files anywhere in the repo.\n\tIgnoreAnywhere(repobasedir string, files []string) error\n\t// IgnoreAnywhere tells the VCS to ignore these files, rooted in the base of the repo.\n\tIgnoreFiles(repobasedir string, files []string) error\n\n\t// CommitTitle sets the title of the next commit.\n\tCommitTitle(title string)\n\t// NeedsCommit queues up commits for later execution.\n\tNeedsCommit(message string, repobasedir string, names []string)\n\t// DebugCommits dumps a list of future commits.\n\tDebugCommits() commitlater.List\n\t// FlushCommits informs the VCS to do queued up commits.\n\tFlushCommits() error\n\n\t// TestingInitRepo initializes a repo of this type (for use by integration tests)\n\tTestingInitRepo() error\n}\n" }, { "path": "pkg/bblog/bblog.go", "content": "package bblog\n\nimport (\n\t\"io/ioutil\"\n\t\"log\"\n\t\"os\"\n)\n\n/*\n\nTo use this, include the following lines in your .go file.\n\nvar logErr *log.Logger\nvar logDebug *log.Logger\nfunc init() {\n logErr = bblog.GetErr()\n logDebug = bblog.GetDebug(debug)\n}\n\nOr in a function:\n\n logErr := bblog.GetErr()\n logDebug := bblog.GetDebug(debug)\n\tlogDebug.Printf(\"whatever: %v\", err)\n\n*/\n\nvar logErr *log.Logger\nvar logDebug *log.Logger\n\n// GetErr returns a logger handle used for errors\nfunc GetErr() *log.Logger {\n\tif logErr == nil {\n\t\tlogErr = log.New(os.Stderr, \"\", 0)\n\t}\n\treturn logErr\n}\n\n// GetDebug returns a Logger handle used for debug info (output is discarded if viable=false)\nfunc GetDebug(visible bool) *log.Logger {\n\tif visible {\n\t\tlogDebug = log.New(os.Stderr, \"\", 0)\n\t} else {\n\t\t// Invisible mode (i.e. display nothing)\n\t\tlogDebug = log.New(ioutil.Discard, \"\", 0)\n\t}\n\treturn logDebug\n}\n" }, { "path": "pkg/bbutil/filestats.go", "content": "package bbutil\n\nimport (\n\t\"fmt\"\n\t\"io/ioutil\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"sort\"\n\t\"strings\"\n\t\"time\"\n)\n\n// DirExists returns true if directory exists.\nfunc DirExists(path string) (bool, error) {\n\tstat, err := os.Stat(path)\n\tif err == nil {\n\t\treturn stat.IsDir(), nil\n\t}\n\tif os.IsNotExist(err) {\n\t\treturn false, nil\n\t}\n\treturn true, err\n}\n\n// FileExistsOrProblem returns true if the file exists or if we can't determine its existence.\nfunc FileExistsOrProblem(path string) bool {\n\t_, err := os.Stat(path)\n\tif err == nil {\n\t\treturn true\n\t}\n\tif os.IsNotExist(err) {\n\t\treturn false\n\t}\n\treturn true\n}\n\n// Touch updates the timestamp of a file.\nfunc Touch(name string) error {\n\tvar err error\n\t_, err = os.Stat(name)\n\tif os.IsNotExist(err) {\n\t\tfile, err := os.Create(name)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"TouchFile failed: %w\", err)\n\t\t}\n\t\tfile.Close()\n\t}\n\n\tcurrentTime := time.Now().Local()\n\treturn os.Chtimes(name, currentTime, currentTime)\n}\n\n// ReadFileLines is like ioutil.ReadFile() but returns an []string.\nfunc ReadFileLines(filename string) ([]string, error) {\n\tb, err := ioutil.ReadFile(filename)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\ts := string(b)\n\ts = strings.TrimSuffix(s, \"\\n\")\n\tif s == \"\" {\n\t\treturn []string{}, nil\n\t}\n\tl := strings.Split(s, \"\\n\")\n\treturn l, nil\n}\n\n// AddLinesToSortedFile adds a line to a sorted file.\nfunc AddLinesToSortedFile(filename string, newlines ...string) error {\n\tlines, err := ReadFileLines(filename)\n\t//fmt.Printf(\"DEBUG: read=%q\\n\", lines)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"AddLinesToSortedFile can't read %q: %w\", filename, err)\n\t}\n\tif !sort.StringsAreSorted(lines) {\n\t\treturn fmt.Errorf(\"AddLinesToSortedFile: file wasn't sorted: %v\", filename)\n\t}\n\tlines = append(lines, newlines...)\n\tsort.Strings(lines)\n\tcontents := strings.Join(lines, \"\\n\") + \"\\n\"\n\t//fmt.Printf(\"DEBUG: write=%q\\n\", contents)\n\terr = ioutil.WriteFile(filename, []byte(contents), 0o660)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"AddLinesToSortedFile can't write %q: %w\", filename, err)\n\t}\n\treturn nil\n}\n\n// AddLinesToFile adds lines to the end of a file.\nfunc AddLinesToFile(filename string, newlines ...string) error {\n\tlines, err := ReadFileLines(filename)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"AddLinesToFile can't read %q: %w\", filename, err)\n\t}\n\tlines = append(lines, newlines...)\n\tcontents := strings.Join(lines, \"\\n\") + \"\\n\"\n\terr = ioutil.WriteFile(filename, []byte(contents), 0o660)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"AddLinesToFile can't write %q: %w\", filename, err)\n\t}\n\treturn nil\n}\n\n// FindDirInParent looks for target in CWD, or .., or ../.., etc.\nfunc FindDirInParent(target string) (string, error) {\n\t// Prevent an infinite loop by only doing \"cd ..\" this many times\n\tmaxDirLevels := 30\n\trelpath := \".\"\n\tfor i := 0; i < maxDirLevels; i++ {\n\t\t// Does relpath contain our target?\n\t\tt := filepath.Join(relpath, target)\n\t\t//logDebug.Printf(\"Trying %q\\n\", t)\n\t\t_, err := os.Stat(t)\n\t\tif err == nil {\n\t\t\treturn t, nil\n\t\t}\n\t\tif !os.IsNotExist(err) {\n\t\t\treturn \"\", fmt.Errorf(\"stat failed FindDirInParent (%q): %w\", t, err)\n\t\t}\n\t\t// Ok, it really wasn't found.\n\n\t\t// If we are at the root, stop.\n\t\tif abs, err := filepath.Abs(relpath); err == nil && abs == \"/\" {\n\t\t\tbreak\n\t\t}\n\t\t// Try one directory up\n\t\trelpath = filepath.Join(\"..\", relpath)\n\t}\n\treturn \"\", fmt.Errorf(\"Not found\")\n}\n" }, { "path": "pkg/bbutil/rbio_test.go", "content": "package bbutil\n\nimport (\n\t\"testing\"\n)\n\nfunc TestRunBashInputOutput(t *testing.T) {\n\n\tin := \"This is a test of the RBIO system.\\n\"\n\tbin := []byte(in)\n\n\tout, err := RunBashInputOutput(bin, \"cat\")\n\tsout := string(out)\n\tif err != nil {\n\t\tt.Error(err)\n\t}\n\n\tif in != sout {\n\t\tt.Errorf(\"not equal %q %q\", in, out)\n\t}\n}\n" }, { "path": "pkg/bbutil/runbash.go", "content": "package bbutil\n\nimport (\n\t\"bytes\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\t\"os/exec\"\n)\n\n// RunBash runs a Bash command.\nfunc RunBash(command string, args ...string) error {\n\tcmd := exec.Command(command, args...)\n\tcmd.Stdin = os.Stdin\n\tcmd.Stdout = os.Stdout\n\tcmd.Stderr = os.Stderr\n\terr := cmd.Start()\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\terr = cmd.Wait()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"RunBash cmd=%q err=%w\", command, err)\n\t}\n\treturn nil\n}\n\n// RunBashOutput runs a Bash command, captures output.\nfunc RunBashOutput(command string, args ...string) (string, error) {\n\tcmd := exec.Command(command, args...)\n\tcmd.Stdin = os.Stdin\n\tcmd.Stderr = os.Stderr\n\tout, err := cmd.Output()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"RunBashOutput err=%w\", err)\n\t}\n\treturn string(out), err\n}\n\n// RunBashOutputSilent runs a Bash command, captures output, discards stderr.\nfunc RunBashOutputSilent(command string, args ...string) (string, error) {\n\tcmd := exec.Command(command, args...)\n\tcmd.Stdin = os.Stdin\n\t// Leave cmd.Stderr unmodified and stderr is discarded.\n\tout, err := cmd.Output()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"RunBashOutputSilent err=%w\", err)\n\t}\n\treturn string(out), err\n}\n\n// RunBashInput runs a Bash command, sends input on stdin.\nfunc RunBashInput(input string, command string, args ...string) error {\n\n\tcmd := exec.Command(command, args...)\n\tcmd.Stdin = bytes.NewBuffer([]byte(input))\n\tcmd.Stdout = os.Stdout\n\tcmd.Stderr = os.Stderr\n\terr := cmd.Run()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"RunBashInput err=%w\", err)\n\t}\n\treturn nil\n}\n\n// RunBashInputOutput runs a Bash command, sends input on stdin.\nfunc RunBashInputOutput(input []byte, command string, args ...string) ([]byte, error) {\n\n\tcmd := exec.Command(command, args...)\n\tcmd.Stdin = bytes.NewBuffer(input)\n\tcmd.Stderr = os.Stderr\n\tout, err := cmd.Output()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"RunBashInputOutput err=%w\", err)\n\t}\n\treturn out, nil\n}\n" }, { "path": "pkg/bbutil/shred.go", "content": "package bbutil\n\n// Pick an appropriate secure erase command for this operating system\n// or just delete the file with os.Remove().\n\n// Code rewritten based https://codereview.stackexchange.com/questions/245072\n\nimport (\n\t\"fmt\"\n\t\"io/ioutil\"\n\t\"os\"\n\t\"os/exec\"\n)\n\nvar shredCmds = []struct {\n\tname, opts string\n}{\n\t{\"sdelete\", \"-a\"},\n\t{\"shred\", \"-u\"},\n\t{\"srm\", \"-f\"},\n\t{\"rm\", \"-Pf\"},\n}\n\nfunc shredTemp(path, opts string) error {\n\tfile, err := ioutil.TempFile(\"\", \"shredTemp.\")\n\tif err != nil {\n\t\treturn err\n\t}\n\tfilename := file.Name()\n\tdefer os.Remove(filename)\n\tdefer file.Close()\n\n\terr = file.Close()\n\tif err != nil {\n\t\treturn err\n\t}\n\terr = RunBash(path, opts, filename)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n\nvar shredPath, shredOpts = func() (string, string) {\n\tfor _, cmd := range shredCmds {\n\t\tpath, err := exec.LookPath(cmd.name)\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\terr = shredTemp(path, cmd.opts)\n\t\tif err == nil {\n\t\t\treturn path, cmd.opts\n\t\t}\n\t}\n\treturn \"\", \"\"\n}()\n\n// ShredInfo reveals the shred command and flags (for \"blackbox info\")\nfunc ShredInfo() string {\n\treturn shredPath + \" \" + shredOpts\n}\n\n// shredFile shreds one file.\nfunc shredFile(filename string) error {\n\tfi, err := os.Stat(filename)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif !fi.Mode().IsRegular() {\n\t\terr := fmt.Errorf(\"filename is not mode regular\")\n\t\treturn err\n\t}\n\n\tif shredPath == \"\" {\n\t\t// No secure erase command found. Default to a normal file delete.\n\t\t// TODO(tlim): Print a warning? Have a flag that causes this to be an error?\n\t\treturn os.Remove(filename)\n\t}\n\n\terr = RunBash(shredPath, shredOpts, filename)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n\n// ShredFiles securely erases a list of files.\nfunc ShredFiles(names []string) error {\n\n\t// TODO(tlim) DO the shredding in parallel like in v1.\n\n\tvar eerr error\n\tfor _, n := range names {\n\t\t_, err := os.Stat(n)\n\t\tif err != nil {\n\t\t\tif os.IsNotExist(err) {\n\t\t\t\tfmt.Printf(\"======= already gone: %q\\n\", n)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\t\tfmt.Printf(\"========== SHREDDING: %q\\n\", n)\n\t\te := shredFile(n)\n\t\tif e != nil {\n\t\t\teerr = e\n\t\t\tfmt.Printf(\"ERROR: %v\\n\", e)\n\t\t}\n\t}\n\treturn eerr\n}\n" }, { "path": "pkg/bbutil/sortedfile_test.go", "content": "package bbutil\n\nimport (\n\t\"io/ioutil\"\n\t\"os\"\n\t\"testing\"\n)\n\nfunc TestAddLinesToSortedFile(t *testing.T) {\n\n\tvar tests = []struct {\n\t\tstart string\n\t\tadd []string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\t\"\",\n\t\t\t[]string{\"one\"},\n\t\t\t\"one\\n\",\n\t\t},\n\t\t{\n\t\t\t\"begin\\ntwo\\n\",\n\t\t\t[]string{\"at top\"},\n\t\t\t\"at top\\nbegin\\ntwo\\n\",\n\t\t},\n\t\t{\n\t\t\t\"begin\\ntwo\\n\",\n\t\t\t[]string{\"zbottom\"},\n\t\t\t\"begin\\ntwo\\nzbottom\\n\",\n\t\t},\n\t\t{\n\t\t\t\"begin\\ntwo\\n\",\n\t\t\t[]string{\"middle\"},\n\t\t\t\"begin\\nmiddle\\ntwo\\n\",\n\t\t},\n\t}\n\n\tfor i, test := range tests {\n\t\tcontent := []byte(test.start)\n\t\ttmpfile, err := ioutil.TempFile(\"\", \"example\")\n\t\tif err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\t\ttmpfilename := tmpfile.Name()\n\t\tdefer os.Remove(tmpfilename)\n\n\t\tif _, err := tmpfile.Write(content); err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\t\tif err := tmpfile.Close(); err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\t\tAddLinesToSortedFile(tmpfilename, test.add...)\n\t\texpected := test.expected\n\n\t\tgot, err := ioutil.ReadFile(tmpfilename)\n\t\tif err != nil {\n\t\t\tt.Fatal(err)\n\t\t}\n\t\tif expected != string(got) {\n\t\t\tt.Errorf(\"test %v: contents wrong:\\nexpected: %q\\n got: %q\", i, expected, got)\n\t\t}\n\t\tos.Remove(tmpfilename)\n\t}\n\n}\n" }, { "path": "pkg/bbutil/umask_posix.go", "content": "//go:build !windows\n// +build !windows\n\npackage bbutil\n\nimport \"syscall\"\n\n// Umask is a no-op on Windows, and calls syscall.Umask on all other\n// systems. On Windows it returns 0, which is a decoy.\nfunc Umask(mask int) int {\n\treturn syscall.Umask(mask)\n}\n" }, { "path": "pkg/bbutil/umask_windows.go", "content": "//go:build windows\n// +build windows\n\npackage bbutil\n\n// Umask is a no-op on Windows, and calls syscall.Umask on all other\n// systems. On Windows it returns 0, which is a decoy.\nfunc Umask(mask int) int {\n\treturn 0o000\n}\n" }, { "path": "pkg/box/box.go", "content": "package box\n\n// box implements the box model.\n\nimport (\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"sort\"\n\t\"strings\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/bblog\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/bbutil\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/crypters\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/vcs\"\n\t\"github.com/urfave/cli/v2\"\n)\n\nvar logErr *log.Logger\nvar logDebug *log.Logger\n\n// Box describes what we know about a box.\ntype Box struct {\n\t// Paths:\n\tTeam string // Name of the team (i.e. .blackbox-$TEAM)\n\tRepoBaseDir string // Rel path to the VCS repo.\n\tConfigPath string // Abs or Rel path to the .blackbox (or whatever) directory.\n\tConfigRO bool // True if we should not try to change files in ConfigPath.\n\t// Settings:\n\tUmask int // umask to set when decrypting\n\tEditor string // Editor to call\n\tDebug bool // Are we in debug logging mode?\n\t// Cache of data gathered from .blackbox:\n\tAdmins []string // If non-empty, the list of admins.\n\tFiles []string // If non-empty, the list of files.\n\tFilesSet map[string]bool // If non-nil, a set of Files.\n\t// Handles to interfaces:\n\tVcs vcs.Vcs // Interface access to the VCS.\n\tCrypter crypters.Crypter // Inteface access to GPG.\n\tlogErr *log.Logger\n\tlogDebug *log.Logger\n}\n\n// StatusMode is a type of query.\ntype StatusMode int\n\nconst (\n\t// Itemized is blah\n\tItemized StatusMode = iota // Individual files by name\n\t// All files is blah\n\tAll\n\t// Unchanged is blah\n\tUnchanged\n\t// Changed is blah\n\tChanged\n)\n\n// NewFromFlags creates a box using items from flags. Nearly all subcommands use this.\nfunc NewFromFlags(c *cli.Context) *Box {\n\n\t// The goal of this is to create a fully-populated box (and box.Vcs)\n\t// so that all subcommands have all the fields and interfaces they need\n\t// to do their job.\n\n\tlogErr = bblog.GetErr()\n\tlogDebug = bblog.GetDebug(c.Bool(\"debug\"))\n\n\tbx := &Box{\n\t\tUmask: c.Int(\"umask\"),\n\t\tEditor: c.String(\"editor\"),\n\t\tTeam: c.String(\"team\"),\n\t\tlogErr: bblog.GetErr(),\n\t\tlogDebug: bblog.GetDebug(c.Bool(\"debug\")),\n\t\tDebug: c.Bool(\"debug\"),\n\t}\n\n\t// Discover which kind of VCS is in use, and the repo root.\n\tbx.Vcs, bx.RepoBaseDir = vcs.Discover()\n\n\t// Discover the crypto backend (GnuPG, go-openpgp, etc.)\n\tbx.Crypter = crypters.SearchByName(c.String(\"crypto\"), c.Bool(\"debug\"))\n\tif bx.Crypter == nil {\n\t\tfmt.Printf(\"ERROR! No CRYPTER found! Please set --crypto correctly or use the damn default\\n\")\n\t\tos.Exit(1)\n\t}\n\n\t// Find the .blackbox (or equiv.) directory.\n\tvar err error\n\tconfigFlag := c.String(\"config\")\n\tif configFlag != \"\" {\n\t\t// Flag is set. Better make sure it is valid.\n\t\tif !filepath.IsAbs(configFlag) {\n\t\t\tfmt.Printf(\"config flag value is a relative path. Too risky. Exiting.\\n\")\n\t\t\tos.Exit(1)\n\t\t\t// NB(tlim): We could return filepath.Abs(config) or maybe it just\n\t\t\t// works as is. I don't know, and until we have a use case to prove\n\t\t\t// it out, it's best to just not implement this.\n\t\t}\n\t\tbx.ConfigPath = configFlag\n\t\tbx.ConfigRO = true // External configs treated as read-only.\n\t\t// TODO(tlim): We could get fancy here and set ConfigReadOnly=true only\n\t\t// if we are sure configFlag is not within bx.RepoBaseDir. Again, I'd\n\t\t// like to see a use-case before we implement this.\n\t\treturn bx\n\n\t}\n\t// Normal path. Flag not set, so we discover the path.\n\tbx.ConfigPath, err = FindConfigDir(bx.RepoBaseDir, c.String(\"team\"))\n\tif err != nil && c.Command.Name != \"info\" {\n\t\tfmt.Printf(\"Can't find .blackbox or equiv. Have you run init?\\n\")\n\t\tos.Exit(1)\n\t}\n\treturn bx\n}\n\n// NewUninitialized creates a box in a pre-init situation.\nfunc NewUninitialized(c *cli.Context) *Box {\n\t/*\n\t\tThis is for \"blackbox init\" (used before \".blackbox*\" exists)\n\n\t\tInit needs: How we populate it:\n\t\tbx.Vcs: Discovered by calling each plug-in until succeeds.\n\t\tbx.ConfigDir: Generated algorithmically (it doesn't exist yet).\n\t*/\n\tbx := &Box{\n\t\tUmask: c.Int(\"umask\"),\n\t\tEditor: c.String(\"editor\"),\n\t\tTeam: c.String(\"team\"),\n\t\tlogErr: bblog.GetErr(),\n\t\tlogDebug: bblog.GetDebug(c.Bool(\"debug\")),\n\t\tDebug: c.Bool(\"debug\"),\n\t}\n\tbx.Vcs, bx.RepoBaseDir = vcs.Discover()\n\tif c.String(\"configdir\") == \"\" {\n\t\trel := \".blackbox\"\n\t\tif bx.Team != \"\" {\n\t\t\trel = \".blackbox-\" + bx.Team\n\t\t}\n\t\tbx.ConfigPath = filepath.Join(bx.RepoBaseDir, rel)\n\t} else {\n\t\t// Wait. The user is using the --config flag on a repo that\n\t\t// hasn't been created yet? I hope this works!\n\t\tfmt.Printf(\"ERROR: You can not set --config when initializing a new repo. Please run this command from within a repo, with no --config flag. Or, file a bug explaining your use caseyour use-case. Exiting!\\n\")\n\t\tos.Exit(1)\n\t\t// TODO(tlim): We could get fancy here and query the Vcs to see if the\n\t\t// path would fall within the repo, figure out the relative path, and\n\t\t// use that value. (and error if configflag is not within the repo).\n\t\t// That would be error prone and would only help the zero users that\n\t\t// ever see the above error message.\n\t}\n\treturn bx\n}\n\n// NewForTestingInit creates a box in a bare environment.\nfunc NewForTestingInit(vcsname string) *Box {\n\t/*\n\n\t\tThis is for \"blackbox test_init\" (secret command used in integration tests; when nothing exists)\n\t\tTestingInitRepo only uses bx.Vcs, so that's all we set.\n\t\tPopulates bx.Vcs by finding the provider named vcsname.\n\t*/\n\tbx := &Box{}\n\n\t// Find the\n\tvar vh vcs.Vcs\n\tvar err error\n\tvcsname = strings.ToLower(vcsname)\n\tfor _, v := range vcs.Catalog {\n\t\tif strings.ToLower(v.Name) == vcsname {\n\t\t\tvh, err = v.New()\n\t\t\tif err != nil {\n\t\t\t\treturn nil // No idea how that would happen.\n\t\t\t}\n\t\t}\n\t}\n\tbx.Vcs = vh\n\n\treturn bx\n}\n\nfunc (bx *Box) getAdmins() error {\n\t// Memoized\n\tif len(bx.Admins) != 0 {\n\t\treturn nil\n\t}\n\n\t// TODO(tlim): Try the json file.\n\n\t// Try the legacy file:\n\tfn := filepath.Join(bx.ConfigPath, \"blackbox-admins.txt\")\n\tbx.logDebug.Printf(\"Admins file: %q\", fn)\n\ta, err := bbutil.ReadFileLines(fn)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getAdmins can't load %q: %v\", fn, err)\n\t}\n\tif !sort.StringsAreSorted(a) {\n\t\treturn fmt.Errorf(\"file corrupt. Lines not sorted: %v\", fn)\n\t}\n\tbx.Admins = a\n\n\treturn nil\n}\n\n// getFiles populates Files and FileMap.\nfunc (bx *Box) getFiles() error {\n\tif len(bx.Files) != 0 {\n\t\treturn nil\n\t}\n\n\t// TODO(tlim): Try the json file.\n\n\t// Try the legacy file:\n\tfn := filepath.Join(bx.ConfigPath, \"blackbox-files.txt\")\n\tbx.logDebug.Printf(\"Files file: %q\", fn)\n\ta, err := bbutil.ReadFileLines(fn)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getFiles can't load %q: %v\", fn, err)\n\t}\n\tif !sort.StringsAreSorted(a) {\n\t\treturn fmt.Errorf(\"file corrupt. Lines not sorted: %v\", fn)\n\t}\n\tfor _, n := range a {\n\t\tbx.Files = append(bx.Files, filepath.Join(bx.RepoBaseDir, n))\n\t}\n\n\tbx.FilesSet = make(map[string]bool, len(bx.Files))\n\tfor _, s := range bx.Files {\n\t\tbx.FilesSet[s] = true\n\t}\n\n\treturn nil\n}\n" }, { "path": "pkg/box/boxutils.go", "content": "package box\n\nimport (\n\t\"bufio\"\n\t\"fmt\"\n\t\"os\"\n\t\"os/user\"\n\t\"path/filepath\"\n\t\"runtime\"\n\t\"strconv\"\n\t\"strings\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/makesafe\"\n)\n\n// FileStatus returns the status of a file.\nfunc FileStatus(name string) (string, error) {\n\t/*\n\t\tDECRYPTED: File is decrypted and ready to edit (unknown if it has been edited).\n\t\tENCRYPTED: GPG file is newer than plaintext. Indicates recented edited then encrypted.\n\t\tSHREDDED: Plaintext is missing.\n\t\tGPGMISSING: The .gpg file is missing. Oops?\n\t\tPLAINERROR: Can't access the plaintext file to determine status.\n\t\tGPGERROR: Can't access .gpg file to determine status.\n\t*/\n\n\tp := name\n\te := p + \".gpg\"\n\tps, perr := os.Stat(p)\n\tes, eerr := os.Stat(e)\n\tif perr == nil && eerr == nil {\n\t\tif ps.ModTime().Before(es.ModTime()) {\n\t\t\treturn \"ENCRYPTED\", nil\n\t\t}\n\t\treturn \"DECRYPTED\", nil\n\t}\n\n\tif os.IsNotExist(perr) && os.IsNotExist(eerr) {\n\t\treturn \"BOTHMISSING\", nil\n\t}\n\n\tif eerr != nil {\n\t\tif os.IsNotExist(eerr) {\n\t\t\treturn \"GPGMISSING\", nil\n\t\t}\n\t\treturn \"GPGERROR\", eerr\n\t}\n\n\tif perr != nil {\n\t\tif os.IsNotExist(perr) {\n\t\t\treturn \"SHREDDED\", nil\n\t\t}\n\t}\n\treturn \"PLAINERROR\", perr\n}\n\nfunc anyGpg(names []string) error {\n\tfor _, name := range names {\n\t\tif strings.HasSuffix(name, \".gpg\") {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"no not specify .gpg files. Specify %q not %q\",\n\t\t\t\tstrings.TrimSuffix(name, \".gpg\"), name)\n\t\t}\n\t}\n\treturn nil\n}\n\n// func isChanged(pname string) (bool, error) {\n// \t// if .gpg exists but not plainfile: unchanged\n// \t// if plaintext exists but not .gpg: changed\n// \t// if plainfile < .gpg: unchanged\n// \t// if plainfile > .gpg: don't know, need to try diff\n\n// \t// Gather info about the files:\n\n// \tpstat, perr := os.Stat(pname)\n// \tif perr != nil && (!os.IsNotExist(perr)) {\n// \t\treturn false, fmt.Errorf(\"isChanged(%q) returned error: %w\", pname, perr)\n// \t}\n// \tgname := pname + \".gpg\"\n// \tgstat, gerr := os.Stat(gname)\n// \tif gerr != nil && (!os.IsNotExist(perr)) {\n// \t\treturn false, fmt.Errorf(\"isChanged(%q) returned error: %w\", gname, gerr)\n// \t}\n\n// \tpexists := perr == nil\n// \tgexists := gerr == nil\n\n// \t// Use the above rules:\n\n// \t// if .gpg exists but not plainfile: unchanged\n// \tif gexists && !pexists {\n// \t\treturn false, nil\n// \t}\n\n// \t// if plaintext exists but not .gpg: changed\n// \tif pexists && !gexists {\n// \t\treturn true, nil\n// \t}\n\n// \t// At this point we can conclude that both p and g exist.\n// \t//\tCan't hurt to test that assertion.\n// \tif (!pexists) && (!gexists) {\n// \t\treturn false, fmt.Errorf(\"Assertion failed. p and g should exist: pn=%q\", pname)\n// \t}\n\n// \tpmodtime := pstat.ModTime()\n// \tgmodtime := gstat.ModTime()\n// \t// if plainfile < .gpg: unchanged\n// \tif pmodtime.Before(gmodtime) {\n// \t\treturn false, nil\n// \t}\n// \t// if plainfile > .gpg: don't know, need to try diff\n// \treturn false, fmt.Errorf(\"Can not know for sure. Try git diff?\")\n// }\n\nfunc parseGroup(userinput string) (int, error) {\n\tif userinput == \"\" {\n\t\treturn -1, fmt.Errorf(\"group spec is empty string\")\n\t}\n\n\t// If it is a valid number, use it.\n\ti, err := strconv.Atoi(userinput)\n\tif err == nil {\n\t\treturn i, nil\n\t}\n\n\t// If not a number, look it up by name.\n\tg, err := user.LookupGroup(userinput)\n\tif err == nil {\n\t\ti, err = strconv.Atoi(g.Gid)\n\t\treturn i, nil\n\t}\n\n\t// Give up.\n\treturn -1, err\n}\n\n// FindConfigDir tests various places until it finds the config dir.\n// If we can't determine the relative path, \"\" is returned.\nfunc FindConfigDir(reporoot, team string) (string, error) {\n\n\tcandidates := []string{}\n\tif team != \"\" {\n\t\tcandidates = append(candidates, \".blackbox-\"+team)\n\t}\n\tcandidates = append(candidates, \".blackbox\")\n\tcandidates = append(candidates, \"keyrings/live\")\n\tlogDebug.Printf(\"DEBUG: candidates = %q\\n\", candidates)\n\n\tmaxDirLevels := 30 // Prevent an infinite loop\n\trelpath := \".\"\n\tfor i := 0; i < maxDirLevels; i++ {\n\t\t// Does relpath contain any of our directory names?\n\t\tfor _, c := range candidates {\n\t\t\tt := filepath.Join(relpath, c)\n\t\t\tlogDebug.Printf(\"Trying %q\\n\", t)\n\t\t\tfi, err := os.Stat(t)\n\t\t\tif err == nil && fi.IsDir() {\n\t\t\t\treturn t, nil\n\t\t\t}\n\t\t\tif err == nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"path %q is not a directory: %w\", t, err)\n\t\t\t}\n\t\t\tif !os.IsNotExist(err) {\n\t\t\t\treturn \"\", fmt.Errorf(\"dirExists access error: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\t// If we are at the root, stop.\n\t\tif abs, _ := filepath.Abs(relpath); abs == \"/\" {\n\t\t\tbreak\n\t\t}\n\t\t// Try one directory up\n\t\trelpath = filepath.Join(\"..\", relpath)\n\t}\n\n\treturn \"\", fmt.Errorf(\"No .blackbox (or equiv) directory found\")\n}\n\nfunc gpgAgentNotice() {\n\t// Is gpg-agent configured?\n\tif os.Getenv(\"GPG_AGENT_INFO\") != \"\" {\n\t\treturn\n\t}\n\t// Are we on macOS?\n\tif runtime.GOOS == \"darwin\" {\n\t\t// We assume the use of https://gpgtools.org, which\n\t\t// uses the keychain.\n\t\treturn\n\t}\n\n\t// TODO(tlim): v1 verifies that \"gpg-agent --version\" outputs a version\n\t// string that is 2.1.0 or higher. It seems that 1.x is incompatible.\n\n\tfmt.Println(\"WARNING: You probably want to run gpg-agent as\")\n\tfmt.Println(\"you will be asked for your passphrase many times.\")\n\tfmt.Println(\"Example: $ eval $(gpg-agent --daemon)\")\n\tfmt.Print(\"Press CTRL-C now to stop. ENTER to continue: \")\n\tinput := bufio.NewScanner(os.Stdin)\n\tinput.Scan()\n}\n\nfunc shouldWeOverwrite() {\n\tfmt.Println()\n\tfmt.Println(\"WARNING: This will overwrite any unencrypted files laying about.\")\n\tfmt.Print(\"Press CTRL-C now to stop. ENTER to continue: \")\n\tinput := bufio.NewScanner(os.Stdin)\n\tinput.Scan()\n}\n\n// PrettyCommitMessage generates a pretty commit message.\nfunc PrettyCommitMessage(verb string, files []string) string {\n\tif len(files) == 0 {\n\t\t// This use-case should probably be an error.\n\t\treturn verb + \" (no files)\"\n\t}\n\trfiles := makesafe.RedactMany(files)\n\tm, truncated := makesafe.FirstFewFlag(rfiles)\n\tif truncated {\n\t\treturn verb + \": \" + m\n\t}\n\treturn verb + \": \" + m\n}\n" }, { "path": "pkg/box/pretty_test.go", "content": "package box\n\nimport \"testing\"\n\nfunc TestPrettyCommitMessage(t *testing.T) {\n\tlong := \"aVeryVeryLongLongLongStringStringString\"\n\tfor i, test := range []struct {\n\t\tdata []string\n\t\texpected string\n\t}{\n\t\t{[]string{}, `HEADING (no files)`},\n\t\t{[]string{\"one\"}, `HEADING: one`},\n\t\t{[]string{\"one\", \"two\"}, `HEADING: one two`},\n\t\t{[]string{\"one\", \"two\", \"three\"}, `HEADING: one two three`},\n\t\t{[]string{\"one\", \"two\", \"three\", \"four\"},\n\t\t\t`HEADING: one two three four`},\n\t\t{[]string{\"one\", \"two\", \"three\", \"four\", \"five\"},\n\t\t\t`HEADING: one two three four five`},\n\t\t{[]string{\"has spaces.txt\"}, `HEADING: \"has spaces.txt\"`},\n\t\t{[]string{\"two\\n\"}, `HEADING: \"twoX\"(redacted)`},\n\t\t{[]string{\"smile😁eyes\"}, `HEADING: smile😁eyes`},\n\t\t{[]string{\"tab\\ttab\", \"two very long strings.txt\"},\n\t\t\t`HEADING: \"tabXtab\"(redacted) \"two very long strings.txt\"`},\n\t\t{[]string{long, long, long, long},\n\t\t\t\"HEADING: \" + long + \" \" + long + \" (and others)\"},\n\t} {\n\t\tg := PrettyCommitMessage(\"HEADING\", test.data)\n\t\tif g == test.expected {\n\t\t\t//t.Logf(\"%03d: PASSED files=%q\\n\", i, test.data)\n\t\t\tt.Logf(\"%03d: PASSED\", i)\n\t\t} else {\n\t\t\tt.Errorf(\"%03d: FAILED files==%q got=(%q) wanted=(%q)\\n\", i, test.data, g, test.expected)\n\t\t}\n\t}\n}\n" }, { "path": "pkg/box/verbs.go", "content": "package box\n\n// This file implements the business logic related to a black box.\n// These functions are usually called from cmd/blackbox/drive.go or\n// external sytems that use box as a module.\nimport (\n\t\"bufio\"\n\t\"fmt\"\n\t\"io/ioutil\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"sort\"\n\t\"strconv\"\n\t\"strings\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/bbutil\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/makesafe\"\n\t\"github.com/olekukonko/tablewriter\"\n)\n\n// AdminAdd adds admins.\nfunc (bx *Box) AdminAdd(nom string, sdir string) error {\n\terr := bx.getAdmins()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t//fmt.Printf(\"ADMINS=%q\\n\", bx.Admins)\n\n\t// Check for duplicates.\n\tif i := sort.SearchStrings(bx.Admins, nom); i < len(bx.Admins) && bx.Admins[i] == nom {\n\t\treturn fmt.Errorf(\"Admin %v already an admin\", nom)\n\t}\n\n\tbx.logDebug.Printf(\"ADMIN ADD rbd=%q\\n\", bx.RepoBaseDir)\n\tchangedFiles, err := bx.Crypter.AddNewKey(nom, bx.RepoBaseDir, sdir, bx.ConfigPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"AdminAdd failed AddNewKey: %v\", err)\n\t}\n\n\t// TODO(tlim): Try the json file.\n\n\t// Try the legacy file:\n\tfn := filepath.Join(bx.ConfigPath, \"blackbox-admins.txt\")\n\tbx.logDebug.Printf(\"Admins file: %q\", fn)\n\terr = bbutil.AddLinesToSortedFile(fn, nom)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not update file (%q,%q): %v\", fn, nom, err)\n\t}\n\tchangedFiles = append([]string{fn}, changedFiles...)\n\n\tbx.Vcs.NeedsCommit(\"NEW ADMIN: \"+nom, bx.RepoBaseDir, changedFiles)\n\treturn nil\n}\n\n// AdminList lists the admin id's.\nfunc (bx *Box) AdminList() error {\n\terr := bx.getAdmins()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfor _, v := range bx.Admins {\n\t\tfmt.Println(v)\n\t}\n\treturn nil\n}\n\n// AdminRemove removes an id from the admin list.\nfunc (bx *Box) AdminRemove([]string) error {\n\treturn fmt.Errorf(\"NOT IMPLEMENTED: AdminRemove\")\n}\n\n// Cat outputs a file, unencrypting if needed.\nfunc (bx *Box) Cat(names []string) error {\n\tif err := anyGpg(names); err != nil {\n\t\treturn fmt.Errorf(\"cat: %w\", err)\n\t}\n\n\terr := bx.getFiles()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfor _, name := range names {\n\t\tvar out []byte\n\t\tvar err error\n\t\tif _, ok := bx.FilesSet[name]; ok {\n\t\t\tout, err = bx.Crypter.Cat(name)\n\t\t} else {\n\t\t\tout, err = ioutil.ReadFile(name)\n\t\t}\n\t\tif err != nil {\n\t\t\tbx.logErr.Printf(\"BX_CRY3\\n\")\n\t\t\treturn fmt.Errorf(\"cat: %w\", err)\n\t\t}\n\t\tfmt.Print(string(out))\n\t}\n\treturn nil\n}\n\n// Decrypt decrypts a file.\nfunc (bx *Box) Decrypt(names []string, overwrite bool, bulkpause bool, setgroup string) error {\n\tvar err error\n\n\tif err := anyGpg(names); err != nil {\n\t\treturn err\n\t}\n\n\terr = bx.getFiles()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif bulkpause {\n\t\tgpgAgentNotice()\n\t}\n\n\tgroupchange := false\n\tgid := -1\n\tif setgroup != \"\" {\n\t\tgid, err = parseGroup(setgroup)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Invalid group name or gid: %w\", err)\n\t\t}\n\t\tgroupchange = true\n\t}\n\tbx.logDebug.Printf(\"DECRYPT GROUP %q %v,%v\\n\", setgroup, groupchange, gid)\n\n\tif len(names) == 0 {\n\t\tnames = bx.Files\n\t}\n\treturn decryptMany(bx, names, overwrite, groupchange, gid)\n}\n\nfunc decryptMany(bx *Box, names []string, overwrite bool, groupchange bool, gid int) error {\n\n\t// TODO(tlim): If we want to decrypt them in parallel, go has a helper function\n\t// called \"sync.WaitGroup()\"\" which would be useful here. We would probably\n\t// want to add a flag on the command line (stored in a field such as bx.ParallelMax)\n\t// that limits the amount of parallelism. The default for the flag should\n\t// probably be runtime.NumCPU().\n\n\tfor _, name := range names {\n\t\tfmt.Printf(\"========== DECRYPTING %q\\n\", name)\n\t\tif !bx.FilesSet[name] {\n\t\t\tbx.logErr.Printf(\"Skipping %q: File not registered with Blackbox\", name)\n\t\t\tcontinue\n\t\t}\n\t\tif (!overwrite) && bbutil.FileExistsOrProblem(name) {\n\t\t\tbx.logErr.Printf(\"Skipping %q: Will not overwrite existing file\", name)\n\t\t\tcontinue\n\t\t}\n\n\t\t// TODO(tlim) v1 detects zero-length files and removes them, even\n\t\t// if overwrite is disabled. I don't think anyone has ever used that\n\t\t// feature. That said, if we want to do that, we would implement it here.\n\n\t\t// TODO(tlim) v1 takes the md5 hash of the plaintext before it decrypts,\n\t\t// then compares the new plaintext's md5. It prints \"EXTRACTED\" if\n\t\t// there is a change.\n\n\t\terr := bx.Crypter.Decrypt(name, bx.Umask, overwrite)\n\t\tif err != nil {\n\t\t\tbx.logErr.Printf(\"%q: %v\", name, err)\n\t\t\tcontinue\n\t\t}\n\n\t\t// FIXME(tlim): Clone the file perms from the .gpg file to the plaintext file.\n\n\t\tif groupchange {\n\t\t\t// FIXME(tlim): Also \"chmod g+r\" the file.\n\t\t\tos.Chown(name, -1, gid)\n\t\t}\n\t}\n\treturn nil\n}\n\n// Diff ...\nfunc (bx *Box) Diff([]string) error {\n\treturn fmt.Errorf(\"NOT IMPLEMENTED: Diff\")\n}\n\n// Edit unencrypts, calls editor, calls encrypt.\nfunc (bx *Box) Edit(names []string) error {\n\n\tif err := anyGpg(names); err != nil {\n\t\treturn err\n\t}\n\n\terr := bx.getFiles()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfor _, name := range names {\n\t\tif _, ok := bx.FilesSet[name]; ok {\n\t\t\tif !bbutil.FileExistsOrProblem(name) {\n\t\t\t\terr := bx.Crypter.Decrypt(name, bx.Umask, false)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"edit failed %q: %w\", name, err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\terr := bbutil.RunBash(bx.Editor, name)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\n// Encrypt encrypts a file.\nfunc (bx *Box) Encrypt(names []string, shred bool) error {\n\tvar err error\n\n\tif err = anyGpg(names); err != nil {\n\t\treturn err\n\t}\n\n\terr = bx.getAdmins()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = bx.getFiles()\n\tif err != nil {\n\t\treturn err\n\t}\n\tif len(names) == 0 {\n\t\tnames = bx.Files\n\t}\n\n\tenames, err := encryptMany(bx, names, shred)\n\n\tbx.Vcs.NeedsCommit(\n\t\tPrettyCommitMessage(\"ENCRYPTED\", names),\n\t\tbx.RepoBaseDir,\n\t\tenames,\n\t)\n\n\treturn err\n}\n\nfunc encryptMany(bx *Box, names []string, shred bool) ([]string, error) {\n\tvar enames []string\n\tfor _, name := range names {\n\t\tfmt.Printf(\"========== ENCRYPTING %q\\n\", name)\n\t\tif !bx.FilesSet[name] {\n\t\t\tbx.logErr.Printf(\"Skipping %q: File not registered with Blackbox\", name)\n\t\t\tcontinue\n\t\t}\n\t\tif !bbutil.FileExistsOrProblem(name) {\n\t\t\tbx.logErr.Printf(\"Skipping. Plaintext does not exist: %q\", name)\n\t\t\tcontinue\n\t\t}\n\t\tename, err := bx.Crypter.Encrypt(name, bx.Umask, bx.Admins)\n\t\tif err != nil {\n\t\t\tbx.logErr.Printf(\"Failed to encrypt %q: %v\", name, err)\n\t\t\tcontinue\n\t\t}\n\t\tenames = append(enames, ename)\n\t\tif shred {\n\t\t\tbx.Shred([]string{name})\n\t\t}\n\t}\n\n\treturn enames, nil\n}\n\n// FileAdd enrolls files.\nfunc (bx *Box) FileAdd(names []string, shred bool) error {\n\tbx.logDebug.Printf(\"FileAdd(shred=%v, %v)\", shred, names)\n\n\t// Check for dups.\n\t// Encrypt them all.\n\t// If that succeeds, add to the blackbox-files.txt file.\n\t// (optionally) shred the plaintext.\n\n\t// FIXME(tlim): Check if the plaintext is in GIT. If it is,\n\t// remove it from Git and print a warning that they should\n\t// eliminate the history or rotate any secrets.\n\n\tif err := anyGpg(names); err != nil {\n\t\treturn err\n\t}\n\n\terr := bx.getAdmins()\n\tif err != nil {\n\t\treturn err\n\t}\n\terr = bx.getFiles()\n\tif err != nil {\n\t\treturn err\n\t}\n\tif err := anyGpg(names); err != nil {\n\t\treturn err\n\t}\n\n\t// Check for newlines\n\tfor _, n := range names {\n\t\tif strings.ContainsAny(n, \"\\n\") {\n\t\t\treturn fmt.Errorf(\"file %q contains a newlineregistered\", n)\n\t\t}\n\t}\n\n\t// Check for duplicates.\n\tfor _, n := range names {\n\t\tif i := sort.SearchStrings(bx.Files, n); i < len(bx.Files) && bx.Files[i] == n {\n\t\t\treturn fmt.Errorf(\"file %q already registered\", n)\n\t\t}\n\t}\n\n\t// Encrypt\n\tvar needsCommit []string\n\tfor _, name := range names {\n\t\ts, err := bx.Crypter.Encrypt(name, bx.Umask, bx.Admins)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"AdminAdd failed AddNewKey: %v\", err)\n\t\t}\n\t\tneedsCommit = append(needsCommit, s)\n\t}\n\n\t// TODO(tlim): Try the json file.\n\n\t// Try the legacy file:\n\tfn := filepath.Join(bx.ConfigPath, \"blackbox-files.txt\")\n\tbx.logDebug.Printf(\"Files file: %q\", fn)\n\terr = bbutil.AddLinesToSortedFile(fn, names...)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not update file (%q,%q): %v\", fn, names, err)\n\t}\n\n\terr = bx.Shred(names)\n\tif err != nil {\n\t\tbx.logErr.Printf(\"Error while shredding: %v\", err)\n\t}\n\n\tbx.Vcs.CommitTitle(\"BLACKBOX ADD FILE: \" + makesafe.FirstFew(makesafe.ShellMany(names)))\n\n\tbx.Vcs.IgnoreFiles(bx.RepoBaseDir, names)\n\n\tbx.Vcs.NeedsCommit(\n\t\tPrettyCommitMessage(\"blackbox-files.txt add\", names),\n\t\tbx.RepoBaseDir,\n\t\tappend([]string{filepath.Join(bx.ConfigPath, \"blackbox-files.txt\")}, needsCommit...),\n\t)\n\treturn nil\n}\n\n// FileList lists the files.\nfunc (bx *Box) FileList() error {\n\terr := bx.getFiles()\n\tif err != nil {\n\t\treturn err\n\t}\n\tfor _, v := range bx.Files {\n\t\tfmt.Println(v)\n\t}\n\treturn nil\n}\n\n// FileRemove de-enrolls files.\nfunc (bx *Box) FileRemove(names []string) error {\n\treturn fmt.Errorf(\"NOT IMPLEMENTED: FileRemove\")\n}\n\n// Info prints debugging info.\nfunc (bx *Box) Info() error {\n\n\terr := bx.getFiles()\n\tif err != nil {\n\t\tbx.logErr.Printf(\"Info getFiles: %v\", err)\n\t}\n\n\terr = bx.getAdmins()\n\tif err != nil {\n\t\tbx.logErr.Printf(\"Info getAdmins: %v\", err)\n\t}\n\n\tfmt.Println(\"BLACKBOX:\")\n\tfmt.Printf(\" Debug: %v\\n\", bx.Debug)\n\tfmt.Printf(\" Team: %q\\n\", bx.Team)\n\tfmt.Printf(\" RepoBaseDir: %q\\n\", bx.RepoBaseDir)\n\tfmt.Printf(\" ConfigPath: %q\\n\", bx.ConfigPath)\n\tfmt.Printf(\" Umask: %04o\\n\", bx.Umask)\n\tfmt.Printf(\" Editor: %v\\n\", bx.Editor)\n\tfmt.Printf(\" Shredder: %v\\n\", bbutil.ShredInfo())\n\tfmt.Printf(\" Admins: count=%v\\n\", len(bx.Admins))\n\tfmt.Printf(\" Files: count=%v\\n\", len(bx.Files))\n\tfmt.Printf(\" FilesSet: count=%v\\n\", len(bx.FilesSet))\n\tfmt.Printf(\" Vcs: %v\\n\", bx.Vcs)\n\tfmt.Printf(\" VcsName: %q\\n\", bx.Vcs.Name())\n\tfmt.Printf(\" Crypter: %v\\n\", bx.Crypter)\n\tfmt.Printf(\" CrypterName: %q\\n\", bx.Crypter.Name())\n\n\treturn nil\n}\n\n// Init initializes a repo.\nfunc (bx *Box) Init(yes, vcsname string) error {\n\tfmt.Printf(\"VCS root is: %q\\n\", bx.RepoBaseDir)\n\n\tfmt.Printf(\"team is: %q\\n\", bx.Team)\n\tfmt.Printf(\"configdir will be: %q\\n\", bx.ConfigPath)\n\n\tif yes != \"yes\" {\n\t\tfmt.Printf(\"Enable blackbox for this %v repo? (yes/no)? \", bx.Vcs.Name())\n\t\tinput := bufio.NewScanner(os.Stdin)\n\t\tinput.Scan()\n\t\tans := input.Text()\n\t\tb, err := strconv.ParseBool(ans)\n\t\tif err != nil {\n\t\t\tb = false\n\t\t\tif len(ans) > 0 {\n\t\t\t\tif ans[0] == 'y' || ans[0] == 'Y' {\n\t\t\t\t\tb = true\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif !b {\n\t\t\tfmt.Println(\"Ok. Maybe some other time.\")\n\t\t\treturn nil\n\t\t}\n\t}\n\n\terr := os.Mkdir(bx.ConfigPath, 0o750)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tba := filepath.Join(bx.ConfigPath, \"blackbox-admins.txt\")\n\tbf := filepath.Join(bx.ConfigPath, \"blackbox-files.txt\")\n\tbbutil.Touch(ba)\n\tbbutil.Touch(bf)\n\tbx.Vcs.SetFileTypeUnix(bx.RepoBaseDir, ba, bf)\n\n\tbx.Vcs.IgnoreAnywhere(bx.RepoBaseDir, []string{\n\t\t\"pubring.gpg~\",\n\t\t\"pubring.kbx~\",\n\t\t\"secring.gpg\",\n\t})\n\n\tfs := []string{ba, bf}\n\tbx.Vcs.NeedsCommit(\n\t\t\"NEW: \"+strings.Join(makesafe.RedactMany(fs), \" \"),\n\t\tbx.RepoBaseDir,\n\t\tfs,\n\t)\n\n\tbx.Vcs.CommitTitle(\"INITIALIZE BLACKBOX\")\n\treturn nil\n}\n\n// Reencrypt decrypts and reencrypts files.\nfunc (bx *Box) Reencrypt(names []string, overwrite bool, bulkpause bool) error {\n\n\tallFiles := false\n\n\tif err := anyGpg(names); err != nil {\n\t\treturn err\n\t}\n\tif err := bx.getAdmins(); err != nil {\n\t\treturn err\n\t}\n\tif err := bx.getFiles(); err != nil {\n\t\treturn err\n\t}\n\tif len(names) == 0 {\n\t\tnames = bx.Files\n\t\tallFiles = true\n\t}\n\n\tif bulkpause {\n\t\tgpgAgentNotice()\n\t}\n\n\tfmt.Println(\"========== blackbox administrators are:\")\n\tbx.AdminList()\n\tfmt.Println(\"========== (the above people will be able to access the file)\")\n\n\tif overwrite {\n\t\tbbutil.ShredFiles(names)\n\t} else {\n\t\twarned := false\n\t\tfor _, n := range names {\n\t\t\tif bbutil.FileExistsOrProblem(n) {\n\t\t\t\tif !warned {\n\t\t\t\t\tfmt.Printf(\"========== Shred these files?\\n\")\n\t\t\t\t\twarned = true\n\t\t\t\t}\n\t\t\t\tfmt.Println(\"SHRED?\", n)\n\t\t\t}\n\t\t}\n\t\tif warned {\n\t\t\tshouldWeOverwrite()\n\t\t}\n\t}\n\n\t// Decrypt\n\tif err := decryptMany(bx, names, overwrite, false, 0); err != nil {\n\t\treturn fmt.Errorf(\"reencrypt failed decrypt: %w\", err)\n\t}\n\tenames, err := encryptMany(bx, names, false)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"reencrypt failed encrypt: %w\", err)\n\t}\n\tif err := bbutil.ShredFiles(names); err != nil {\n\t\treturn fmt.Errorf(\"reencrypt failed shred: %w\", err)\n\t}\n\n\tif allFiles {\n\t\t// If the \"--all\" flag was used, don't try to list all the files.\n\t\tbx.Vcs.NeedsCommit(\n\t\t\t\"REENCRYPT all files\",\n\t\t\tbx.RepoBaseDir,\n\t\t\tenames,\n\t\t)\n\t} else {\n\t\tbx.Vcs.NeedsCommit(\n\t\t\tPrettyCommitMessage(\"REENCRYPT\", names),\n\t\t\tbx.RepoBaseDir,\n\t\t\tenames,\n\t\t)\n\n\t}\n\n\treturn nil\n}\n\n// Shred shreds files.\nfunc (bx *Box) Shred(names []string) error {\n\n\tif err := anyGpg(names); err != nil {\n\t\treturn err\n\t}\n\n\terr := bx.getFiles()\n\t// Calling getFiles() has the benefit of making sure we are in a repo.\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif len(names) == 0 {\n\t\tnames = bx.Files\n\t}\n\n\treturn bbutil.ShredFiles(names)\n}\n\n// Status prints the status of files.\nfunc (bx *Box) Status(names []string, nameOnly bool, match string) error {\n\n\terr := bx.getFiles()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar flist []string\n\tif len(names) == 0 {\n\t\tflist = bx.Files\n\t} else {\n\t\tflist = names\n\t}\n\n\tvar data [][]string\n\tvar onlylist []string\n\tthirdColumn := false\n\tvar tcData bool\n\n\tfor _, name := range flist {\n\t\tvar stat string\n\t\tvar err error\n\t\tif _, ok := bx.FilesSet[name]; ok {\n\t\t\tstat, err = FileStatus(name)\n\t\t} else {\n\t\t\tstat, err = \"NOTREG\", nil\n\t\t}\n\t\tif (match == \"\") || (stat == match) {\n\t\t\tif err == nil {\n\t\t\t\tdata = append(data, []string{stat, name})\n\t\t\t\tonlylist = append(onlylist, name)\n\t\t\t} else {\n\t\t\t\tthirdColumn = tcData\n\t\t\t\tdata = append(data, []string{stat, name, fmt.Sprintf(\"%v\", err)})\n\t\t\t\tonlylist = append(onlylist, fmt.Sprintf(\"%v: %v\", name, err))\n\t\t\t}\n\t\t}\n\t}\n\n\tif nameOnly {\n\t\tfmt.Println(strings.Join(onlylist, \"\\n\"))\n\t\treturn nil\n\t}\n\n\ttable := tablewriter.NewWriter(os.Stdout)\n\ttable.SetAutoWrapText(false)\n\tif thirdColumn {\n\t\ttable.SetHeader([]string{\"Status\", \"Name\", \"Error\"})\n\t} else {\n\t\ttable.SetHeader([]string{\"Status\", \"Name\"})\n\t}\n\tfor _, v := range data {\n\t\ttable.Append(v)\n\t}\n\ttable.Render() // Send output\n\n\treturn nil\n}\n\n// TestingInitRepo initializes a repo.\n// Uses bx.Vcs to create \".git\" or whatever.\n// Uses bx.Vcs to discover what was created, testing its work.\nfunc (bx *Box) TestingInitRepo() error {\n\n\tif bx.Vcs == nil {\n\t\tfmt.Println(\"bx.Vcs is nil\")\n\t\tfmt.Printf(\"BLACKBOX_VCS=%q\\n\", os.Getenv(\"BLACKBOX_VCS\"))\n\t\tos.Exit(1)\n\t}\n\tfmt.Printf(\"ABOUT TO CALL TestingInitRepo\\n\")\n\tfmt.Printf(\"vcs = %v\\n\", bx.Vcs.Name())\n\terr := bx.Vcs.TestingInitRepo()\n\tfmt.Printf(\"RETURNED from TestingInitRepo: %v\\n\", err)\n\tfmt.Println(os.Getwd())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"TestingInitRepo returned: %w\", err)\n\t}\n\tif b, _ := bx.Vcs.Discover(); !b {\n\t\treturn fmt.Errorf(\"TestingInitRepo failed Discovery\")\n\t}\n\treturn nil\n}\n" }, { "path": "pkg/commitlater/commitlater.go", "content": "package commitlater\n\nimport (\n\t\"fmt\"\n)\n\ntype future struct {\n\tmessage string // Message that describes this transaction.\n\tdir string // Basedir of the files\n\tfiles []string // Names of the files\n\tdisplay []string // Names as to be displayed to the user\n}\n\n// List of futures to be done in the future.\ntype List struct {\n\titems []*future\n}\n\n// Add queues up a future commit.\nfunc (list *List) Add(message string, repobasedir string, files []string) {\n\titem := &future{\n\t\tmessage: message,\n\t\tdir: repobasedir,\n\t\tfiles: files,\n\t}\n\tlist.items = append(list.items, item)\n}\n\nfunc sameDirs(l *List) bool {\n\tif len(l.items) <= 1 {\n\t\treturn true\n\t}\n\tfor _, k := range l.items[1:] {\n\t\tif k.dir != l.items[0].dir {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true\n}\n\n// Flush executes queued commits.\nfunc (list *List) Flush(\n\ttitle string,\n\tfadd func([]string) error,\n\tfcommit func([]string, string, []string) error,\n) error {\n\n\t// Just list the individual commit commands.\n\tif title == \"\" || len(list.items) < 2 || !sameDirs(list) {\n\t\tfor _, fut := range list.items {\n\t\t\terr := fadd(fut.files)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"add files1 (%q) failed: %w\", fut.files, err)\n\t\t\t}\n\t\t\terr = fcommit([]string{fut.message}, fut.dir, fut.files)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"commit files (%q) failed: %w\", fut.files, err)\n\t\t\t}\n\t\t}\n\t\treturn nil\n\t}\n\n\t// Create a long commit message.\n\tvar m []string\n\tvar f []string\n\tfor _, fut := range list.items {\n\t\terr := fadd(fut.files)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"add files2 (%q) failed: %w\", fut.files, err)\n\t\t}\n\t\tm = append(m, fut.message)\n\t\tf = append(f, fut.files...)\n\t}\n\tmsg := []string{title}\n\tfor _, mm := range m {\n\t\tmsg = append(msg, \" * \"+mm)\n\t}\n\terr := fcommit(msg, list.items[0].dir, f)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"commit files (%q) failed: %w\", f, err)\n\t}\n\n\treturn nil\n}\n" }, { "path": "pkg/crypters/_all/all.go", "content": "package all\n\nimport (\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/crypters/gnupg\"\n)\n" }, { "path": "pkg/crypters/crypters.go", "content": "package crypters\n\nimport (\n\t\"sort\"\n\t\"strings\"\n\n\t\"github.com/StackExchange/blackbox/v2/models\"\n)\n\n// Crypter is the handle\ntype Crypter interface {\n\tmodels.Crypter\n}\n\n// NewFnSig function signature needed by reg.\ntype NewFnSig func(debug bool) (Crypter, error)\n\n// Item stores one item\ntype Item struct {\n\tName string\n\tNew NewFnSig\n\tPriority int\n}\n\n// Catalog is the list of registered vcs's.\nvar Catalog []*Item\n\n// SearchByName returns a Crypter handle for name.\n// The search is case insensitive.\nfunc SearchByName(name string, debug bool) Crypter {\n\tname = strings.ToLower(name)\n\tfor _, v := range Catalog {\n\t\t//fmt.Printf(\"Trying %v %v\\n\", v.Name)\n\t\tif strings.ToLower(v.Name) == name {\n\t\t\tchandle, err := v.New(debug)\n\t\t\tif err != nil {\n\t\t\t\treturn nil // No idea how that would happen.\n\t\t\t}\n\t\t\t//fmt.Printf(\"USING! %v\\n\", v.Name)\n\t\t\treturn chandle\n\t\t}\n\t}\n\treturn nil\n}\n\n// Register a new VCS.\nfunc Register(name string, priority int, newfn NewFnSig) {\n\t//fmt.Printf(\"CRYPTER registered: %v\\n\", name)\n\titem := &Item{\n\t\tName: name,\n\t\tNew: newfn,\n\t\tPriority: priority,\n\t}\n\tCatalog = append(Catalog, item)\n\n\t// Keep the list sorted.\n\tsort.Slice(Catalog, func(i, j int) bool { return Catalog[j].Priority < Catalog[i].Priority })\n}\n" }, { "path": "pkg/crypters/gnupg/gnupg.go", "content": "package gnupg\n\nimport (\n\t\"fmt\"\n\t\"io/ioutil\"\n\t\"log\"\n\t\"os\"\n\t\"os/exec\"\n\t\"path/filepath\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/bblog\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/bbutil\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/crypters\"\n)\n\nvar pluginName = \"GnuPG\"\n\nfunc init() {\n\tcrypters.Register(pluginName, 100, registerNew)\n}\n\n// CrypterHandle is the handle\ntype CrypterHandle struct {\n\tGPGCmd string // \"gpg2\" or \"gpg\"\n\tlogErr *log.Logger\n\tlogDebug *log.Logger\n}\n\nfunc registerNew(debug bool) (crypters.Crypter, error) {\n\n\tcrypt := &CrypterHandle{\n\t\tlogErr: bblog.GetErr(),\n\t\tlogDebug: bblog.GetDebug(debug),\n\t}\n\n\t// Which binary to use?\n\tpath, err := exec.LookPath(\"gpg2\")\n\tif err != nil {\n\t\tpath, err = exec.LookPath(\"gpg\")\n\t\tif err != nil {\n\t\t\tpath = \"gpg2\"\n\t\t}\n\t}\n\tcrypt.GPGCmd = path\n\n\treturn crypt, nil\n}\n\n// Name returns my name.\nfunc (crypt CrypterHandle) Name() string {\n\treturn pluginName\n}\n\n// Decrypt name+\".gpg\", possibly overwriting name.\nfunc (crypt CrypterHandle) Decrypt(filename string, umask int, overwrite bool) error {\n\n\ta := []string{\n\t\t\"--use-agent\",\n\t\t\"-q\",\n\t\t\"--decrypt\",\n\t\t\"-o\", filename,\n\t}\n\tif overwrite {\n\t\ta = append(a, \"--yes\")\n\t}\n\ta = append(a, filename+\".gpg\")\n\n\toldumask := bbutil.Umask(umask)\n\terr := bbutil.RunBash(crypt.GPGCmd, a...)\n\tbbutil.Umask(oldumask)\n\treturn err\n}\n\n// Cat returns the plaintext or, if it is missing, the decrypted cyphertext.\nfunc (crypt CrypterHandle) Cat(filename string) ([]byte, error) {\n\n\ta := []string{\n\t\t\"--use-agent\",\n\t\t\"-q\",\n\t\t\"--decrypt\",\n\t}\n\n\t// TODO(tlim): This assumes the entire gpg file fits in memory. If\n\t// this becomes a problem, re-implement this using exec Cmd.StdinPipe()\n\t// and feed the input in chunks.\n\tin, err := ioutil.ReadFile(filename + \".gpg\")\n\tif err != nil {\n\n\t\tif os.IsNotExist(err) {\n\t\t\t// Encrypted file doesn't exit? Return the plaintext.\n\t\t\treturn ioutil.ReadFile(filename)\n\t\t}\n\n\t\treturn nil, err\n\t}\n\n\treturn bbutil.RunBashInputOutput(in, crypt.GPGCmd, a...)\n}\n\n// Encrypt name, overwriting name+\".gpg\"\nfunc (crypt CrypterHandle) Encrypt(filename string, umask int, receivers []string) (string, error) {\n\tvar err error\n\n\tcrypt.logDebug.Printf(\"Encrypt(%q, %d, %q)\", filename, umask, receivers)\n\tencrypted := filename + \".gpg\"\n\ta := []string{\n\t\t\"--use-agent\",\n\t\t\"--yes\",\n\t\t\"--encrypt\",\n\t\t\"-o\", encrypted,\n\t}\n\tfor _, f := range receivers {\n\t\ta = append(a, \"-r\", f)\n\t}\n\ta = append(a, \"--encrypt\")\n\ta = append(a, filename)\n\t//err = bbutil.RunBash(\"ls\", \"-la\")\n\n\toldumask := bbutil.Umask(umask)\n\tcrypt.logDebug.Printf(\"Args = %q\", a)\n\terr = bbutil.RunBash(crypt.GPGCmd, a...)\n\tbbutil.Umask(oldumask)\n\n\treturn encrypted, err\n}\n\n// AddNewKey extracts keyname from sourcedir's GnuPG chain to destdir keychain.\n// It returns a list of files that may have changed.\nfunc (crypt CrypterHandle) AddNewKey(keyname, repobasedir, sourcedir, destdir string) ([]string, error) {\n\n\t// $GPG --homedir=\"$2\" --export -a \"$KEYNAME\" >\"$pubkeyfile\"\n\targs := []string{\n\t\t\"--export\",\n\t\t\"-a\",\n\t}\n\tif sourcedir != \"\" {\n\t\targs = append(args, \"--homedir\", sourcedir)\n\t}\n\targs = append(args, keyname)\n\tcrypt.logDebug.Printf(\"ADDNEWKEY: Extracting key=%v: gpg, %v\\n\", keyname, args)\n\tpubkey, err := bbutil.RunBashOutput(\"gpg\", args...)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(pubkey) == 0 {\n\t\treturn nil, fmt.Errorf(\"Nothing found when %q exported from %q\", keyname, sourcedir)\n\t}\n\n\t// $GPG --no-permission-warning --homedir=\"$KEYRINGDIR\" --import \"$pubkeyfile\"\n\targs = []string{\n\t\t\"--no-permission-warning\",\n\t\t\"--homedir\", destdir,\n\t\t\"--import\",\n\t}\n\tcrypt.logDebug.Printf(\"ADDNEWKEY: Importing: gpg %v\\n\", args)\n\t// fmt.Printf(\"DEBUG: crypter ADD %q\", args)\n\terr = bbutil.RunBashInput(pubkey, \"gpg\", args...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"AddNewKey failed: %w\", err)\n\t}\n\n\t// Suggest: ${pubring_path} trustdb.gpg blackbox-admins.txt\n\tvar changed []string\n\n\t// Prefix each file with the relative path to it.\n\tprefix, err := filepath.Rel(repobasedir, destdir)\n\tif err != nil {\n\t\t//fmt.Printf(\"FAIL (%v) (%v) (%v)\\n\", repobasedir, destdir, err)\n\t\tprefix = destdir\n\t}\n\tfor _, file := range []string{\"pubring.gpg\", \"pubring.kbx\", \"trustdb.gpg\"} {\n\t\tpath := filepath.Join(destdir, file)\n\t\tif bbutil.FileExistsOrProblem(path) {\n\t\t\tchanged = append(changed, filepath.Join(prefix, file))\n\t\t}\n\t}\n\treturn changed, nil\n}\n" }, { "path": "pkg/crypters/gnupg/keychain.go", "content": "package gnupg\n\n/*\n\n# How does Blackbox manage key rings?\n\nBlackbox uses the user's .gnupg directory for most actions, such as decrypting data.\nDecrypting requires the user's private key, which is stored by the user in their\nhome directory (and up to them to store safely).\nBlack box does not store the user's private key in the repo.\n\nWhen encrypting data, black needs the public key of all the admins, not just the users.\nTo assure that the user's `.gnupg` has all these public keys, prior to\nencrypting data the public keys are imported from .blackbox, which stores\na keychain that stores the public (not private!) keys of all the admins.\n\nFYI: v1 does this import before decrypting, because I didn't know any better.\n\n# Binary compatibility:\n\nWhen writing v1, we didn't realize that the pubkey.gpg file is a binary format\nthat is not intended to be portable. In fact, it is intentionally not portable.\nThis means that all admins must use the exact same version of GnuPG\nor the files (pubring.gpg or pubring.kbx) may get corrupted.\n\nIn v2, we store the public keys in the portable ascii format\nin a file called `.blackbox/public-keys-db.asc`.\nIt will also update the binary files if they exist.\nIf `.blackbox/public-keys-db.asc` doesn't exist, it will be created.\n\nEventually we will stop updating the binary files.\n\n# Importing public keys to the user\n\nHow to import the public keys to the user's GPG system:\n\nIf pubkeyring-ascii.txt exists:\n\tgpg --import pubkeyring-ascii.asc\nElse if pubring.kbx\n\tgpg --import pubring.kbx\nElse if pubring.gpg\n\tgpg --import pubring.gpg\n\nThis is what v1 does:\n #if gpg2 is installed next to gpg like on ubuntu 16\n if [[ \"$GPG\" != \"gpg2\" ]]; then\n $GPG --export --no-default-keyring --keyring \"$(get_pubring_path)\" >\"$keyringasc\"\n $GPG --import \"$keyringasc\" 2>&1 | egrep -v 'not changed$' >&2\n Else\n $GPG --keyring \"$(get_pubring_path)\" --export | $GPG --import\n fi\n\n# How to add a key to the keyring?\n\nOld, binary format:\n # Get the key they want to add:\n FOO is a user-specified directory, otherwise $HOME/.gnupg:\n\t $GPG --homedir=\"FOO\" --export -a \"$KEYNAME\" >TEMPFILE\n\t# Import into the binary files:\n\t KEYRINGDIR is .blackbox\n $GPG --no-permission-warning --homedir=\"$KEYRINGDIR\" --import TEMPFILE\n\t# Git add any of these files if they exist:\n\t pubring.gpg pubring.kbx trustdb.gpg blackbox-admins.txt\n\t# Tell the user to git commit them.\n\nNew, ascii format:\n\t# Get the key to be added. Write to a TEMPFILE\n FOO is a user-specified directory, otherwise $HOME/.gnupg:\n\t $GPG --homedir=\"FOO\" --export -a \"$KEYNAME\" >TEMPFILE\n\t# Make a tempdir called TEMPDIR\n\t# Import the pubkeyring-ascii.txt to TEMPDIR's keyring. (Skip if file not found)\n\t# Import the temp1 data to TEMPDIR\n\t# Export the TEMPDIR to create a new .blackbox/pubkeyring-ascii.txt\n\t PATH_TO_BINARY is the path to .blackbox/pubring.gpg; if that's not found then pubring.kbx\n $GPG --keyring PATH_TO_BINARY --export -a --output .blackbox/pubkeyring-ascii.txt\n\t# Git add .blackbox/pubkeyring-ascii.txt and .blackbox/blackbox-admins.txt\n\t# Tell the user to git commit them.\n\t# Delete TEMPDIR\n\n# How to remove a key from the keyring?\n\nOld, binary format:\n # Remove key from the binary file\n $GPG --no-permission-warning --homedir=\"$KEYRINGDIR\" --batch --yes --delete-key \"$KEYNAME\" || true\n\t# Git add any of these files if they exist:\n\t pubring.gpg pubring.kbx trustdb.gpg blackbox-admins.txt\n\t# Tell the user to git commit them.\n\nNew, ascii format:\n\t# Make a tempdir called TEMPDIR\n\t# Import the pubkeyring-ascii.txt to TEMPDIR's keyring. (Skip if file not found)\n # Remove key from the ring file\n $GPG --no-permission-warning --homedir=\"$KEYRINGDIR\" --batch --yes --delete-key \"$KEYNAME\" || true\n\t# Export the TEMPDIR to create a new .blackbox/pubkeyring-ascii.txt\n\t PATH_TO_BINARY is the path to .blackbox/pubring.gpg; if that's not found then pubring.kbx\n $GPG --keyring PATH_TO_BINARY --export -a --output .blackbox/pubkeyring-ascii.txt\n\t# Git add .blackbox/pubkeyring-ascii.txt and .blackbox/blackbox-admins.txt\n\t# Update the .blackbox copy of pubring.gpg, pubring.kbx, or trustdb.gpg (if they exist)\n\t# with copies from TEMPDIR (if they exist). Git add any files that are updated.\n\t# Tell the user to git commit them.\n\t# Delete TEMPDIR\n\n*/\n\n//func prepareUserKeychain() error {\n//\treturn nil\n//}\n" }, { "path": "pkg/makesafe/makesafe.go", "content": "package makesafe\n\n// untaint -- A string with a Stringer that is shell safe.\n\n// This goes to great lengths to make sure the String() is pastable.\n// Whitespace and shell \"special chars\" are handled as expected.\n\n// However to be extra paranoid, unicode is turned into backtick\n// printf statements. I don't know anyone that puts unicode in their\n// filenames, but I hope they appreciate this.\n\n// Most people would just use strconv.QuoteToGraphic() but I'm a\n// control freak.\n\nimport (\n\t\"fmt\"\n\t\"strings\"\n\t\"unicode\"\n)\n\ntype protection int\n\nconst (\n\t// Unknown indicates we don't know if it is safe.\n\tUnknown protection = iota\n\t// None requires no special escaping.\n\tNone // Nothing special\n\t// SingleQuote is unsafe in bash and requires a single quote.\n\tSingleQuote // Requires at least a single quote\n\t// DoubleQuote is unsafe in bash and requires escaping or other double-quote features.\n\tDoubleQuote // Can only be in a double-quoted string\n)\n\nconst (\n\t// IsAQuote is either a `'` or `\"`\n\tIsAQuote = None\n\t// IsSpace is ascii 32\n\tIsSpace = SingleQuote\n\t// ShellUnsafe is ()!$ or other bash special char\n\tShellUnsafe = SingleQuote\n\t// GlobUnsafe means could be a glob char (* or ?)\n\tGlobUnsafe = SingleQuote\n\t// InterpolationUnsafe used in bash string interpolation ($)\n\tInterpolationUnsafe = SingleQuote\n\t// HasBackslash things like \\n \\t \\r \\000 \\xFF\n\tHasBackslash = DoubleQuote\n)\n\nfunc max(i, j protection) protection {\n\tif i > j {\n\t\treturn i\n\t}\n\treturn j\n\n}\n\ntype tabEntry struct {\n\tlevel protection\n\tfn func(s rune) string\n}\n\nvar tab [128]tabEntry\n\nfunc init() {\n\n\tfor i := 0; i <= 31; i++ { // Control chars\n\t\ttab[i] = tabEntry{HasBackslash, oct()}\n\t}\n\ttab['\\t'] = tabEntry{HasBackslash, literal(`\\t`)} // Override\n\ttab['\\n'] = tabEntry{HasBackslash, literal(`\\n`)} // Override\n\ttab['\\r'] = tabEntry{HasBackslash, literal(`\\r`)} // Override\n\ttab[' '] = tabEntry{IsSpace, same()}\n\ttab['!'] = tabEntry{ShellUnsafe, same()}\n\ttab['\"'] = tabEntry{IsAQuote, same()}\n\ttab['#'] = tabEntry{ShellUnsafe, same()}\n\ttab['@'] = tabEntry{InterpolationUnsafe, same()}\n\ttab['$'] = tabEntry{InterpolationUnsafe, same()}\n\ttab['%'] = tabEntry{InterpolationUnsafe, same()}\n\ttab['&'] = tabEntry{ShellUnsafe, same()}\n\ttab['\\''] = tabEntry{IsAQuote, same()}\n\ttab['('] = tabEntry{ShellUnsafe, same()}\n\ttab[')'] = tabEntry{ShellUnsafe, same()}\n\ttab['*'] = tabEntry{GlobUnsafe, same()}\n\ttab['+'] = tabEntry{GlobUnsafe, same()}\n\ttab[','] = tabEntry{None, same()}\n\ttab['-'] = tabEntry{None, same()}\n\ttab['.'] = tabEntry{None, same()}\n\ttab['/'] = tabEntry{None, same()}\n\tfor i := '0'; i <= '9'; i++ {\n\t\ttab[i] = tabEntry{None, same()}\n\t}\n\ttab[':'] = tabEntry{InterpolationUnsafe, same()} // ${foo:=default}\n\ttab[';'] = tabEntry{ShellUnsafe, same()}\n\ttab['<'] = tabEntry{ShellUnsafe, same()}\n\ttab['='] = tabEntry{InterpolationUnsafe, same()} // ${foo:=default}\n\ttab['>'] = tabEntry{ShellUnsafe, same()}\n\ttab['?'] = tabEntry{GlobUnsafe, same()}\n\ttab['@'] = tabEntry{InterpolationUnsafe, same()} // ${myarray[@]};\n\tfor i := 'A'; i <= 'Z'; i++ {\n\t\ttab[i] = tabEntry{None, same()}\n\t}\n\ttab['['] = tabEntry{ShellUnsafe, same()}\n\ttab['\\\\'] = tabEntry{ShellUnsafe, same()}\n\ttab[']'] = tabEntry{GlobUnsafe, same()}\n\ttab['^'] = tabEntry{GlobUnsafe, same()}\n\ttab['_'] = tabEntry{None, same()}\n\ttab['`'] = tabEntry{ShellUnsafe, same()}\n\tfor i := 'a'; i <= 'z'; i++ {\n\t\ttab[i] = tabEntry{None, same()}\n\t}\n\ttab['{'] = tabEntry{ShellUnsafe, same()}\n\ttab['|'] = tabEntry{ShellUnsafe, same()}\n\ttab['}'] = tabEntry{ShellUnsafe, same()}\n\ttab['~'] = tabEntry{ShellUnsafe, same()}\n\ttab[127] = tabEntry{HasBackslash, oct()}\n\n\t// Check our work. All indexes should have been set.\n\tfor i, e := range tab {\n\t\tif e.level == 0 || e.fn == nil {\n\t\t\tpanic(fmt.Sprintf(\"tabEntry %d not set!\", i))\n\t\t}\n\t}\n\n}\n\n// literal return this exact string.\nfunc literal(s string) func(s rune) string {\n\treturn func(rune) string { return s }\n}\n\n// same converts the rune to a string.\nfunc same() func(r rune) string {\n\treturn func(r rune) string { return string(r) }\n}\n\n// oct returns the octal representing the value.\nfunc oct() func(r rune) string {\n\treturn func(r rune) string { return fmt.Sprintf(`\\%03o`, r) }\n}\n\n// Redact returns a string that can be used in a shell single-quoted\n// string. It may not be an exact representation, but it is safe\n// to include on a command line.\n//\n// Redacted chars are changed to \"X\".\n// If anything is redacted, the string is surrounded by double quotes\n// (\"air quotes\") and the string \"(redacted)\" is added to the end.\n// If nothing is redacted, but it contains spaces, it is surrounded\n// by double quotes.\n//\n// Example: `s` -> `s`\n// Example: `space cadet.txt` -> `\"space cadet.txt\"`\n// Example: `drink a \\t soda` -> `\"drink a X soda\"(redacted)`\n// Example: `smile☺` -> `\"smile☺`\nfunc Redact(tainted string) string {\n\n\tif tainted == \"\" {\n\t\treturn `\"\"`\n\t}\n\n\tvar b strings.Builder\n\tb.Grow(len(tainted) + 10)\n\n\tredacted := false\n\tneedsQuote := false\n\n\tfor _, r := range tainted {\n\t\tif r == ' ' {\n\t\t\tb.WriteRune(r)\n\t\t\tneedsQuote = true\n\t\t} else if r == '\\'' {\n\t\t\tb.WriteRune('X')\n\t\t\tredacted = true\n\t\t} else if r == '\"' {\n\t\t\tb.WriteRune('\\\\')\n\t\t\tb.WriteRune(r)\n\t\t\tneedsQuote = true\n\t\t} else if unicode.IsPrint(r) {\n\t\t\tb.WriteRune(r)\n\t\t} else {\n\t\t\tb.WriteRune('X')\n\t\t\tredacted = true\n\t\t}\n\t}\n\n\tif redacted {\n\t\treturn `\"` + b.String() + `\"(redacted)`\n\t}\n\tif needsQuote {\n\t\treturn `\"` + b.String() + `\"`\n\t}\n\treturn tainted\n}\n\n// RedactMany returns the list after processing each element with Redact().\nfunc RedactMany(items []string) []string {\n\tvar r []string\n\tfor _, n := range items {\n\t\tr = append(r, Redact(n))\n\t}\n\treturn r\n}\n\n// Shell returns the string formatted so that it is safe to be pasted\n// into a command line to produce the desired filename as an argument\n// to the command.\nfunc Shell(tainted string) string {\n\tif tainted == \"\" {\n\t\treturn `\"\"`\n\t}\n\n\tvar b strings.Builder\n\tb.Grow(len(tainted) + 10)\n\n\tlevel := Unknown\n\tfor _, r := range tainted {\n\t\tif r < 128 {\n\t\t\tlevel = max(level, tab[r].level)\n\t\t\tb.WriteString(tab[r].fn(r))\n\t\t} else {\n\t\t\tlevel = max(level, DoubleQuote)\n\t\t\tb.WriteString(escapeRune(r))\n\t\t}\n\t}\n\ts := b.String()\n\n\tif level == None {\n\t\treturn tainted\n\t} else if level == SingleQuote {\n\t\t// A single quoted string accepts all chars except the single\n\t\t// quote itself, which must be replaced with: '\"'\"'\n\t\treturn \"'\" + strings.Join(strings.Split(s, \"'\"), `'\"'\"'`) + \"'\"\n\t} else if level == DoubleQuote {\n\t\t// A double-quoted string may include \\xxx escapes and other\n\t\t// things. Sadly bash doesn't interpret those, but printf will!\n\t\treturn `$(printf '%q' '` + s + `')`\n\t}\n\t// should not happen\n\treturn fmt.Sprintf(\"%q\", s)\n}\n\n// escapeRune returns a string of octal escapes that represent the rune.\nfunc escapeRune(r rune) string {\n\tb := []byte(string(rune(r))) // Convert to the indivdual bytes, utf8-encoded.\n\t// fmt.Printf(\"rune: len=%d %s %v\\n\", len(s), s, []byte(s))\n\tswitch len(b) {\n\tcase 1:\n\t\treturn fmt.Sprintf(`\\%03o`, b[0])\n\tcase 2:\n\t\treturn fmt.Sprintf(`\\%03o\\%03o`, b[0], b[1])\n\tcase 3:\n\t\treturn fmt.Sprintf(`\\%03o\\%03o\\%03o`, b[0], b[1], b[2])\n\tcase 4:\n\t\treturn fmt.Sprintf(`\\%03o\\%03o\\%03o\\%03o`, b[0], b[1], b[2], b[3])\n\tdefault:\n\t\treturn string(rune(r))\n\t}\n}\n\n// ShellMany returns the list after processing each element with Shell().\nfunc ShellMany(items []string) []string {\n\tvar r []string\n\tfor _, n := range items {\n\t\tr = append(r, Redact(n))\n\t}\n\treturn r\n}\n\n// FirstFew returns the first few names. If any are truncated, it is\n// noted by appending \"...\". The exact definition of \"few\" may change\n// over time, and may be based on the number of chars not the list\nfunc FirstFew(sl []string) string {\n\ts, _ := FirstFewFlag(sl)\n\treturn s\n}\n\n// FirstFewFlag is like FirstFew but returns true if truncation done.\nfunc FirstFewFlag(sl []string) (string, bool) {\n\tconst maxitems = 2\n\tconst maxlen = 70\n\tif len(sl) < maxitems || len(strings.Join(sl, \" \")) < maxlen {\n\t\treturn strings.Join(sl, \" \"), false\n\t}\n\treturn strings.Join(sl[:maxitems], \" \") + \" (and others)\", true\n}\n" }, { "path": "pkg/makesafe/makesafe_test.go", "content": "package makesafe\n\nimport (\n\t\"testing\"\n)\n\nfunc TestRedact(t *testing.T) {\n\tfor i, test := range []struct{ data, expected string }{\n\t\t{\"\", `\"\"`},\n\t\t{\"one\", \"one\"},\n\t\t{\"has space.txt\", `\"has space.txt\"`},\n\t\t{\"has\\ttab.txt\", `\"hasXtab.txt\"(redacted)`},\n\t\t{\"has\\nnl.txt\", `\"hasXnl.txt\"(redacted)`},\n\t\t{\"has\\rret.txt\", `\"hasXret.txt\"(redacted)`},\n\t\t{\"¡que!\", `¡que!`},\n\t\t{\"thé\", `thé`},\n\t\t{\"pound£\", `pound£`},\n\t\t{\"*.go\", `*.go`},\n\t\t{\"rm -rf / ; echo done\", `\"rm -rf / ; echo done\"`},\n\t\t{\"smile\\u263a\", `smile☺`},\n\t\t{\"dub\\U0001D4E6\", `dub𝓦`},\n\t\t{\"four\\U0010FFFF\", `\"fourX\"(redacted)`},\n\t} {\n\t\tg := Redact(test.data)\n\t\tif g == test.expected {\n\t\t\tt.Logf(\"%03d: PASSED\", i)\n\t\t} else {\n\t\t\tt.Errorf(\"%03d: FAILED data=%q got=(%s) wanted=(%s)\", i, test.data, g, test.expected)\n\t\t}\n\t}\n}\n\nfunc TestRedactMany(t *testing.T) {\n\tdata := []string{\n\t\t\"\",\n\t\t\"one\",\n\t\t\"has space.txt\",\n\t\t\"has\\ttab.txt\",\n\t}\n\tg := RedactMany(data)\n\tif len(g) != 4 || g[0] != `\"\"` || g[1] != `\"has space.txt\"` || g[2] != `\"hasXtab.txt\"(redacted)` {\n\t\tt.Logf(\"PASSED\")\n\t} else {\n\t\tt.Errorf(\"FAILED got=(%q)\", g)\n\t}\n}\n\nfunc TestShell(t *testing.T) {\n\tfor i, test := range []struct{ data, expected string }{\n\t\t{\"\", `\"\"`},\n\t\t{\"one\", \"one\"},\n\t\t{\"two\\n\", `$(printf '%q' 'two\\n')`},\n\t\t{\"ta\ttab\", `$(printf '%q' 'ta\\ttab')`},\n\t\t{\"tab\\ttab\", `$(printf '%q' 'tab\\ttab')`},\n\t\t{\"new\\nline\", `$(printf '%q' 'new\\nline')`},\n\t\t{\"¡que!\", `$(printf '%q' '\\302\\241que!')`},\n\t\t{\"thé\", `$(printf '%q' 'th\\303\\251')`},\n\t\t{\"pound£\", `$(printf '%q' 'pound\\302\\243')`},\n\t\t{\"*.go\", `'*.go'`},\n\t\t{\"rm -rf / ; echo done\", `'rm -rf / ; echo done'`},\n\t\t{\"smile\\u263a\", `$(printf '%q' 'smile\\342\\230\\272')`},\n\t\t{\"dub\\U0001D4E6\", `$(printf '%q' 'dub\\360\\235\\223\\246')`},\n\t\t{\"four\\U0010FFFF\", `$(printf '%q' 'four\\364\\217\\277\\277')`},\n\t} {\n\t\tg := Shell(test.data)\n\t\tif g == test.expected {\n\t\t\tt.Logf(\"%03d: PASSED\", i)\n\t\t\t//t.Logf(\"%03d: PASSED go(%q) bash: %s\", i, test.data, test.expected)\n\t\t} else {\n\t\t\tt.Errorf(\"%03d: FAILED data=%q got=`%s` wanted=`%s`\", i, test.data, g, test.expected)\n\t\t}\n\t}\n}\n\nfunc TestEscapeRune(t *testing.T) {\n\tfor i, test := range []struct {\n\t\tdata rune\n\t\texpected string\n\t}{\n\t\t{'a', `\\141`},\n\t\t{'é', `\\303\\251`},\n\t\t{'☺', `\\342\\230\\272`},\n\t\t{'글', `\\352\\270\\200`},\n\t\t{'𩸽', `\\360\\251\\270\\275`},\n\t\t//{\"\\U0010FEDC\", `\"'\\U0010fedc'\"`},\n\t} {\n\t\tg := escapeRune(test.data)\n\t\tif g == test.expected {\n\t\t\tt.Logf(\"%03d: PASSED go=(%q) bash=(%s)\", i, test.data, test.expected)\n\t\t} else {\n\t\t\tt.Errorf(\"%03d: FAILED data=%q got=(%s) wanted=(%s)\", i, test.data, g, test.expected)\n\t\t}\n\t}\n}\n\nfunc TestShellMany(t *testing.T) {\n\tdata := []string{\n\t\t\"\",\n\t\t\"one\",\n\t\t\"has space.txt\",\n\t\t\"¡que!\",\n\t}\n\tg := ShellMany(data)\n\tif len(g) != 4 || g[0] != `\"\"` || g[1] != \"one\" || g[2] != `\"has space.txt\"` || g[3] != `$(printf '%q' '\\302\\241que!')` {\n\t\tt.Logf(\"PASSED\")\n\t} else {\n\t\tt.Errorf(\"FAILED got=(%q)\", g)\n\t}\n}\n\nfunc TestFirstFewFlag(t *testing.T) {\n\tfor i, test := range []struct {\n\t\tdata []string\n\t\texpectedFlag bool\n\t\texpectedString string\n\t}{\n\t\t{[]string{\"\", \"one\"}, false, ` one`},\n\t\t{[]string{\"one\"}, false, `one`},\n\t\t{[]string{\"one\", \"two\", \"three\", \"longlonglong\", \"longlonglonglong\", \"manylonglonglog\", \"morelongonglonglong\"}, true, ``},\n\t} {\n\t\tgs, gf := FirstFewFlag(test.data)\n\t\tif test.expectedFlag {\n\t\t\tif gf == test.expectedFlag {\n\t\t\t\tt.Logf(\"%03d: PASSED\", i)\n\t\t\t} else {\n\t\t\t\tt.Errorf(\"%03d: FAILED data=%q got=(%q) wanted=(%q)\", i, test.data, gs, test.expectedString)\n\t\t\t}\n\t\t} else {\n\t\t\tif gf == test.expectedFlag && gs == test.expectedString {\n\t\t\t\tt.Logf(\"%03d: PASSED\", i)\n\t\t\t} else {\n\t\t\t\tt.Errorf(\"%03d: FAILED data=%q got=(%q) wanted=(%q)\", i, test.data, gs, test.expectedString)\n\t\t\t}\n\t\t}\n\t}\n}\n" }, { "path": "pkg/vcs/_all/all.go", "content": "package all\n\nimport (\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/vcs/git\"\n\t_ \"github.com/StackExchange/blackbox/v2/pkg/vcs/none\"\n)\n" }, { "path": "pkg/vcs/git/git.go", "content": "package git\n\nimport (\n\t\"fmt\"\n\t\"path/filepath\"\n\t\"strings\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/bbutil\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/commitlater\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/makesafe\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/vcs\"\n)\n\nvar pluginName = \"GIT\"\n\nfunc init() {\n\tvcs.Register(pluginName, 100, newGit)\n}\n\n// VcsHandle is the handle\ntype VcsHandle struct {\n\tcommitTitle string\n\tcommitHeaderPrinted bool // Has the \"NEXT STEPS\" header been printed?\n\ttoCommit *commitlater.List // List of future commits\n}\n\nfunc newGit() (vcs.Vcs, error) {\n\tl := &commitlater.List{}\n\treturn &VcsHandle{toCommit: l}, nil\n}\n\n// Name returns my name.\nfunc (v VcsHandle) Name() string {\n\treturn pluginName\n}\n\nfunc ultimate(s string) int { return len(s) - 1 }\n\n// Discover returns true if we are a repo of this type; along with the Abs path to the repo root (or \"\" if we don't know).\nfunc (v VcsHandle) Discover() (bool, string) {\n\tout, err := bbutil.RunBashOutputSilent(\"git\", \"rev-parse\", \"--show-toplevel\")\n\tif err != nil {\n\t\treturn false, \"\"\n\t}\n\tif out == \"\" {\n\t\tfmt.Printf(\"WARNING: git rev-parse --show-toplevel has NO output??. Seems broken.\")\n\t\treturn false, \"\"\n\t}\n\tif out[ultimate(out)] == '\\n' {\n\t\tout = out[0:ultimate(out)]\n\t}\n\treturn err == nil, out\n}\n\n// SetFileTypeUnix informs the VCS that files should maintain unix-style line endings.\nfunc (v VcsHandle) SetFileTypeUnix(repobasedir string, files ...string) error {\n\tseen := make(map[string]bool)\n\n\t// Add to the .gitattributes in the same directory as the file.\n\tfor _, file := range files {\n\t\td, n := filepath.Split(file)\n\t\taf := filepath.Join(repobasedir, d, \".gitattributes\")\n\t\terr := bbutil.Touch(af)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\terr = bbutil.AddLinesToFile(af, fmt.Sprintf(\"%q text eol=lf\", n))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tseen[af] = true\n\t}\n\n\tvar changedfiles []string\n\tfor k := range seen {\n\t\tchangedfiles = append(changedfiles, k)\n\t}\n\n\tv.NeedsCommit(\n\t\t\"set gitattr=UNIX \"+strings.Join(makesafe.RedactMany(files), \" \"),\n\t\trepobasedir,\n\t\tchangedfiles,\n\t)\n\n\treturn nil\n}\n\n// IgnoreAnywhere tells the VCS to ignore these files anywhere rin the repo.\nfunc (v VcsHandle) IgnoreAnywhere(repobasedir string, files []string) error {\n\t// Add to the .gitignore file in the repobasedir.\n\tignore := filepath.Join(repobasedir, \".gitignore\")\n\terr := bbutil.Touch(ignore)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = bbutil.AddLinesToFile(ignore, files...)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tv.NeedsCommit(\n\t\t\"gitignore \"+strings.Join(makesafe.RedactMany(files), \" \"),\n\t\trepobasedir,\n\t\t[]string{\".gitignore\"},\n\t)\n\treturn nil\n}\n\nfunc gitSafeFilename(name string) string {\n\t// TODO(tlim): Add unit tests.\n\t// TODO(tlim): Confirm that *?[] escaping works.\n\tif name == \"\" {\n\t\treturn \"ERROR\"\n\t}\n\tvar b strings.Builder\n\tb.Grow(len(name) + 2)\n\tfor _, r := range name {\n\t\tif r == ' ' || r == '*' || r == '?' || r == '[' || r == ']' {\n\t\t\tb.WriteRune('\\\\')\n\t\t\tb.WriteRune(r)\n\t\t} else {\n\t\t\tb.WriteRune(r)\n\t\t}\n\t}\n\tif name[0] == '!' || name[0] == '#' {\n\t\treturn `\\` + b.String()\n\t}\n\treturn b.String()\n}\n\n// IgnoreFiles tells the VCS to ignore these files, specified relative to RepoBaseDir.\nfunc (v VcsHandle) IgnoreFiles(repobasedir string, files []string) error {\n\n\tvar lines []string\n\tfor _, f := range files {\n\t\tlines = append(lines, \"/\"+gitSafeFilename(f))\n\t}\n\n\t// Add to the .gitignore file in the repobasedir.\n\tignore := filepath.Join(repobasedir, \".gitignore\")\n\terr := bbutil.Touch(ignore)\n\tif err != nil {\n\t\treturn err\n\t}\n\terr = bbutil.AddLinesToFile(ignore, lines...)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tv.NeedsCommit(\n\t\t\"gitignore \"+strings.Join(makesafe.RedactMany(files), \" \"),\n\t\trepobasedir,\n\t\t[]string{\".gitignore\"},\n\t)\n\treturn nil\n}\n\n// Add makes a file visible to the VCS (like \"git add\").\nfunc (v VcsHandle) Add(repobasedir string, files []string) error {\n\n\tif len(files) == 0 {\n\t\treturn nil\n\t}\n\n\t// TODO(tlim): Make sure that files are within repobasedir.\n\n\tvar gpgnames []string\n\tfor _, n := range files {\n\t\tgpgnames = append(gpgnames, n+\".gpg\")\n\t}\n\treturn bbutil.RunBash(\"git\", append([]string{\"add\"}, gpgnames...)...)\n}\n\n// CommitTitle indicates what the next commit title will be.\n// This is used if a group of commits are merged into one.\nfunc (v *VcsHandle) CommitTitle(title string) {\n\tv.commitTitle = title\n}\n\n// NeedsCommit queues up commits for later execution.\nfunc (v *VcsHandle) NeedsCommit(message string, repobasedir string, names []string) {\n\tv.toCommit.Add(message, repobasedir, names)\n}\n\n// DebugCommits dumps the list of future commits.\nfunc (v VcsHandle) DebugCommits() commitlater.List {\n\treturn *v.toCommit\n}\n\n// FlushCommits informs the VCS to do queued up commits.\nfunc (v VcsHandle) FlushCommits() error {\n\treturn v.toCommit.Flush(\n\t\tv.commitTitle,\n\t\tfunc(files []string) error {\n\t\t\treturn bbutil.RunBash(\"git\", append([]string{\"add\"}, files...)...)\n\t\t},\n\t\tv.suggestCommit,\n\t)\n\t// TODO(tlim): Some day we can add a command line flag that indicates that commits are\n\t// to be done for real, not just suggested to the user. At that point, this function\n\t// can call v.toCommit.Flush() with a function that actually does the commits instead\n\t// of suggesting them. Flag could be called --commit=auto vs --commit=suggest.\n}\n\n// suggestCommit tells the user what commits are needed.\nfunc (v *VcsHandle) suggestCommit(messages []string, repobasedir string, files []string) error {\n\tif !v.commitHeaderPrinted {\n\t\tfmt.Printf(\"NEXT STEP: You need to manually check these in:\\n\")\n\t}\n\tv.commitHeaderPrinted = true\n\n\tfmt.Print(` git commit -m'`, strings.Join(messages, `' -m'`)+`'`)\n\tfmt.Print(\" \")\n\tfmt.Print(strings.Join(makesafe.ShellMany(files), \" \"))\n\tfmt.Println()\n\treturn nil\n}\n\n// The following are \"secret\" functions only used by the integration testing system.\n\n// TestingInitRepo initializes a repo.\nfunc (v VcsHandle) TestingInitRepo() error {\n\treturn bbutil.RunBash(\"git\", \"init\")\n\n}\n" }, { "path": "pkg/vcs/none/none.go", "content": "package none\n\nimport (\n\t\"fmt\"\n\n\t\"github.com/StackExchange/blackbox/v2/pkg/commitlater\"\n\t\"github.com/StackExchange/blackbox/v2/pkg/vcs\"\n)\n\nvar pluginName = \"NONE\"\n\nfunc init() {\n\tvcs.Register(pluginName, 0, newNone)\n}\n\n// VcsHandle is\ntype VcsHandle struct {\n\trepoRoot string\n}\n\nfunc newNone() (vcs.Vcs, error) {\n\treturn &VcsHandle{}, nil\n}\n\n// Name returns my name.\nfunc (v VcsHandle) Name() string {\n\treturn pluginName\n}\n\n// Discover returns true if we are a repo of this type; along with the Abs path to the repo root (or \"\" if we don't know).\nfunc (v VcsHandle) Discover() (bool, string) {\n\treturn true, \"\" // We don't know the root.\n}\n\n//// SetRepoRoot informs the Vcs of the VCS root.\n//func (v *VcsHandle) SetRepoRoot(dir string) {\n//\tv.repoRoot = dir\n//}\n\n// SetFileTypeUnix informs the VCS that files should maintain unix-style line endings.\nfunc (v VcsHandle) SetFileTypeUnix(repobasedir string, files ...string) error {\n\treturn nil\n}\n\n// IgnoreAnywhere tells the VCS to ignore these files anywhere in the repo.\nfunc (v VcsHandle) IgnoreAnywhere(repobasedir string, files []string) error {\n\treturn nil\n}\n\n// IgnoreFiles tells the VCS to ignore these files anywhere in the repo.\nfunc (v VcsHandle) IgnoreFiles(repobasedir string, files []string) error {\n\treturn nil\n}\n\n// CommitTitle sets the title of the next commit.\nfunc (v VcsHandle) CommitTitle(title string) {}\n\n// NeedsCommit queues up commits for later execution.\nfunc (v VcsHandle) NeedsCommit(message string, repobasedir string, names []string) {\n\treturn\n}\n\n// DebugCommits dumps a list of future commits.\nfunc (v VcsHandle) DebugCommits() commitlater.List {\n\treturn commitlater.List{}\n}\n\n// FlushCommits informs the VCS to do queued up commits.\nfunc (v VcsHandle) FlushCommits() error {\n\treturn nil\n}\n\n// The following are \"secret\" functions only used by the integration testing system.\n\n// TestingInitRepo initializes a repo.\nfunc (v VcsHandle) TestingInitRepo() error {\n\tfmt.Println(\"VCS=none, TestingInitRepo\")\n\treturn nil\n}\n" }, { "path": "pkg/vcs/vcs.go", "content": "package vcs\n\nimport (\n\t\"fmt\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"sort\"\n\t\"strings\"\n\n\t\"github.com/StackExchange/blackbox/v2/models\"\n)\n\n// Vcs is the handle\ntype Vcs interface {\n\tmodels.Vcs\n}\n\n// NewFnSig function signature needed by reg.\ntype NewFnSig func() (Vcs, error)\n\n// Item stores one item\ntype Item struct {\n\tName string\n\tNew NewFnSig\n\tPriority int\n}\n\n// Catalog is the list of registered vcs's.\nvar Catalog []*Item\n\n// Discover polls the VCS plug-ins to determine the VCS of directory.\n// The first to succeed is returned.\n// It never returns nil, since \"NONE\" is always valid.\nfunc Discover() (Vcs, string) {\n\tfor _, v := range Catalog {\n\t\th, err := v.New()\n\t\tif err != nil {\n\t\t\treturn nil, \"\" // No idea how that would happen.\n\t\t}\n\t\tif b, repodir := h.Discover(); b {\n\n\t\t\t// Try to find the rel path from CWD to RepoBase\n\t\t\twd, err := os.Getwd()\n\t\t\tif err != nil {\n\t\t\t\tfmt.Printf(\"ERROR: Can not determine cwd! Failing!\\n\")\n\t\t\t\tos.Exit(1)\n\t\t\t}\n\t\t\t//fmt.Printf(\"DISCCOVER: WD=%q REPO=%q\\n\", wd, repodir)\n\t\t\tif repodir != wd && strings.HasSuffix(repodir, wd) {\n\t\t\t\t// This is a terrible hack. We're basically guessing\n\t\t\t\t// at the filesystem layout. That said, it works on macOS.\n\t\t\t\t// TODO(tlim): Abstract this out into a separate function\n\t\t\t\t// so we can do integration tests on it (to know if it fails on\n\t\t\t\t// a particular operating system.)\n\t\t\t\trepodir = wd\n\t\t\t}\n\t\t\tr, err := filepath.Rel(wd, repodir)\n\t\t\tif err != nil {\n\t\t\t\t// Wait, we're not relative to each other? Give up and\n\t\t\t\t// just return the abs repodir.\n\t\t\t\treturn h, repodir\n\t\t\t}\n\t\t\treturn h, r\n\t\t}\n\t}\n\t// This can't happen. If it does, we'll panic and that's ok.\n\treturn nil, \"\"\n}\n\n// Register a new VCS.\nfunc Register(name string, priority int, newfn NewFnSig) {\n\t//fmt.Printf(\"VCS registered: %v\\n\", name)\n\titem := &Item{\n\t\tName: name,\n\t\tNew: newfn,\n\t\tPriority: priority,\n\t}\n\tCatalog = append(Catalog, item)\n\n\t// Keep the list sorted.\n\tsort.Slice(Catalog, func(i, j int) bool { return Catalog[j].Priority < Catalog[i].Priority })\n}\n" }, { "path": "tools/Portfile.template", "content": "# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4\n# $Id: Portfile 132962 2015-02-16 10:33:02Z ryandesign@macports.org $\n\nPortSystem 1.0\nPortGroup github 1.0\n\ngithub.setup StackExchange blackbox @@VERSION@@ v\nname vcs_blackbox\ncategories security\nplatforms darwin\nmaintainers whatexit.org:tal openmaintainer\nlicense BSD\nsupported_archs noarch\n\ndescription Safely store secrets in git/hg/svn repos using GPG encryption\n\nlong_description Storing secrets such as passwords, certificates and private keys \\\n in Git/Mercurial/SubVersion is dangerous. Blackbox makes it easy \\\n to store secrets safely using GPG encryption. They can be easily \\\n decrypted for editing or use in production.\n\nchecksums rmd160 @@RMD160@@ \\\n sha256 @@SHA256@@\n\nuse_configure no\n\nbuild {}\n\n# This project's Makefile uses DESTDIR incorrectly.\ndestroot.destdir DESTDIR=${destroot}${prefix}\ndestroot.target packages-macports\n" }, { "path": "tools/auto_system_test", "content": "#!/usr/bin/env expect\n\n# Run the confidence test non-interactively. Since the script\n# asks for passphrases, we use \"expect\" to simulate keyboard data entry.\n\n# Run the test:\nspawn tools/confidence_test.sh\n\n# As we run the confidence test, respond with the right password.\n# We do this for up to 300 times to prevent an infinite loop.\n\nset times 0;\nwhile { $times < 300 } {\n expect {\n # The script outputs what the password will be, and we save\n # that info in $pw any time we see the text.\n \"my password is the lowercase letter a\" { set pw \"a\\n\" ; exp_continue }\n \"my password is the lowercase letter b\" { set pw \"b\\n\" ; exp_continue }\n # If the passphrase is requested, send it.\n \"Passphrase:\" { send $pw ; exp_continue }\n # If we reach EOF, exit this loop.\n eof { break }\n }\n set times [ expr $times+1];\n}\n" }, { "path": "tools/confidence_test.sh", "content": "#!/usr/bin/env bash\n\nblackbox_home=$( cd \"$( dirname \"${BASH_SOURCE[0]}\" )\" && pwd )/../bin\nexport PATH=\"${blackbox_home}:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/local/bin:/usr/pkg/bin:/usr/pkg/gnu/bin:/usr/local/MacGPG2/bin:/opt/homebrew/bin:${blackbox_home}\"\n\nexport LANG=C.UTF-8 # Required ro \"gpg --export\" to work properly.\n\n# TODO(tlim): The tests are hardcoded to this directory. This should be fixed.\nexport BLACKBOXDATA=keyrings/live\n\n# This script requires many utilities, some are not\n# required by the usual blackbox scripts. Test to make\n# sure we have them all.\ne=false\nfor i in blackbox_addadmin blackbox_list_admins blackbox_register_new_file \\\n cat git gpg gpg-agent mkdir pinentry pinentry-tty rm tar which ; do\n if ! which >/dev/null 2>&1 $i ; then\n echo ERROR: Command not in PATH: $i\n e=true\n fi\ndone\nif $e ; then\n echo 'Exiting. Please install the above commands.'\n echo 'This script requires many utilities not required by blackbox itself.'\n echo PATH=\"$PATH\"\n exit 1\nfi\n\nset -e\n. _stack_lib.sh\n. tools/test_functions.sh\n\nPHASE 'UNIT TESTS'\n\n_blackbox_common_test.sh\n\nPHASE 'SYSTEM TESTS'\n\nmake_tempdir test_repository\ncd \"$test_repository\"\n\nmake_self_deleting_tempdir fake_alice_home\nmake_self_deleting_tempdir fake_bob_home\nexport GNUPGHOME=\"$fake_alice_home\"\n#echo 'pinentry-program' \"$(which pinentry-insecure-fake)\" >> \"$GNUPGHOME/gpg-agent.conf\"\necho 'pinentry-program' \"$(which pinentry-tty)\" >> \"$GNUPGHOME/gpg-agent.conf\"\n#pinentry-program \"${blackbox_home}/pinentry-fake-insecure\"\neval \"$(gpg-agent --homedir \"$fake_alice_home\" --daemon)\"\nGPG_AGENT_INFO_ALICE=\"$GPG_AGENT_INFO\"\n\nexport GNUPGHOME=\"$fake_bob_home\"\n#echo 'pinentry-program' \"$(which pinentry-insecure-fake)\" >> \"$GNUPGHOME/gpg-agent.conf\"\necho 'pinentry-program' \"$(which pinentry-tty)\" >> \"$GNUPGHOME/gpg-agent.conf\"\neval \"$(gpg-agent --homedir \"$fake_bob_home\" --daemon)\"\nGPG_AGENT_INFO_BOB=\"$GPG_AGENT_INFO\"\n\nfunction become_alice() {\n export GNUPGHOME=\"$fake_alice_home\"\n export GPG_AGENT_INFO=\"$GPG_AGENT_INFO_ALICE\"\n echo BECOMING ALICE: GNUPGHOME=\"$GNUPGHOME AGENT=$GPG_AGENT_INFO\"\n mkdir -p .git ; touch .git/config\n git init\n git config user.name \"Alice Example\"\n git config user.email alice@example.com\n}\n\nfunction become_bob() {\n export GNUPGHOME=\"$fake_bob_home\"\n export GPG_AGENT_INFO=\"$GPG_AGENT_INFO_BOB\"\n mkdir -p .git ; touch .git/config\n git config user.name \"Bob Example\"\n git config user.email bob@example.com\n}\n\nPHASE 'Alice creates a repo. She creates secret.txt.'\n\nbecome_alice\necho 'this is my secret' >secret.txt\n\n\nPHASE 'Alice wants to be part of the secret system.'\nPHASE 'She creates a GPG key...'\n\nmake_self_deleting_tempfile gpgconfig\ncat >\"$gpgconfig\" <\"$adminlist1\"\nassert_file_md5hash \"$adminlist1\" \"aa1db827772e1d51d453b844394b7617\"\n\n\nPHASE 'Bob arrives.'\n\nbecome_bob\n\n\nPHASE 'Bob creates a gpg key.'\n\ncat >\"$gpgconfig\" <\"$adminlist2\"\nassert_file_md5hash \"$adminlist2\" \"0b82b0b3c96e6e5dd5faf60493fe5cf7\"\n\nPHASE 'Alice does the second part to enroll bob.'\nbecome_alice\n\nPHASE 'She enrolls bob.'\n#gpg --import $(get_pubring_path)\n## TODO(tlim) That --import can be eliminated... maybe?\n\nPHASE 'She enrolls secrets.txt.'\nblackbox_register_new_file secret.txt\nassert_file_missing secret.txt\nassert_file_exists secret.txt.gpg\nassert_line_exists '/secret.txt' .gitignore\n\nPHASE 'She cats secrets.txt.gpg.'\nmake_self_deleting_tempfile catsecret\nblackbox_cat secret.txt.gpg > $catsecret\nassert_line_exists 'this is my secret' $catsecret\n\nPHASE 'She decrypts secrets.txt.'\nblackbox_edit_start secret.txt\nassert_file_exists secret.txt\nassert_file_exists secret.txt.gpg\nassert_file_md5hash secret.txt \"69923af35054e09cff786424e7b287aa\"\n\nPHASE 'She edits secrets.txt.'\necho 'this is MY NEW SECRET' >secret.txt\nblackbox_edit_end secret.txt\nassert_file_missing secret.txt\nassert_file_exists secret.txt.gpg\n\n\nPHASE 'Alice copies files to a non-repo directory. (NO REPO)'\n\n# Copy the repo entirely:\nmake_self_deleting_tempdir fake_alice_filedir\ntar cf - . | ( cd \"$fake_alice_filedir\" && tar xpvf - )\n# Remove the .git directory\nrm -rf \"$fake_alice_filedir/.git\"\n(\ncd \"$fake_alice_filedir\"\nassert_file_missing '.git'\nassert_file_exists 'secret.txt.gpg'\nassert_file_missing 'secret.txt'\nblackbox_postdeploy\nassert_file_missing '.git'\nassert_file_exists 'secret.txt.gpg'\nassert_file_exists 'secret.txt'\nassert_file_md5hash secret.txt \"08a3fa763a05c018a38e9924363b97e7\"\n\nPHASE 'Alice shreds these non-repo files. (NO REPO)'\nblackbox_shred_all_files\nassert_file_missing '.git'\nassert_file_exists 'secret.txt.gpg'\nassert_file_missing 'secret.txt'\n\nPHASE 'Alice decrypts secrets.txt (NO REPO).'\nblackbox_edit_start secret.txt\nassert_file_exists secret.txt\nassert_file_exists secret.txt.gpg\nassert_file_md5hash secret.txt \"08a3fa763a05c018a38e9924363b97e7\"\n\nPHASE 'Alice edits secrets.txt. (NO REPO EDIT)'\necho 'NOREPO EDIT' >secret.txt\nassert_file_md5hash secret.txt \"d3e6bbdfc76fae7fd0a921f3408db1d1\"\nblackbox_edit_end secret.txt\nassert_file_missing secret.txt\nassert_file_exists secret.txt.gpg\n\nPHASE 'Alice decrypts secrets.txt (NO REPO EDIT).'\nblackbox_edit_start secret.txt\nassert_file_exists secret.txt\nassert_file_exists secret.txt.gpg\nassert_file_md5hash secret.txt \"d3e6bbdfc76fae7fd0a921f3408db1d1\"\n)\n\nPHASE 'appears.'\nbecome_bob\n\n#PHASE 'Bob makes sure he has all new keys.'\n#gpg --import keyrings/live/pubring.???\n\n# Pick a GID to use:\n# This users's default group:\nDEFAULT_GID_NUM=$(id -g)\n# Pick a group that is not the default group:\n#TEST_GID_NUM=$(grep -v \"$DEFAULT_GID_NUM\" /etc/group | cut -d: -f3 | sort -rn | head -1)\nTEST_GID_NUM=$(id -G | tr ' ' \"\\n\" | sort -nr | grep -x -v \"$DEFAULT_GID_NUM\" | head -1)\necho \"DEFAULT_GID_NUM=$DEFAULT_GID_NUM\"\necho \"TEST_GID_NUM=$TEST_GID_NUM\"\n\nPHASE 'Bob postdeploys... default.'\nblackbox_postdeploy\nassert_file_exists secret.txt\nassert_file_exists secret.txt.gpg\nassert_file_md5hash secret.txt \"08a3fa763a05c018a38e9924363b97e7\"\nassert_file_group secret.txt \"$DEFAULT_GID_NUM\"\n\nPHASE 'Bob postdeploys... with a GID.'\nblackbox_postdeploy \"$TEST_GID_NUM\"\nassert_file_exists secret.txt\nassert_file_exists secret.txt.gpg\nassert_file_md5hash secret.txt \"08a3fa763a05c018a38e9924363b97e7\"\nassert_file_group secret.txt \"$TEST_GID_NUM\"\n\nPHASE 'Bob cleans up the secret.'\nrm secret.txt\n\nPHASE 'Bob removes Alice.'\nblackbox_removeadmin alice@example.com\nassert_line_not_exists 'alice@example.com' keyrings/live/blackbox-admins.txt\n\nmake_self_deleting_tempfile adminlist3\nblackbox_list_admins >\"$adminlist3\"\nassert_file_md5hash \"$adminlist3\" \"aadbfafd76ea66ff40dbfd239a69067f\"\n\nPHASE 'Bob reencrypts files so alice can not access them.'\nblackbox_update_all_files\n\nPHASE 'Bob decrypts secrets.txt.'\nblackbox_edit_start secret.txt\nassert_file_exists secret.txt\nassert_file_exists secret.txt.gpg\nassert_file_md5hash secret.txt \"08a3fa763a05c018a38e9924363b97e7\"\n\nPHASE 'Bob edits secrets.txt.'\necho 'BOB BOB BOB BOB' >secret.txt\nblackbox_edit_end secret.txt\nassert_file_missing secret.txt\nassert_file_exists secret.txt.gpg\n\nPHASE 'Bob decrypts secrets.txt VERSION 3.'\nblackbox_edit_start secret.txt\nassert_file_exists secret.txt\nassert_file_exists secret.txt.gpg\nassert_file_md5hash secret.txt \"beb0b0fd5701afb6f891de372abd35ed\"\n\nPHASE 'Bob exposes a secret in the repo.'\necho 'this is my exposed secret' >mistake.txt\ngit add mistake.txt\ngit commit -m'Oops I am committing a secret to the repo.' mistake.txt\n\nPHASE 'Bob corrects it by registering it.'\nblackbox_register_new_file mistake.txt\nassert_file_missing mistake.txt\nassert_file_exists mistake.txt.gpg\n# NOTE: It is still in the history. That should be corrected someday.\nassert_line_exists '/mistake.txt' .gitignore\n\nPHASE 'Bob enrolls my/path/to/relsecrets.txt.'\nmkdir my my/path my/path/to\necho 'New secret' > my/path/to/relsecrets.txt\ncd my/path/to\nblackbox_register_new_file relsecrets.txt\nassert_file_missing relsecrets.txt\nassert_file_exists relsecrets.txt.gpg\nassert_file_missing .gitignore\nassert_file_exists ../../../.gitignore\nassert_line_exists '/my/path/to/relsecrets.txt' ../../../.gitignore\n\nPHASE 'Bob decrypts relsecrets.txt.'\ncd ..\nblackbox_edit_start to/relsecrets.txt\nassert_file_exists to/relsecrets.txt\nassert_file_exists to/relsecrets.txt.gpg\nassert_file_md5hash to/relsecrets.txt \"c47f9c3c8ce03d895b883ac22384cb67\"\ncd ../..\n\nPHASE 'Bob enrolls !important!.txt'\necho A very important file >'!important!.txt'\nblackbox_register_new_file '!important!.txt'\nassert_file_missing '!important!.txt'\nassert_file_exists '!important!.txt'.gpg\nassert_line_exists '/!important!.txt' .gitignore\n\nPHASE 'Bob enrolls #andpounds.txt'\necho A very commented file >'#andpounds.txt'\nblackbox_register_new_file '#andpounds.txt'\nassert_file_missing '#andpounds.txt'\nassert_file_exists '#andpounds.txt'.gpg\nassert_line_exists '/#andpounds.txt' .gitignore\n\nPHASE 'Bob enrolls stars*bars?.txt'\necho A very wild and questioned file >'stars*bars?.txt'\nblackbox_register_new_file 'stars*bars?.txt'\nassert_file_missing 'stars*bars?.txt'\nassert_file_exists 'stars*bars?.txt'.gpg\nassert_line_exists '/stars\\*bars\\?.txt' .gitignore\n\nPHASE 'Bob enrolls space space.txt'\necho A very spacey file >'space space.txt'\nblackbox_register_new_file 'space space.txt'\nassert_file_missing 'space space.txt'\nassert_file_exists 'space space.txt'.gpg\nassert_line_exists '/space space.txt' .gitignore\n\nPHASE 'Bob checks out stars*bars?.txt.'\nblackbox_edit_start 'stars*bars?.txt'\nassert_file_exists 'stars*bars?.txt'\nassert_file_exists 'stars*bars?.txt'\nassert_file_md5hash 'stars*bars?.txt' \"448e018faade28cede2bf6f33c3c2dfb\"\n\nPHASE 'Bob checks out space space.txt.'\nblackbox_edit_start 'space space.txt'\nassert_file_exists 'space space.txt'\nassert_file_exists 'space space.txt'\nassert_file_md5hash 'space space.txt' \"de1d4e4a07046f81af5d3c0194b78742\"\n\nPHASE 'Bob shreds all exposed files.'\nassert_file_exists 'my/path/to/relsecrets.txt'\nassert_file_exists 'secret.txt'\nblackbox_shred_all_files\nwhich blackbox_shred_all_files\nassert_file_missing '!important!.txt'\nassert_file_missing '#andpounds.txt'\nassert_file_missing 'mistake.txt'\nassert_file_missing 'my/path/to/relsecrets.txt'\nassert_file_missing 'secret.txt'\nassert_file_missing 'space space.txt'\nassert_file_missing 'stars*bars?.txt'\nassert_file_exists '!important!.txt.gpg'\nassert_file_exists '#andpounds.txt.gpg'\nassert_file_exists 'mistake.txt.gpg'\nassert_file_exists 'my/path/to/relsecrets.txt.gpg'\nassert_file_exists 'secret.txt.gpg'\nassert_file_exists 'space space.txt.gpg'\nassert_file_exists 'stars*bars?.txt.gpg'\n\nPHASE 'Bob updates all files.'\nblackbox_update_all_files\nassert_file_missing '!important!.txt'\nassert_file_missing '#andpounds.txt'\nassert_file_missing 'mistake.txt'\nassert_file_missing 'my/path/to/relsecrets.txt'\nassert_file_missing 'secret.txt'\nassert_file_missing 'space space.txt'\nassert_file_missing 'stars*bars?.txt'\nassert_file_exists '!important!.txt.gpg'\nassert_file_exists '#andpounds.txt.gpg'\nassert_file_exists 'mistake.txt.gpg'\nassert_file_exists 'my/path/to/relsecrets.txt.gpg'\nassert_file_exists 'secret.txt.gpg'\nassert_file_exists 'space space.txt.gpg'\nassert_file_exists 'stars*bars?.txt.gpg'\n\nPHASE 'Bob DEregisters mistake.txt'\ntouch 'mistake.txt'\nblackbox_deregister_file 'mistake.txt.gpg'\nassert_file_exists 'keyrings/live/blackbox-admins.txt'\nassert_file_exists 'keyrings/live/blackbox-files.txt'\nassert_line_not_exists 'mistake.txt' 'keyrings/live/blackbox-files.txt'\nassert_file_missing 'mistake.txt.gpg'\nassert_file_exists 'mistake.txt'\n# Now remove 'mistake.txt' to leave the area clean.\nrm 'mistake.txt'\n\nPHASE 'Bob enrolls multiple files: multi1.txt and multi2.txt'\necho 'One singular sensation.' >'multi1.txt'\necho 'Another singular sensation.' >'multi2.txt'\nblackbox_register_new_file 'multi1.txt' 'multi2.txt'\nassert_file_missing 'multi1.txt'\nassert_file_exists 'multi1.txt'.gpg\nassert_line_exists '/multi1.txt' .gitignore\nassert_file_missing 'multi2.txt'\nassert_file_exists 'multi2.txt'.gpg\nassert_line_exists '/multi2.txt' .gitignore\n\nPHASE 'Alice returns. She should be locked out'\nassert_file_missing 'secret.txt'\nbecome_alice\nPHASE 'Alice tries to decrypt secret.txt. Is blocked.'\nif blackbox_edit_start secret.txt ; then\n echo 'ERROR: Alice was able to decrypt secret.txt! She should have been blocked.'\n exit 1\nelse\n echo 'NOTE: Alice was not able to decrypt secret.txt as expected.'\nfi\n\nPHASE 'Bob returns. Tries to update all files with a corrupt blackbox-admins.txt'\nbecome_bob\n# Corrupt the blackbox-admins.txt list:\necho 'abba@notarealuser.com' >> keyrings/live/blackbox-admins.txt\n# Make sure it fails.\nif blackbox_update_all_files; then\n echo '!!!!! blackbox_update_all_files should have failed and it did NOT.'\n exit 1\nfi\n# Cleanup:\nblackbox_removeadmin abba@notarealuser.com\n\nmake_self_deleting_tempfile adminlist4\nblackbox_list_admins >\"$adminlist4\"\nassert_file_md5hash \"$adminlist4\" \"aadbfafd76ea66ff40dbfd239a69067f\"\n\n\n# TODO: Create a new directory. \"git clone\" the repo into it.\n\n#\n# ASSERTIONS\n#\n\necho '========== Verifying .gnupg was not accidentally created.'\n\nif [[ -e $HOME/.gnupg ]]; then\n echo \"ASSERT FAILED: $HOME/.gnupg should not exist.\"\n exit 1\nfi\n\necho '========== DONE with tests. Outputing some diagnostics:'\n\nfind .git?* * -type f -ls\necho cd \"$test_repository\"\necho rm -rf \"$test_repository\"\necho 'SUCCESS! Doing final clean-up then exiting.'\n" }, { "path": "tools/macports_report_upgrade.sh", "content": "#!/usr/bin/env bash\n\n# Turn the Portfile.template into a Portfile.\n# Usage:\n# mk_portfile.sh TEMPLATE OUTPUTFILE VERSION\n\nset -e\nblackbox_home=$( cd \"$( dirname \"${BASH_SOURCE[0]}\" )\" && pwd )\nsource ${blackbox_home}/../bin/_stack_lib.sh\n\nTEMPLATEFILE=tools/Portfile.template\nOUTPUTFILE=Portfile\nPORTVERSION=${1?\"Arg 1 must be a version number like 1.20150222 (with no v)\"} ; shift\n\n# Add the version number to the template.\nsed <\"$TEMPLATEFILE\" >\"$OUTPUTFILE\" -e 's/@@VERSION@@/'\"$PORTVERSION\"'/g'\n\n# Test it. Record the failure in $checksumout\nfgrep >/dev/null -x 'file:///var/tmp/ports' /opt/local/etc/macports/sources.conf || sudo sed -i -e '1s@^@file:///var/tmp/ports\\'$'\\n@' /opt/local/etc/macports/sources.conf\nrm -rf /var/tmp/ports\nmkdir -p /var/tmp/ports/security/vcs_blackbox\ncp Portfile /var/tmp/ports/security/vcs_blackbox\n( cd /var/tmp/ports && sudo portindex )\nmake_self_deleting_tempfile checksumout\nset +e\nsudo port -v checksum vcs_blackbox > \"$checksumout\" 2>/dev/null\nret=$?\n\n# If it failed, grab the checksums. Then re-process the template with them.\nif [[ $ret != 0 ]]; then\n RMD160=$(awk <\"$checksumout\" '/^Distfile checksum: .*rmd160/ { print $NF }')\n SHA256=$(awk <\"$checksumout\" '/^Distfile checksum: .*sha256/ { print $NF }')\n echo RMD160=$RMD160\n echo SHA256=$SHA256\n echo\n if [[ $RMD160 != '' && $SHA256 != '' ]]; then\n sed <\"$TEMPLATEFILE\" >\"$OUTPUTFILE\" -e 's/@@VERSION@@/'\"$PORTVERSION\"'/g' -e 's/@@RMD160@@/'\"$RMD160\"'/g' -e 's/@@SHA256@@/'\"$SHA256\"'/g'\n cp Portfile /var/tmp/ports/security/vcs_blackbox\n ( cd /var/tmp/ports && sudo portindex )\n sudo port -v checksum vcs_blackbox\n fi\nfi\n\n# Generate the diff\ncp /opt/local/var/macports/sources/rsync.macports.org/release/tarballs/ports/security/vcs_blackbox/Portfile /var/tmp/ports/security/vcs_blackbox/Portfile.orig\n( cd /var/tmp/ports/security/vcs_blackbox && diff --ignore-matching-lines='Id:' -u Portfile.orig Portfile ) > Portfile-vcs_blackbox.diff\nopen -R Portfile-vcs_blackbox.diff\n\necho\necho 'portfile is in:'\necho ' /var/tmp/ports/security/vcs_blackbox/Portfile'\necho 'cleanup:'\necho ' sudo vi /opt/local/etc/macports/sources.conf'\n\necho \"\nPLEASE OPEN A TICKET WITH THIS INFORMATION:\n https://trac.macports.org/newticket\n Summary: vcs_blackbox @$PORTVERSION Update to latest upstream\n Description: \nNew upstream of vcs_blackbox.\ngithub.setup and checksums updated.\n Type: update\n Component: ports\n Port: vcs_blackbox\n Keywords: maintainer haspatch\n\"\necho 'Attach: Portfile-vcs_blackbox.diff'\n" }, { "path": "tools/mk_deb_fpmdir", "content": "#! /usr/bin/env bash\n\n# Use fpm to package up files into a DEB .\n\n# Usage:\n# mk_deb_fpmdir PACKAGENAME MANIFEST1 MANIFEST2 ...\n\n# Example:\n# Make a package foopkg manifest.txt\n# Where \"manifest.txt\" contains:\n# exec /usr/bin/stack_makefqdn misc/stack_makefqdn.py\n# exec /usr/bin/bar bar/bar.sh\n# read /usr/man/man1/bar.1 bar/bar.1.man\n# 0444 /etc/foo.conf bar/foo.conf\n\nset -e\n\n# Parameters for this DEB:\nPACKAGENAME=${1?\"First arg must be the package name.\"}\nshift\n\n# Defaults that can be overridden:\n# All packages are 1.0 unless otherwise specifed:\n: ${PKGVERSION:=1.0} ;\n# If there is no iteration set, default to use the number of commits in the repository:\nif [[ -z \"${PKGRELEASE}\" ]]; then\n PKGRELEASE=$(git rev-list HEAD --count)\n if [[ $? != 0 ]]; then\n # We're not in a git repo, fall back to 1 so we cope with being built from\n # a tarball\n PKGRELEASE=1\n fi\nfi\n\n# If there is no epoch, assume 0\n: ${PKGEPOCH:=0}\n\n# Allow us to set a different OUTPUTDIR if we're building in CI/CD\nif [[ -z \"${OUTPUTDIR}\" ]]; then\n # The DEB is output here: (should be a place that can be wiped)\n OUTPUTDIR=\"${HOME}/debbuild-${PACKAGENAME}\"\nelse\n echo \"Using $OUTPUTDIR for OUTPUTDIR instead of ${HOME}/debbuild-${PACKAGENAME}\"\nfi\n\n# The TeamCity templates expect to find the list of artifacts here:\nDEB_BIN_LIST=\"${OUTPUTDIR}/bin-packages.txt\"\n\n# -- Now the real work can be done.\n\n# Clean the output dir.\nrm -rf \"$OUTPUTDIR\"\n\nmkdir -p \"$OUTPUTDIR/installroot\"\n\n# Copy the files into place:\nset -o pipefail # Error out if any manifest is not found.\ncat \"\"\"$@\"\"\" | while read -a arr ; do\n PERM=\"${arr[0]}\"\n case $PERM in\n \\#*) continue ;; # Skip comments.\n exec) PERM=0755 ;;\n read) PERM=0744 ;;\n *) ;;\n esac\n DST=\"$OUTPUTDIR/installroot/${arr[1]}\"\n SRC=\"${arr[2]}\"\n if [[ $SRC == \"cmd/\"* || $SRC == *\"/cmd/\"* ]]; then\n ( cd $(dirname \"$SRC\" ) && go build -a -v )\n fi\n install -D -T -b -m \"$PERM\" -T \"$SRC\" \"$DST\"\ndone\n\n# Build the DEB:\ncd \"$OUTPUTDIR\" && fpm -s dir -t deb \\\n -a all \\\n -n \"${PACKAGENAME}\" \\\n --epoch \"${PKGEPOCH}\" \\\n --version \"${PKGVERSION}\" \\\n --iteration \"${PKGRELEASE}\" \\\n ${PKGDESCRIPTION:+ --description=\"${PKGDESCRIPTION}\"} \\\n ${PKGVENDOR:+ --vendor=\"${PKGVENDOR}\"} \\\n -C \"$OUTPUTDIR/installroot\" \\\n .\n\n# TeamCity templates for DEBS expect to find\n# the list of all packages created in bin-packages.txt.\n# Generate that list:\nfind \"$OUTPUTDIR\" -maxdepth 1 -name '*.deb' >\"$DEB_BIN_LIST\"\n# Output it for debugging purposes:\ncat \"$DEB_BIN_LIST\"\n" }, { "path": "tools/mk_deb_fpmdir.stack_blackbox.txt", "content": "exec /usr/bin/_blackbox_common.sh ../bin/_blackbox_common.sh\nexec /usr/bin/_stack_lib.sh ../bin/_stack_lib.sh\nexec /usr/bin/blackbox_addadmin ../bin/blackbox_addadmin\nexec /usr/bin/blackbox_cat ../bin/blackbox_cat\nexec /usr/bin/blackbox_decrypt_all_files ../bin/blackbox_decrypt_all_files\nexec /usr/bin/blackbox_decrypt_file ../bin/blackbox_decrypt_file\nexec /usr/bin/blackbox_deregister_file ../bin/blackbox_deregister_file\nexec /usr/bin/blackbox_diff ../bin/blackbox_diff\nexec /usr/bin/blackbox_edit ../bin/blackbox_edit\nexec /usr/bin/blackbox_edit_end ../bin/blackbox_edit_end\nexec /usr/bin/blackbox_edit_start ../bin/blackbox_edit_start\nexec /usr/bin/blackbox_initialize ../bin/blackbox_initialize\nexec /usr/bin/blackbox_listadmins ../bin/blackbox_listadmins\nexec /usr/bin/blackbox_list_files ../bin/blackbox_list_files\nexec /usr/bin/blackbox_list_admins ../bin/blackbox_list_admins\nexec /usr/bin/blackbox_postdeploy ../bin/blackbox_postdeploy\nexec /usr/bin/blackbox_recurse ../bin/blackbox_recurse\nexec /usr/bin/blackbox_register_new_file ../bin/blackbox_register_new_file\nexec /usr/bin/blackbox_removeadmin ../bin/blackbox_removeadmin\nexec /usr/bin/blackbox_shred_all_files ../bin/blackbox_shred_all_files\nexec /usr/bin/blackbox_update_all_files ../bin/blackbox_update_all_files\nexec /usr/bin/blackbox_view ../bin/blackbox_view\nexec /usr/bin/blackbox_whatsnew ../bin/blackbox_whatsnew\n" }, { "path": "tools/mk_macports", "content": "#!/usr/bin/env bash\n\n# Install files into MacPorts DESTDIR\n\n# Usage:\n# mk_macports MANIFEST MANIFEST1 ...\n\n# Where \"manifest.txt\" contains:\n# exec /usr/bin/stack_makefqdn misc/stack_makefqdn.py\n# exec /usr/bin/bar bar/bar.sh\n# read /usr/man/man1/bar.1 bar/bar.1.man\n# 0444 /etc/foo.conf bar/foo.conf\n# (NOTE: \"exec\" means 0755; \"read\" means 0744)\n\nset -e\n\n# Fail if DESTDIR is not set.\nDESTDIR=\"${DESTDIR?\"Envvar DESTDIR must be set to destination dir.\"}\"\n\n# Copy the files into place:\ncat \"\"\"$@\"\"\" | while read -a arr ; do\n PERM=\"${arr[0]}\"\n case $PERM in\n \\#*) continue ;; # Skip comments.\n exec) PERM=0755 ;;\n read) PERM=0744 ;;\n *) ;;\n esac\n DST=\"$DESTDIR/${arr[1]}\"\n SRC=\"${arr[2]}\"\n install -m \"$PERM\" \"$SRC\" \"$DST\"\ndone\n" }, { "path": "tools/mk_macports.vcs_blackbox.txt", "content": "exec bin/_blackbox_common.sh ../bin/_blackbox_common.sh\nexec bin/_stack_lib.sh ../bin/_stack_lib.sh\nexec bin/blackbox_addadmin ../bin/blackbox_addadmin\nexec bin/blackbox_cat ../bin/blackbox_cat\nexec bin/blackbox_decrypt_all_files ../bin/blackbox_decrypt_all_files\nexec bin/blackbox_decrypt_file ../bin/blackbox_decrypt_file\nexec bin/blackbox_deregister_file ../bin/blackbox_deregister_file\nexec bin/blackbox_diff ../bin/blackbox_diff\nexec bin/blackbox_edit ../bin/blackbox_edit\nexec bin/blackbox_edit_end ../bin/blackbox_edit_end\nexec bin/blackbox_edit_start ../bin/blackbox_edit_start\nexec bin/blackbox_initialize ../bin/blackbox_initialize\nexec bin/blackbox_listadmins ../bin/blackbox_listadmins\nexec bin/blackbox_list_files ../bin/blackbox_list_files\nexec bin/blackbox_list_admins ../bin/blackbox_list_admins\nexec bin/blackbox_postdeploy ../bin/blackbox_postdeploy\nexec bin/blackbox_recurse ../bin/blackbox_recurse\nexec bin/blackbox_register_new_file ../bin/blackbox_register_new_file\nexec bin/blackbox_removeadmin ../bin/blackbox_removeadmin\nexec bin/blackbox_shred_all_files ../bin/blackbox_shred_all_files\nexec bin/blackbox_update_all_files ../bin/blackbox_update_all_files\nexec bin/blackbox_view ../bin/blackbox_view\nexec bin/blackbox_whatsnew ../bin/blackbox_whatsnew\n" }, { "path": "tools/mk_rpm_fpmdir", "content": "#! /usr/bin/env bash\n\n# Use fpm to package up files into an RPM.\n\n# Usage:\n# mk_rpm_fpmdir PACKAGENAME MANIFEST1 MANIFEST2 ...\n\n# Example:\n# Make a package foopkg manifest.txt\n# Where \"manifest.txt\" contains:\n# exec /usr/bin/stack_makefqdn misc/stack_makefqdn.py\n# exec /usr/bin/bar bar/bar.sh\n# read /usr/man/man1/bar.1 bar/bar.1.man\n# 0444 /etc/foo.conf bar/foo.conf\n\nset -e\n\n# Parameters for this RPM:\nPACKAGENAME=${1?\"First arg must be the package name.\"}\nshift\n\n# What is my name?\nCMDNAME=$(basename $0)\n\n# Defaults that can be overridden:\n# Packages are 1.0 unless otherwise specifed:\n: ${PKGVERSION:=1.0} ;\n# If there is no iteration set, default to use the number of commits in the repository:\nif [[ -z \"${PKGRELEASE}\" ]]; then\n PKGRELEASE=$(git rev-list HEAD --count)\n if [[ $? != 0 ]]; then\n # We're not in a git repo, fall back to 1 so we cope with being built from\n # a tarball\n PKGRELEASE=1\n fi\nfi\n\n# If there is no epoch, assume 0\n: ${PKGEPOCH:=0}\n\n# If no arch defined, assume any. Other good values include \"native\".\n: ${PKGARCH:=all}\n# NOTE: If we later compile code, we set this to \"native\", which\n# FPM will translate to the correct value for local conditions.\n\n# Allow us to set a different OUTPUTDIR if we're building in CI/CD\nif [[ -z \"${OUTPUTDIR}\" ]]; then\n # The RPM is output here: (should be a place that can be wiped)\n OUTPUTDIR=\"${HOME}/rpmbuild-${PACKAGENAME}\"\nelse\n echo \"Using ${OUTPUTDIR} for OUTPUTDIR instead of ${HOME}/rpmbuild-${PACKAGENAME}\"\nfi\nINSTALLROOT=\"$OUTPUTDIR/installroot\"\n\n# StackOverflow's TeamCity templates expect to find the list of artifacts here:\nRPM_BIN_LIST=\"${OUTPUTDIR}/bin-packages.txt\"\n\n# -- Now the real work can be done.\n\n# Clean the output dir.\nrm -rf \"$OUTPUTDIR\"\nmkdir -p \"$INSTALLROOT\"\n\n# If there is a build script, execute it.\nBUILDSCRIPTNAME=\"./build.${PACKAGENAME}.sh\"\nif [[ -x $BUILDSCRIPTNAME ]]; then\n echo \"========== $BUILDSCRIPTNAME FOUND. Running.\"\n if [[ $PKGARCH == \"all\" ]]; then\n echo 'WARNING: PKGARCH=all (which may not what you want)'\n # If you are using a build.*.sh script, you probably want to\n # set PKGARCH to \"native\" before you run mk_rpm_fpmdir.\n fi\n $BUILDSCRIPTNAME \"$INSTALLROOT\" \"${PKGVERSION}\"\n # If we used the build build.*.sh script, it must do all compilation.\n # Therefore, we disable the automagic GO build feature.\n GO_COMPILE=false\nelse\n GO_COMPILE=true\nfi\n\n# If there are additional args for fpm, read them into a variable. There is\n# a chdir later, therefore we can't rely on the file path working at that time.\nFPM_OPTIONS_FILE=\"./fpm_opts.${PACKAGENAME}.sh\"\nif [[ -f $FPM_OPTIONS_FILE ]]; then\n echo \"========== $FPM_OPTIONS_FILE FOUND. Loading.\"\n FPM_OPTIONS=$(<$FPM_OPTIONS_FILE)\nfi\n# Warning: The contents of the file are evaluated therefore\n# quotes and special chars must be quoted.\n\n# Copy any static files into place:\nset -o pipefail # Error out if any manifest is not found.\ncat \"$@\" | while read -a arr ; do\n PERM=\"${arr[0]}\"\n case $PERM in\n \\#*) continue ;; # Skip comments.\n exec) PERM=0755 ;;\n read) PERM=0744 ;;\n *) ;;\n esac\n DST=\"$INSTALLROOT/${arr[1]}\"\n SRC=\"${arr[2]}\"\n if [[ ${#arr[@]} != 3 ]] ; then\n echo \"ERROR: Line must contain 3 items.\"\n echo \"DEBUG NUM=${#arr[@]} PERM=$PERM DST=$DST SRC=$SRC\"\n exit 1\n fi\n if $GO_COMPILE && [[ $SRC == \"cmd/\"* || $SRC == *\"/cmd/\"* ]]; then\n echo \"========== BUILD© $SRC\"\n ( cd $(dirname \"$SRC\" ) && go get -d && go build ) \n PKGARCH=native\n else\n echo \"========== COPY $SRC\"\n fi\n if [[ ! -f \"$SRC\" ]]; then\n echo \"${CMDNAME}: ERROR: File not found: $SRC\"\n exit 1\n fi\n install -D -T -b -m \"$PERM\" -T \"$SRC\" \"$DST\"\ndone\n\nset -x\n# Build the RPM out of what is found in $INSTALLROOT:\ncd \"$OUTPUTDIR\" && fpm -s dir -t rpm \\\n -a \"${PKGARCH}\" \\\n -n \"${PACKAGENAME}\" \\\n --epoch \"${PKGEPOCH}\" \\\n --version \"${PKGVERSION}\" \\\n --iteration \"${PKGRELEASE}\" \\\n ${PKGDESCRIPTION:+ --description=\"${PKGDESCRIPTION}\"} \\\n ${PKGVENDOR:+ --vendor=\"${PKGVENDOR}\"} \\\n ${FPM_OPTIONS:+ $FPM_OPTIONS} \\\n -C \"$INSTALLROOT\" \\\n .\n\n# TeamCity templates for RPMS expect to find\n# the list of all packages created in bin-packages.txt.\n# Generate that list:\nfind \"$OUTPUTDIR\" -maxdepth 1 -name '*.rpm' >\"$RPM_BIN_LIST\"\n# Output it for debugging purposes:\ncat \"$RPM_BIN_LIST\"\n" }, { "path": "tools/mk_rpm_fpmdir.stack_blackbox.txt", "content": "# Update tools/mk_rpm_fpmdir.stack_blackbox.txt. Other files generate from it.\nexec /etc/profile.d/usrblackbox.sh profile.d-usrblackbox.sh\nexec /usr/blackbox/bin/_blackbox_common.sh ../bin/_blackbox_common.sh\nexec /usr/blackbox/bin/_stack_lib.sh ../bin/_stack_lib.sh\nexec /usr/blackbox/bin/blackbox_addadmin ../bin/blackbox_addadmin\nexec /usr/blackbox/bin/blackbox_cat ../bin/blackbox_cat\nexec /usr/blackbox/bin/blackbox_decrypt_all_files ../bin/blackbox_decrypt_all_files\nexec /usr/blackbox/bin/blackbox_decrypt_file ../bin/blackbox_decrypt_file\nexec /usr/blackbox/bin/blackbox_deregister_file ../bin/blackbox_deregister_file\nexec /usr/blackbox/bin/blackbox_diff ../bin/blackbox_diff\nexec /usr/blackbox/bin/blackbox_edit ../bin/blackbox_edit\nexec /usr/blackbox/bin/blackbox_edit_end ../bin/blackbox_edit_end\nexec /usr/blackbox/bin/blackbox_edit_start ../bin/blackbox_edit_start\nexec /usr/blackbox/bin/blackbox_initialize ../bin/blackbox_initialize\nexec /usr/blackbox/bin/blackbox_listadmins ../bin/blackbox_listadmins\nexec /usr/blackbox/bin/blackbox_list_files ../bin/blackbox_list_files\nexec /usr/blackbox/bin/blackbox_list_admins ../bin/blackbox_list_admins\nexec /usr/blackbox/bin/blackbox_postdeploy ../bin/blackbox_postdeploy\nexec /usr/blackbox/bin/blackbox_recurse ../bin/blackbox_recurse\nexec /usr/blackbox/bin/blackbox_register_new_file ../bin/blackbox_register_new_file\nexec /usr/blackbox/bin/blackbox_removeadmin ../bin/blackbox_removeadmin\nexec /usr/blackbox/bin/blackbox_shred_all_files ../bin/blackbox_shred_all_files\nexec /usr/blackbox/bin/blackbox_update_all_files ../bin/blackbox_update_all_files\nexec /usr/blackbox/bin/blackbox_view ../bin/blackbox_view\nexec /usr/blackbox/bin/blackbox_whatsnew ../bin/blackbox_whatsnew\n" }, { "path": "tools/profile.d-usrblackbox-test.sh", "content": "#!/usr/bin/env sh\n\n# Test profile.d-usrblackbox.sh\n\n# Make sure profile.d-usrblackbox.sh works.\n\n# Test variations including /usr/blackbox/bin is not in the path, is\n# already there in the front, middle, or end, and tests if the path has :\n# in weird places (front, middle, or both).\n\n# To run the test:\n# bash tools/profile.d-usrblackbox-test.sh | fgrep --color /usr/blackbox/bin\n# sh tools/profile.d-usrblackbox-test.sh | fgrep --color /usr/blackbox/bin\n\n# NOTE: profile.d-usrblackbox.sh is written to be so small that it fits as an \"inline\" file.\n# https://lwn.net/Articles/468678/\n# To remove the last newline in the file:\n# perl -i -pe 'chomp if eof' profile.d-usrblackbox.sh\n\nfor p in \\\n '/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin' \\\n '/usr/blackbox/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin' \\\n '/usr/local/bin:/bin:/usr/blackbox/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin' \\\n '/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/usr/blackbox/bin' \\\n '/Apple spaces/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin' \\\n ; do\n\n export PATH=\"$p\"\n . tools/profile.d-usrblackbox.sh\n echo NEW: \"$PATH\"\n\n export PATH=\":$p\"\n . tools/profile.d-usrblackbox.sh\n echo NEW: \"$PATH\"\n\n export PATH=\"$p:\"\n . tools/profile.d-usrblackbox.sh\n echo NEW: \"$PATH\"\n\n export PATH=\":$p:\"\n . tools/profile.d-usrblackbox.sh\n echo NEW: \"$PATH\"\n\ndone\n" }, { "path": "tools/profile.d-usrblackbox.sh", "content": "x=/usr/blackbox/bin\ncase \":$PATH:\" in *:$x:*);;*)PATH=\"$x:$PATH\";;esac" }, { "path": "tools/test_functions.sh", "content": "#!/usr/bin/env bash\n\n# NB: This is copied from _blackbox_common.sh\nfunction get_pubring_path() {\n : \"${KEYRINGDIR:=keyrings/live}\" ;\n if [[ -f \"${KEYRINGDIR}/pubring.gpg\" ]]; then\n echo \"${KEYRINGDIR}/pubring.gpg\"\n else\n echo \"${KEYRINGDIR}/pubring.kbx\"\n fi\n}\n\nfunction PHASE() {\n echo '********************'\n echo '********************'\n echo '*********' \"\"\"$@\"\"\"\n echo '********************'\n echo '********************'\n}\n\nfunction md5sum_file() {\n # Portably generate the MD5 hash of file $1.\n case $(uname -s) in\n Darwin | FreeBSD )\n md5 -r \"$1\" | awk '{ print $1 }'\n ;;\n NetBSD )\n md5 -q \"$1\"\n ;;\n SunOS )\n digest -a md5 \"$1\"\n ;;\n Linux )\n md5sum \"$1\" | awk '{ print $1 }'\n ;;\n CYGWIN* )\n md5sum \"$1\" | awk '{ print $1 }'\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting.'\n exit 1\n ;;\n esac\n}\n\nfunction assert_file_missing() {\n if [[ -e \"$1\" ]]; then\n echo \"ASSERT FAILED: ${1} should not exist.\"\n exit 1\n fi\n}\n\nfunction assert_file_exists() {\n if [[ ! -e \"$1\" ]]; then\n echo \"ASSERT FAILED: ${1} should exist.\"\n echo \"PWD=$(/usr/bin/env pwd -P)\"\n #echo \"LS START\"\n #ls -la\n #echo \"LS END\"\n exit 1\n fi\n}\nfunction assert_file_md5hash() {\n local file=\"$1\"\n local wanted=\"$2\"\n assert_file_exists \"$file\"\n local found\n found=$(md5sum_file \"$file\")\n if [[ \"$wanted\" != \"$found\" ]]; then\n echo \"ASSERT FAILED: $file hash wanted=$wanted found=$found\"\n exit 1\n fi\n}\nfunction assert_file_group() {\n local file=\"$1\"\n local wanted=\"$2\"\n local found\n assert_file_exists \"$file\"\n\n case $(uname -s) in\n Darwin | FreeBSD | NetBSD )\n found=$(stat -f '%Dg' \"$file\")\n ;;\n Linux | SunOS )\n found=$(stat -c '%g' \"$file\")\n ;;\n CYGWIN* )\n echo \"ASSERT_FILE_GROUP: Running on Cygwin. Not being tested.\"\n return 0\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting.'\n exit 1\n ;;\n esac\n\n echo \"DEBUG: assert_file_group X${wanted}X vs. X${found}X\"\n echo \"DEBUG:\" $(which stat)\n if [[ \"$wanted\" != \"$found\" ]]; then\n echo \"ASSERT FAILED: $file chgrp group wanted=$wanted found=$found\"\n exit 1\n fi\n}\nfunction assert_file_perm() {\n local wanted=\"$1\"\n local file=\"$2\"\n local found\n assert_file_exists \"$file\"\n\n case $(uname -s) in\n Darwin | FreeBSD | NetBSD )\n found=$(stat -f '%Sp' \"$file\")\n ;;\n # NB(tlim): CYGWIN hasn't been tested. It might be more like Darwin.\n Linux | CYGWIN* | SunOS )\n found=$(stat -c '%A' \"$file\")\n ;;\n * )\n echo 'ERROR: Unknown OS. Exiting.'\n exit 1\n ;;\n esac\n\n echo \"DEBUG: assert_file_perm X${wanted}X vs. X${found}X\"\n echo \"DEBUG:\" $(which stat)\n if [[ \"$wanted\" != \"$found\" ]]; then\n echo \"ASSERT FAILED: $file chgrp perm wanted=$wanted found=$found\"\n exit 1\n fi\n}\nfunction assert_line_not_exists() {\n local target=\"$1\"\n local file=\"$2\"\n assert_file_exists \"$file\"\n if grep -F -x -s -q >/dev/null \"$target\" \"$file\" ; then\n echo \"ASSERT FAILED: line '$target' should not exist in file $file\"\n echo \"==== file contents: START $file\"\n cat \"$file\"\n echo \"==== file contents: END $file\"\n exit 1\n fi\n}\nfunction assert_line_exists() {\n local target=\"$1\"\n local file=\"$2\"\n assert_file_exists \"$file\"\n if ! grep -F -x -s -q >/dev/null \"$target\" \"$file\" ; then\n echo \"ASSERT FAILED: line '$target' should exist in file $file\"\n echo \"==== file contents: START $file\"\n cat \"$file\"\n echo \"==== file contents: END $file\"\n exit 1\n fi\n}\n" } ]