1inguini/pijul-encrypt - Change JZOUKME477D7QIZ63OXC4AJWF52PS7YIS55H4PEC5QMMOGQUJ5SQC

ファイルが2重に記録されてるの直るか?

Created by 1inguini on March 12, 2025

JZOUKME477D7QIZ63OXC4AJWF52PS7YIS55H4PEC5QMMOGQUJ5SQC

Dependencies

In channels

main

Change contents

File deletion: hello
BF:BFD[4.1] → [5.0:16]
BF:BFD[5.16] → [5.17:17]
File deletion: secret
BF:BFD[5.17] → [5.19:36]
BF:BFD[5.36] → [5.37:37]
File deletion: world
BF:BFD[5.37] → [5.39:55]
BF:BFD[5.55] → [5.56:56]

File deletion: README.md

BF:BFD[4.1] → [6.0:33]

BF:BFD[6.33] → [6.34:34]

B:BD[6.34] → [6.35:52]

B:BD[6.52] → [3.0:872]

# pijul-encrypt
Pijul hook to encrypt files using GnuPG in Pijul repositry before recording.
Add globs matching paths you want to encrypt to `.encrypt`.
Register your and collaborators GnuPG public key using `.pijul/encrypt/add-recipients.sh`.
Files will be encrypted both asymmetricaly and symmetricaly.
Symmetric key can be retrieved by decrypting `.encrypt.d/master_key.gpg`.
GnuPGでrecord前にファイルを暗号化するPijulフック。
`.encrypt`に記入したグロブパターンにマッチするファイルを暗号化します。
`.pijul/encrypt/add-recipients.sh`で自分や共同編集者のGnuPG公開鍵を登録できます。
ファイルは公開鍵暗号と共通鍵暗号の両方で暗号化されます。
共通鍵は `.encrypt.d/master_key.gpg`を復号することで確認できます。
``` toml
[hooks]
record = [".pijul/encrypt/hook-record.sh"]
```

File deletion: .pijul
BF:BFD[4.1] → [5.923:940]
BF:BFD[5.940] → [5.941:941]
File deletion: encrypt
BF:BFD[5.941] → [5.943:961]
BF:BFD[5.961] → [5.962:962]

File deletion: add-recipients.sh

BF:BFD[5.962] → [5.4094:4135]

BF:BFD[5.4135] → [5.4136:4136]

B:BD[5.4136] → [5.4137:4863]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
[ "$*" ] || {
  echo 'Please supply the recipients fingerprints as arguments.' >&2
  false
}
mkdir -p .encrypt.d/recipient/
for recipient in "$@"; do
  gpg --armor --export "$recipient" >".encrypt.d/recipient/$recipient.asc"
done
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 're-encrypting master key...'
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --sign --encrypt \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) \
      --output .encrypt.d/master_key.gpg.tmp
  mv .encrypt.d/master_key.gpg.tmp .encrypt.d/master_key.gpg
  echo 'done'
fi

File deletion: hook-record.sh

BF:BFD[5.962] → [5.1987:2025]

BF:BFD[5.2025] → [5.2026:2026]

B:BD[5.2026] → [5.2027:4093]

#!/bin/sh
. .pijul/encrypt/scripts.sh
if ! sha256sum=$(command -v sha256sum) >/dev/null; then
  echo "$0 requires sha256sum" >&2
  false
fi
if [ ! -f .encrypt.d/master_key.gpg ]; then
  echo "No master key in repositry. Repositry not initialized for pijul-encrypt" >&2
  false
fi
encrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --passphrase-fd 0 \
      --sign --encrypt --symmetric \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) "$path"
}
decrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --output - --passphrase-fd 0 \
      --decrypt "$path"
}
# globを展開、マッチするディレクトリの中身も全部マッチしたいのでfindを噛ませる
# shellcheck disable=SC2046
worktree_glob=$(find $(cat .encrypt) -type f -not -name '*.gpg')
: "↓debug worktree_glob↓
$worktree_glob"
# pijulが記録しているパスのうち`.encrypt`にマッチするもの
# shellcheck disable=SC2086
# shellcheck disable=SC2046
tracked_glob=$(printf '%s\n' $worktree_glob $(pijul list) | sort | uniq -d)
: "↓debug tracked_glob↓
$tracked_glob"
# shellcheck disable=SC2086
pijul remove $tracked_glob # 秘密のファイルはさっさと記録から除外
# pijulが記録しているパスのうち`*.gpg`にマッチするもの (pijul listが変わってるのでtracked_globとは重複しない)
gpg_tracked=$(pijul list | grep '\.gpg$' | sed 's/\.gpg$//')
: "↓debug gpg_tracked↓
$gpg_tracked"
# 秘密にしなければいけないファイルたち
will_be_encrypted="$tracked_glob
$gpg_tracked"
# 秘密のファイルに変更があれば暗号化し直す
for path in $will_be_encrypted; do
  if [ ! -f "$path" ]; then
    [ "$path" = ".encrypt.d/master_key" ] || pijul remove "$path.gpg"
  else
    if [ -f "$path.gpg" ] &&
      [ "$($sha256sum <"$path")" != "$(decrypt "$path.gpg" | $sha256sum)" ]; then
      rm "$path.gpg"
    fi
    if [ ! -e "$path.gpg" ]; then
      encrypt "$path"
    fi
    pijul add "$path.gpg"
  fi
done

File deletion: init.sh

BF:BFD[5.962] → [5.1113:1144]

BF:BFD[5.1144] → [5.1145:1145]

B:BD[5.1145] → [5.1146:1986]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 'pijul-encrypt already configured!'
  false
fi
recipients="$*"
[ "$recipients" ] || {
  echo 'Specify recipients fingerprints.'
  read -r recipients
}
(
  IFS=' '
  .pijul/encrypt/add-recipients.sh $recipients
)
echo 'generating master key...'
master_key=$($gpg --armor --gen-random 16 512)
echo "master key generated: $master_key"
printf %s "$master_key" | $gpg --batch --sign --encrypt \
  $(printf -- '--recipient-file\n%s\n' .encrypt.d/recipient/*.asc) \
  --output .encrypt.d/master_key.gpg
echo "Now add .pijul/encrypt/hook-record.sh to record hook.
edit .pijul/config as below:
\`\`\`
[hooks]
record = ['.pijul/encrypt/hook-record.sh']
\`\`\`
"

File deletion: scripts.sh
BF:BFD[5.962] → [5.964:998]
BF:BFD[5.998] → [5.999:999]
B:BD[5.999] → [5.1000:1112]
```
#!/bin/sh
set -e
IFS='
'
if ! gpg=$(command -v gpg2) >/dev/null; then
  echo "$0 requires gpg2" >&2
  false
fi
```
File deletion: .ignore
BF:BFD[4.1] → [5.4864:4895]
BF:BFD[5.4895] → [5.4896:4896]
B:BD[5.4896] → [5.4897:4911]
```
.git
.DS_Store
```
File deletion: .encrypt.d
BF:BFD[4.1] → [5.4912:4933]
BF:BFD[5.4933] → [5.4934:4934]
File deletion: master_key.gpg
BF:BFD[5.4934] → [5.6336:6381]
BF:BFD[5.6381] → [5.6382:6382]
B:BD[5.6382] → [5.6383:7330]
File deletion: recipient
BF:BFD[5.4934] → [5.4936:4956]
BF:BFD[5.4956] → [5.4957:4957]

File deletion: 709D50D8B911D7803BBEB84B49333C087767B9C1.asc

BF:BFD[5.4957] → [5.4959:5027]

BF:BFD[5.5027] → [5.5028:5028]

B:BD[5.5028] → [5.5029:6335]

File deletion: .encrypt
BF:BFD[4.1] → [5.7331:7363]
BF:BFD[5.7363] → [5.7364:7364]
B:BD[5.7364] → [6.122:133]
```
**/secret/*
```
File deletion: .pijul
BF:BFD[7.1] → [2.0:17]
BF:BFD[2.17] → [2.18:18]
File deletion: encrypt
BF:BFD[2.18] → [2.20:38]
BF:BFD[2.38] → [2.39:39]

File deletion: add-recipients.sh

BF:BFD[2.39] → [2.3179:3220]

BF:BFD[2.3220] → [2.3221:3221]

B:BD[2.3221] → [2.3222:3948]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
[ "$*" ] || {
  echo 'Please supply the recipients fingerprints as arguments.' >&2
  false
}
mkdir -p .encrypt.d/recipient/
for recipient in "$@"; do
  gpg --armor --export "$recipient" >".encrypt.d/recipient/$recipient.asc"
done
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 're-encrypting master key...'
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --sign --encrypt \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) \
      --output .encrypt.d/master_key.gpg.tmp
  mv .encrypt.d/master_key.gpg.tmp .encrypt.d/master_key.gpg
  echo 'done'
fi

File deletion: hook-record.sh

BF:BFD[2.39] → [2.1064:1102]

BF:BFD[2.1102] → [2.1103:1103]

B:BD[2.1103] → [2.1104:3178]

#!/bin/sh
. .pijul/encrypt/scripts.sh
if ! sha256sum=$(command -v sha256sum) >/dev/null; then
  echo "$0 requires sha256sum" >&2
  false
fi
if [ ! -f .encrypt.d/master_key.gpg ]; then
  echo "No master key in repositry. Repositry not initialized for pijul-encrypt" >&2
  false
fi
encrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --passphrase-fd 0 \
      --sign --encrypt --symmetric \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) "$path"
}
decrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --output - --passphrase-fd 0 \
      --decrypt "$path"
}
# globを展開、マッチするディレクトリの中身も全部マッチしたいのでfindを噛ませる
# shellcheck disable=SC2046
worktree_glob=$(find $(cat .encrypt) -type f -not -name '*.gpg' || true)
: "↓debug worktree_glob↓
$worktree_glob"
# pijulが記録しているパスのうち`.encrypt`にマッチするもの
# shellcheck disable=SC2086
# shellcheck disable=SC2046
tracked_glob=$(printf '%s\n' $worktree_glob $(pijul list) | sort | uniq -d)
: "↓debug tracked_glob↓
$tracked_glob"
# shellcheck disable=SC2086
pijul remove $tracked_glob # 秘密のファイルはさっさと記録から除外
# pijulが記録しているパスのうち`*.gpg`にマッチするもの (pijul listが変わってるのでtracked_globとは重複しない)
gpg_tracked=$(pijul list | grep '\.gpg$' | sed 's/\.gpg$//')
: "↓debug gpg_tracked↓
$gpg_tracked"
# 秘密にしなければいけないファイルたち
will_be_encrypted="$tracked_glob
$gpg_tracked"
# 秘密のファイルに変更があれば暗号化し直す
for path in $will_be_encrypted; do
  if [ ! -f "$path" ]; then
    [ "$path" = ".encrypt.d/master_key" ] || pijul remove "$path.gpg"
  else
    if [ -f "$path.gpg" ] &&
      [ "$($sha256sum <"$path")" != "$(decrypt "$path.gpg" | $sha256sum)" ]; then
      rm "$path.gpg"
    fi
    if [ ! -e "$path.gpg" ]; then
      encrypt "$path"
    fi
    pijul add "$path.gpg"
  fi
done

File deletion: init.sh

BF:BFD[2.39] → [2.190:221]

BF:BFD[2.221] → [2.222:222]

B:BD[2.222] → [2.223:1063]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 'pijul-encrypt already configured!'
  false
fi
recipients="$*"
[ "$recipients" ] || {
  echo 'Specify recipients fingerprints.'
  read -r recipients
}
(
  IFS=' '
  .pijul/encrypt/add-recipients.sh $recipients
)
echo 'generating master key...'
master_key=$($gpg --armor --gen-random 16 512)
echo "master key generated: $master_key"
printf %s "$master_key" | $gpg --batch --sign --encrypt \
  $(printf -- '--recipient-file\n%s\n' .encrypt.d/recipient/*.asc) \
  --output .encrypt.d/master_key.gpg
echo "Now add .pijul/encrypt/hook-record.sh to record hook.
edit .pijul/config as below:
\`\`\`
[hooks]
record = ['.pijul/encrypt/hook-record.sh']
\`\`\`
"

File deletion: scripts.sh

BF:BFD[2.39] → [2.41:75]

BF:BFD[2.75] → [2.76:76]

B:BD[2.76] → [2.77:189]

#!/bin/sh
set -e
IFS='
'
if ! gpg=$(command -v gpg2) >/dev/null; then
  echo "$0 requires gpg2" >&2
  false
fi

File addition: secret (d--x------)
[7.1]
File addition: Lorem ipsum.txt.gpg (----------)
[0.18]
File addition: Hello World.txt.gpg (----------)
[0.18]

File addition: README.md (----------)

[7.1]

# pijul-encrypt
Pijul hook to encrypt files using GnuPG in Pijul repositry before recording.
Add globs matching paths you want to encrypt to `.encrypt`.
Register your and collaborators GnuPG public key using `.pijul/encrypt/add-recipients.sh`.
Files will be encrypted both asymmetricaly and symmetricaly.
Symmetric key can be retrieved by decrypting `.encrypt.d/master_key.gpg`.
GnuPGでrecord前にファイルを暗号化するPijulフック。
`.encrypt`に記入したグロブパターンにマッチするファイルを暗号化します。
`.pijul/encrypt/add-recipients.sh`で自分や共同編集者のGnuPG公開鍵を登録できます。
ファイルは公開鍵暗号と共通鍵暗号の両方で暗号化されます。
共通鍵は `.encrypt.d/master_key.gpg`を復号することで確認できます。
``` toml
[hooks]
record = [".pijul/encrypt/hook-record.sh"]
```
Master key for this example repositry.
例示のためのこのレポジトリのマスターキー
```
eb40d77797be122260be7b0be5c78f664235b973093c5f9baa3c1461d5ce370dfb02ec3ee30c80cdd37b1984fc5881a4baef71258a58b915c1c4bb326a498065cc03de58b798867f0e08dbb62b76d4ab270c936c19baf07498f0b5da53a42671796d65644de1c74f1ce8b8415865cf52ec78c8d2482018b641c5343c4aee6c1b88bc6b6ed5cf2d2df5a74631d311f37b2990a17988e4dd4d3ca1de4e8ca600c2b1cd9f9763e3bdd5b63d69eefa33158a6d457a75b206b30520dfc24e201e3f62161d50458a16139db1fcde54b38f3c7d66954d6a39bd604b112097739964a3d5c817fcaefc3f987003da3521759f703b71766d214c1bd3067baebb9bfbbb42bdd0af269a280ece5860905d0b691cde59b4ad00551abc1b48d82e40b74efcf2c9ae81dd8141a1f702c15c85c9accafcf1fe10b662b405aae3cf7c4aee999005a587d3199309a220fb83b6d56869b04521d056a9f616c19bd435df3243e0e6c33973e602e050c774de38f6b04c088181aefa8782f5f7dcf9e45f4cb3b42503c8e5130ac301a6cfad376529fce930ea331f8801cd3136e42d4818d2544cae239e81c5c695dde98b92a63881972b37704e7449639d68533a3c5ec0e2831755ea28c58ec8ddef051c3eec4dd35d7bd536f90c34879dcff9370a9a5fd6644199181d2fc451dec2971647faa241fc419d1c2ca44f6f40de90fbc1e088bce54d23799e3a
```

File addition: .pijul (d--x------)
[7.1]
File addition: encrypt (d--x------)
[0.3288]

File addition: scripts.sh (----------)

[0.3309]

#!/bin/sh
set -e
IFS='
'
if ! gpg=$(command -v gpg2) >/dev/null; then
  echo "$0 requires gpg2" >&2
  false
fi

File addition: init.sh (---x------)

[0.3309]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 'pijul-encrypt already configured!'
  false
fi
recipients="$*"
[ "$recipients" ] || {
  echo 'Specify recipients fingerprints.'
  read -r recipients
}
(
  IFS=' '
  .pijul/encrypt/add-recipients.sh $recipients
)
echo 'generating master key...'
master_key=$($gpg --armor --gen-random 16 512)
echo "master key generated: $master_key"
printf %s "$master_key" | $gpg --batch --sign --encrypt \
  $(printf -- '--recipient-file\n%s\n' .encrypt.d/recipient/*.asc) \
  --output .encrypt.d/master_key.gpg
echo "Now add .pijul/encrypt/hook-record.sh to record hook.
edit .pijul/config as below:
\`\`\`
[hooks]
record = ['.pijul/encrypt/hook-record.sh']
\`\`\`
"

File addition: hook-record.sh (---x------)

[0.3309]

#!/bin/sh
. .pijul/encrypt/scripts.sh
if ! sha256sum=$(command -v sha256sum) >/dev/null; then
  echo "$0 requires sha256sum" >&2
  false
fi
if [ ! -f .encrypt.d/master_key.gpg ]; then
  echo "No master key in repositry. Repositry not initialized for pijul-encrypt" >&2
  false
fi
encrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --passphrase-fd 0 \
      --sign --encrypt --symmetric \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) "$path"
}
decrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --output - --passphrase-fd 0 \
      --decrypt "$path"
}
# globを展開、マッチするディレクトリの中身も全部マッチしたいのでfindを噛ませる
# shellcheck disable=SC2046
worktree_glob=$(find $(cat .encrypt) -type f -not -name '*.gpg' || true)
: "↓debug worktree_glob↓
$worktree_glob"
# pijulが記録しているパスのうち`.encrypt`にマッチするもの
# shellcheck disable=SC2086
# shellcheck disable=SC2046
tracked_glob=$(printf '%s\n' $worktree_glob $(pijul list) | sort | uniq -d)
: "↓debug tracked_glob↓
$tracked_glob"
# shellcheck disable=SC2086
pijul remove $tracked_glob # 秘密のファイルはさっさと記録から除外
# pijulが記録しているパスのうち`*.gpg`にマッチするもの (pijul listが変わってるのでtracked_globとは重複しない)
gpg_tracked=$(pijul list | grep '\.gpg$' | sed 's/\.gpg$//')
: "↓debug gpg_tracked↓
$gpg_tracked"
# 秘密にしなければいけないファイルたち
will_be_encrypted="$tracked_glob
$gpg_tracked"
# 秘密のファイルに変更があれば暗号化し直す
for path in $will_be_encrypted; do
  if [ ! -f "$path" ]; then
    [ "$path" = ".encrypt.d/master_key" ] || pijul remove "$path.gpg"
  else
    if [ -f "$path.gpg" ] &&
      [ "$($sha256sum <"$path")" != "$(decrypt "$path.gpg" | $sha256sum)" ]; then
      rm "$path.gpg"
    fi
    if [ ! -e "$path.gpg" ]; then
      encrypt "$path"
    fi
    pijul add "$path.gpg"
  fi
done

File addition: add-recipients.sh (---x------)

[0.3309]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
[ "$*" ] || {
  echo 'Please supply the recipients fingerprints as arguments.' >&2
  false
}
mkdir -p .encrypt.d/recipient/
for recipient in "$@"; do
  gpg --armor --export "$recipient" >".encrypt.d/recipient/$recipient.asc"
done
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 're-encrypting master key...'
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --sign --encrypt \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) \
      --output .encrypt.d/master_key.gpg.tmp
  mv .encrypt.d/master_key.gpg.tmp .encrypt.d/master_key.gpg
  echo 'done'
fi

File addition: .ignore (----------)
[7.1]
```
.git
.DS_Store
```
File addition: .encrypt.d (d--x------)
[7.1]
File addition: recipient (d--x------)
[0.7289]

File addition: 709D50D8B911D7803BBEB84B49333C087767B9C1.asc (----------)

[0.7312]

File addition: master_key.gpg (----------)
[0.7289]
File addition: .encrypt (----------)
[7.1]
```
secret/*
```
File addition: Lorem ipsum.txt.gpg (----------)
[0.18]
File addition: Hello World.txt.gpg (----------)
[0.18]

File addition: README.md (----------)

[4.1]

# pijul-encrypt
Pijul hook to encrypt files using GnuPG in Pijul repositry before recording.
Add globs matching paths you want to encrypt to `.encrypt`.
Register your and collaborators GnuPG public key using `.pijul/encrypt/add-recipients.sh`.
Files will be encrypted both asymmetricaly and symmetricaly.
Symmetric key can be retrieved by decrypting `.encrypt.d/master_key.gpg`.
GnuPGでrecord前にファイルを暗号化するPijulフック。
`.encrypt`に記入したグロブパターンにマッチするファイルを暗号化します。
`.pijul/encrypt/add-recipients.sh`で自分や共同編集者のGnuPG公開鍵を登録できます。
ファイルは公開鍵暗号と共通鍵暗号の両方で暗号化されます。
共通鍵は `.encrypt.d/master_key.gpg`を復号することで確認できます。
``` toml
[hooks]
record = [".pijul/encrypt/hook-record.sh"]
```
Master key for this example repositry.
例示のためのこのレポジトリのマスターキー
```
eb40d77797be122260be7b0be5c78f664235b973093c5f9baa3c1461d5ce370dfb02ec3ee30c80cdd37b1984fc5881a4baef71258a58b915c1c4bb326a498065cc03de58b798867f0e08dbb62b76d4ab270c936c19baf07498f0b5da53a42671796d65644de1c74f1ce8b8415865cf52ec78c8d2482018b641c5343c4aee6c1b88bc6b6ed5cf2d2df5a74631d311f37b2990a17988e4dd4d3ca1de4e8ca600c2b1cd9f9763e3bdd5b63d69eefa33158a6d457a75b206b30520dfc24e201e3f62161d50458a16139db1fcde54b38f3c7d66954d6a39bd604b112097739964a3d5c817fcaefc3f987003da3521759f703b71766d214c1bd3067baebb9bfbbb42bdd0af269a280ece5860905d0b691cde59b4ad00551abc1b48d82e40b74efcf2c9ae81dd8141a1f702c15c85c9accafcf1fe10b662b405aae3cf7c4aee999005a587d3199309a220fb83b6d56869b04521d056a9f616c19bd435df3243e0e6c33973e602e050c774de38f6b04c088181aefa8782f5f7dcf9e45f4cb3b42503c8e5130ac301a6cfad376529fce930ea331f8801cd3136e42d4818d2544cae239e81c5c695dde98b92a63881972b37704e7449639d68533a3c5ec0e2831755ea28c58ec8ddef051c3eec4dd35d7bd536f90c34879dcff9370a9a5fd6644199181d2fc451dec2971647faa241fc419d1c2ca44f6f40de90fbc1e088bce54d23799e3a
```

File addition: scripts.sh (----------)

[0.3309]

#!/bin/sh
set -e
IFS='
'
if ! gpg=$(command -v gpg2) >/dev/null; then
  echo "$0 requires gpg2" >&2
  false
fi

File addition: init.sh (---x------)

[0.3309]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 'pijul-encrypt already configured!'
  false
fi
recipients="$*"
[ "$recipients" ] || {
  echo 'Specify recipients fingerprints.'
  read -r recipients
}
(
  IFS=' '
  .pijul/encrypt/add-recipients.sh $recipients
)
echo 'generating master key...'
master_key=$($gpg --armor --gen-random 16 512)
echo "master key generated: $master_key"
printf %s "$master_key" | $gpg --batch --sign --encrypt \
  $(printf -- '--recipient-file\n%s\n' .encrypt.d/recipient/*.asc) \
  --output .encrypt.d/master_key.gpg
echo "Now add .pijul/encrypt/hook-record.sh to record hook.
edit .pijul/config as below:
\`\`\`
[hooks]
record = ['.pijul/encrypt/hook-record.sh']
\`\`\`
"

File addition: hook-record.sh (---x------)

[0.3309]

#!/bin/sh
. .pijul/encrypt/scripts.sh
if ! sha256sum=$(command -v sha256sum) >/dev/null; then
  echo "$0 requires sha256sum" >&2
  false
fi
if [ ! -f .encrypt.d/master_key.gpg ]; then
  echo "No master key in repositry. Repositry not initialized for pijul-encrypt" >&2
  false
fi
encrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --passphrase-fd 0 \
      --sign --encrypt --symmetric \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) "$path"
}
decrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --output - --passphrase-fd 0 \
      --decrypt "$path"
}
# globを展開、マッチするディレクトリの中身も全部マッチしたいのでfindを噛ませる
# shellcheck disable=SC2046
worktree_glob=$(find $(cat .encrypt) -type f -not -name '*.gpg' || true)
: "↓debug worktree_glob↓
$worktree_glob"
# pijulが記録しているパスのうち`.encrypt`にマッチするもの
# shellcheck disable=SC2086
# shellcheck disable=SC2046
tracked_glob=$(printf '%s\n' $worktree_glob $(pijul list) | sort | uniq -d)
: "↓debug tracked_glob↓
$tracked_glob"
# shellcheck disable=SC2086
pijul remove $tracked_glob # 秘密のファイルはさっさと記録から除外
# pijulが記録しているパスのうち`*.gpg`にマッチするもの (pijul listが変わってるのでtracked_globとは重複しない)
gpg_tracked=$(pijul list | grep '\.gpg$' | sed 's/\.gpg$//')
: "↓debug gpg_tracked↓
$gpg_tracked"
# 秘密にしなければいけないファイルたち
will_be_encrypted="$tracked_glob
$gpg_tracked"
# 秘密のファイルに変更があれば暗号化し直す
for path in $will_be_encrypted; do
  if [ ! -f "$path" ]; then
    [ "$path" = ".encrypt.d/master_key" ] || pijul remove "$path.gpg"
  else
    if [ -f "$path.gpg" ] &&
      [ "$($sha256sum <"$path")" != "$(decrypt "$path.gpg" | $sha256sum)" ]; then
      rm "$path.gpg"
    fi
    if [ ! -e "$path.gpg" ]; then
      encrypt "$path"
    fi
    pijul add "$path.gpg"
  fi
done

File addition: add-recipients.sh (---x------)

[0.3309]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
[ "$*" ] || {
  echo 'Please supply the recipients fingerprints as arguments.' >&2
  false
}
mkdir -p .encrypt.d/recipient/
for recipient in "$@"; do
  gpg --armor --export "$recipient" >".encrypt.d/recipient/$recipient.asc"
done
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 're-encrypting master key...'
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --sign --encrypt \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) \
      --output .encrypt.d/master_key.gpg.tmp
  mv .encrypt.d/master_key.gpg.tmp .encrypt.d/master_key.gpg
  echo 'done'
fi

File addition: .ignore (----------)
[4.1]
```
.git
.DS_Store
```

File addition: 709D50D8B911D7803BBEB84B49333C087767B9C1.asc (----------)

[0.7312]

File addition: master_key.gpg (----------)
[0.7289]
File addition: .encrypt (----------)
[4.1]
```
secret/*
```

ファイルが2重に記録されてるの直るか?

Dependencies

In channels

Change contents

File deletion: hello

File deletion: secret

File deletion: world

File deletion: README.md

File deletion: .pijul

File deletion: encrypt

File deletion: add-recipients.sh

File deletion: hook-record.sh

File deletion: init.sh

File deletion: scripts.sh

File deletion: .ignore

File deletion: .encrypt.d

File deletion: master_key.gpg

File deletion: recipient

File deletion: 709D50D8B911D7803BBEB84B49333C087767B9C1.asc

File deletion: .encrypt

File deletion: .pijul

File deletion: encrypt

File deletion: add-recipients.sh

File deletion: hook-record.sh

File deletion: init.sh

File deletion: scripts.sh

File addition: secret (d--x------)

File addition: Lorem ipsum.txt.gpg (----------)

File addition: Hello World.txt.gpg (----------)

File addition: README.md (----------)

File addition: .pijul (d--x------)

File addition: encrypt (d--x------)

File addition: scripts.sh (----------)

File addition: init.sh (---x------)

File addition: hook-record.sh (---x------)

File addition: add-recipients.sh (---x------)

File addition: .ignore (----------)

File addition: .encrypt.d (d--x------)

File addition: recipient (d--x------)

File addition: 709D50D8B911D7803BBEB84B49333C087767B9C1.asc (----------)

File addition: master_key.gpg (----------)

File addition: .encrypt (----------)

File addition: Lorem ipsum.txt.gpg (----------)

File addition: Hello World.txt.gpg (----------)

File addition: README.md (----------)

File addition: scripts.sh (----------)

File addition: init.sh (---x------)

File addition: hook-record.sh (---x------)

File addition: add-recipients.sh (---x------)

File addition: .ignore (----------)

File addition: 709D50D8B911D7803BBEB84B49333C087767B9C1.asc (----------)

File addition: master_key.gpg (----------)

File addition: .encrypt (----------)