#!/bin/sh
set -e
IFS='
'
if ! gpg=$(command -v gpg2) >/dev/null; then
  echo "$0 requires gpg2" >&2
  false
fi

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 'pijul-encrypt already configured!'
  false
fi
recipients="$*"
[ "$recipients" ] || {
  echo 'Specify recipients fingerprints.'
  read -r recipients
}
(
  IFS=' '
  .pijul/encrypt/add-recipients.sh $recipients
)
echo 'generating master key...'
master_key=$($gpg --armor --gen-random 16 512)
echo "master key generated: $master_key"
printf %s "$master_key" | $gpg --batch --sign --encrypt \
  $(printf -- '--recipient-file\n%s\n' .encrypt.d/recipient/*.asc) \
  --output .encrypt.d/master_key.gpg
echo "Now add .pijul/encrypt/hook-record.sh to record hook.
edit .pijul/config as below:
\`\`\`
[hooks]
record = ['.pijul/encrypt/hook-record.sh']
\`\`\`
"

#!/bin/sh
. .pijul/encrypt/scripts.sh
if ! sha256sum=$(command -v sha256sum) >/dev/null; then
  echo "$0 requires sha256sum" >&2
  false
fi
if [ ! -f .encrypt.d/master_key.gpg ]; then
  echo "No master key in repositry. Repositry not initialized for pijul-encrypt" >&2
  false
fi
encrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --passphrase-fd 0 \
      --sign --encrypt --symmetric \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) "$path"
}
decrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --output - --passphrase-fd 0 \
      --decrypt "$path"
}
# globを展開、マッチするディレクトリの中身も全部マッチしたいのでfindを噛ませる
# shellcheck disable=SC2046
worktree_glob=$(find $(cat .encrypt) -type f -not -name '*.gpg' || true)
: "↓debug worktree_glob↓
$worktree_glob"
# pijulが記録しているパスのうち`.encrypt`にマッチするもの
# shellcheck disable=SC2086
# shellcheck disable=SC2046
tracked_glob=$(printf '%s\n' $worktree_glob $(pijul list) | sort | uniq -d)
: "↓debug tracked_glob↓
$tracked_glob"
# shellcheck disable=SC2086
pijul remove $tracked_glob # 秘密のファイルはさっさと記録から除外
# pijulが記録しているパスのうち`*.gpg`にマッチするもの (pijul listが変わってるのでtracked_globとは重複しない)
gpg_tracked=$(pijul list | grep '\.gpg$' | sed 's/\.gpg$//')
: "↓debug gpg_tracked↓
$gpg_tracked"
# 秘密にしなければいけないファイルたち
will_be_encrypted="$tracked_glob
$gpg_tracked"
# 秘密のファイルに変更があれば暗号化し直す
for path in $will_be_encrypted; do
  if [ ! -f "$path" ]; then
    [ "$path" = ".encrypt.d/master_key" ] || pijul remove "$path.gpg"
  else
    if [ -f "$path.gpg" ] &&
      [ "$($sha256sum <"$path")" != "$(decrypt "$path.gpg" | $sha256sum)" ]; then
      rm "$path.gpg"
    fi
    if [ ! -e "$path.gpg" ]; then
      encrypt "$path"
    fi
    pijul add "$path.gpg"
  fi
done

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
[ "$*" ] || {
  echo 'Please supply the recipients fingerprints as arguments.' >&2
  false
}
mkdir -p .encrypt.d/recipient/
for recipient in "$@"; do
  gpg --armor --export "$recipient" >".encrypt.d/recipient/$recipient.asc"
done
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 're-encrypting master key...'
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --sign --encrypt \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) \
      --output .encrypt.d/master_key.gpg.tmp
  mv .encrypt.d/master_key.gpg.tmp .encrypt.d/master_key.gpg
  echo 'done'
fi