1inguini/pijul-encrypt - Change MVH4Z55GJ75LXJNTYNSCZDG4WG42QYBLRMZMEZYTLTZ6JDI4JGUQC

わけわからん、ちゃんと動いてるかこれ?

Created by 1inguini on March 12, 2025

MVH4Z55GJ75LXJNTYNSCZDG4WG42QYBLRMZMEZYTLTZ6JDI4JGUQC

Dependencies

In channels

main

Change contents

File deletion: hello
BF:BFD[3.1] → [4.0:16]
BF:BFD[4.16] → [4.17:17]
File deletion: secret
BF:BFD[4.17] → [4.19:36]
BF:BFD[4.36] → [4.37:37]
File deletion: hello.gpg
BF:BFD[4.37] → [4.311:351]
BF:BFD[4.351] → [4.352:352]
B:BD[4.352] → [5.0:388]
File deletion: world
BF:BFD[4.37] → [4.39:55]
BF:BFD[4.55] → [4.56:56]
File deletion: hello.gpg
BF:BFD[4.56] → [4.58:98]
BF:BFD[4.98] → [4.99:99]
B:BD[4.99] → [6.0:388]
File deletion: .pijul
BF:BFD[3.1] → [7.0:17]
BF:BFD[7.17] → [7.18:18]
File deletion: config
BF:BFD[7.18] → [7.1883:1913]
BF:BFD[7.1913] → [7.1914:1914]
B:BD[7.1914] → [7.1915:1923]
B:BD[7.1923] → [8.47:90]
```
[hooks]
record = ['.pijul/encrypt/hook-record.sh']
```
File deletion: encrypt
BF:BFD[7.18] → [8.0:18]
BF:BFD[8.18] → [8.19:19]

File deletion: add-recipients.sh

BF:BFD[8.19] → [5.1629:1670]

BF:BFD[5.1670] → [5.1671:1671]

B:BD[5.1671] → [5.1672:2037]

B:BD[5.2037] → [6.872:1110]

∅:D[2.106] → [6.1151:1168]

B:BD[6.1151] → [6.1151:1168]

B:BD[6.1110] → [2.0:106]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
[ "$*" ] || {
  echo 'Please supply the recipients fingerprints as arguments.' >&2
  false
}
mkdir -p .encrypt.d/recipient/
for recipient in "$@"; do
  gpg --armor --export "$recipient" >".encrypt.d/recipient/$recipient.asc"
done
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 're-encrypting master key...'
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --sign --encrypt \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) \
  echo 'done'
fi
      --output .encrypt.d/master_key.gpg.tmp
  mv .encrypt.d/master_key.gpg.tmp .encrypt.d/master_key.gpg

File deletion: init.sh

BF:BFD[8.19] → [5.538:569]

BF:BFD[5.569] → [5.570:570]

B:BD[5.570] → [5.571:1089]

∅:D[6.833] → [5.1177:1246]

B:BD[5.1177] → [5.1177:1246]

∅:D[6.871] → [5.1320:1478]

B:BD[5.1320] → [5.1320:1478]

B:BD[5.1246] → [6.834:871]

B:BD[5.1089] → [6.775:833]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 'pijul-encrypt already configured!'
  false
fi
recipients="$*"
[ "$recipients" ] || {
  echo 'Specify recipients fingerprints.'
  read -r recipients
}
(
  IFS=' '
  .pijul/encrypt/add-recipients.sh $recipients
)
echo 'generating master key...'
master_key=$($gpg --armor --gen-random 16 512)
echo "master key generated: $master_key"
  $(printf -- '--recipient-file\n%s\n' .encrypt.d/recipient/*.asc) \
echo "Now add .pijul/encrypt/hook-record.sh to record hook.
edit .pijul/config as below:
\`\`\`
[hooks]
record = ['.pijul/encrypt/hook-record.sh']
\`\`\`
"
  --output .encrypt.d/master_key.gpg
printf %s "$master_key" | $gpg --batch --sign --encrypt \

File deletion: scripts.sh
BF:BFD[8.19] → [5.389:423]
BF:BFD[5.423] → [5.424:424]
B:BD[5.424] → [5.425:537]
```
#!/bin/sh
set -e
IFS='
'
if ! gpg=$(command -v gpg2) >/dev/null; then
  echo "$0 requires gpg2" >&2
  false
fi
```

File deletion: hook-record.sh, hook-encrypt.sh

BF:BFD[8.19] → [8.21:46]

BF:BFD[8.46] → [7.60:60]

BFD:BFD[7.18] → [7.20:59]

BF:BFD[7.59] → [7.60:60]

B:BD[7.60] → [7.61:71]

B:BD[7.141] → [7.141:142]

∅:D[5.1507] → [7.228:229]

B:BD[7.228] → [7.228:229]

∅:D[4.927] → [7.339:581]

B:BD[7.339] → [7.339:581]

∅:D[5.1628] → [7.639:642]

B:BD[7.639] → [7.639:642]

∅:D[4.1069] → [7.820:821]

B:BD[7.820] → [7.820:821]

B:BD[7.843] → [7.843:956]

∅:D[4.1208] → [7.1036:1037]

B:BD[7.1036] → [7.1036:1037]

B:BD[7.1095] → [7.1095:1173]

∅:D[4.1384] → [7.1261:1262]

B:BD[7.1261] → [7.1261:1262]

∅:D[4.1497] → [7.1317:1318]

B:BD[7.1317] → [7.1317:1318]

∅:D[4.1745] → [7.1434:1435]

B:BD[7.1434] → [7.1434:1435]

∅:D[4.2256] → [7.1583:1609]

B:BD[7.1583] → [7.1583:1609]

∅:D[4.2262] → [7.1624:1629]

B:BD[7.1624] → [7.1624:1629]

B:BD[7.1609] → [4.2257:2262]

B:BD[7.1435] → [4.1746:2256]

B:BD[7.1318] → [4.1498:1745]

B:BD[7.1262] → [4.1385:1497]

B:BD[7.1173] → [4.1209:1384]

B:BD[7.956] → [4.1070:1208]

B:BD[7.642] → [4.928:1069]

B:BD[7.581] → [5.1508:1628]

B:BD[7.229] → [4.825:927]

B:BD[7.142] → [5.1479:1507]

#!/bin/sh
if [ -f .encrypt/master_key.gpg ]; then
  echo "No master key in repositry. Repositry not initialized for pijul-encrypt" >&2
  false
fi
encrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --passphrase-fd 0 \
}
# globを展開、マッチするディレクトリの中身も全部マッチしたいのでfindを噛ませる
# pijulが記録しているパスのうち`.encrypt`にマッチするもの
    pijul add "$path.gpg"
done
  fi
# 秘密にしなければいけないファイルたち
will_be_encrypted="$tracked_glob
$gpg_tracked"
# 秘密のファイルに変更があれば暗号化し直す
for path in $will_be_encrypted; do
  if [ ! -f "$path" ]; then
    [ "$path" = ".encrypt.d/master_key" ] || pijul remove "$path.gpg"
  else
    if [ -f "$path.gpg" ] &&
      [ "$($sha256sum <"$path")" != "$(decrypt "$path.gpg" | $sha256sum)" ]; then
      rm "$path.gpg"
    fi
    if [ ! -e "$path.gpg" ]; then
      encrypt "$path"
    fi
# pijulが記録しているパスのうち`*.gpg`にマッチするもの (pijul listが変わってるのでtracked_globとは重複しない)
gpg_tracked=$(pijul list | grep '\.gpg$' | sed 's/\.gpg$//')
: "↓debug gpg_tracked↓
$gpg_tracked"
# shellcheck disable=SC2086
pijul remove $tracked_glob # 秘密のファイルはさっさと記録から除外
# shellcheck disable=SC2086
# shellcheck disable=SC2046
tracked_glob=$(printf '%s\n' $worktree_glob $(pijul list) | sort | uniq -d)
: "↓debug tracked_glob↓
$tracked_glob"
# shellcheck disable=SC2046
worktree_glob=$(find $(cat .encrypt) -type f -not -name '*.gpg')
: "↓debug worktree_glob↓
$worktree_glob"
decrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --output - --passphrase-fd 0 \
      --decrypt "$path"
}
      --sign --encrypt --symmetric \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) "$path"
if ! sha256sum=$(command -v sha256sum) >/dev/null; then
  echo "$0 requires sha256sum" >&2
  false
fi
. .pijul/encrypt/scripts.sh

File deletion: Hello World.gpg
BF:BFD[3.1] → [4.566:612]
BF:BFD[4.612] → [4.613:613]
B:BD[4.613] → [6.389:774]
File deletion: .ignore
BF:BFD[3.1] → [7.1965:1996]
BF:BFD[7.1996] → [7.1997:1997]
B:BD[7.1997] → [7.1998:2012]
```
.git
.DS_Store
```
File deletion: .encrypt.d
BF:BFD[3.1] → [7.2013:2034]
BF:BFD[7.2034] → [7.2035:2035]
File deletion: master_key.gpg
BF:BFD[7.2035] → [7.2037:2082]
BF:BFD[7.2082] → [7.2083:2083]
B:BD[7.2083] → [6.1169:1180]
B:BD[6.1180] → [2.107:1043]
File deletion: .encrypt
BF:BFD[3.1] → [7.2186:2218]
BF:BFD[7.2218] → [7.2219:2219]
B:BD[7.2219] → [7.2220:2243]
```
**/secret/*
Hello World
```
File addition: hello (d--x------)
[3.1]
File addition: secret (d--x------)
[0.17]
File addition: world (d--x------)
[0.37]
File addition: hello.gpg (----------)
[0.37]
File addition: Hello World.gpg (----------)
[3.1]
File addition: .pijul (d--x------)
[3.1]
File addition: encrypt (d--x------)
[0.941]

File addition: scripts.sh (----------)

[0.962]

#!/bin/sh
set -e
IFS='
'
if ! gpg=$(command -v gpg2) >/dev/null; then
  echo "$0 requires gpg2" >&2
  false
fi

File addition: init.sh (---x------)

[0.962]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 'pijul-encrypt already configured!'
  false
fi
recipients="$*"
[ "$recipients" ] || {
  echo 'Specify recipients fingerprints.'
  read -r recipients
}
(
  IFS=' '
  .pijul/encrypt/add-recipients.sh $recipients
)
echo 'generating master key...'
master_key=$($gpg --armor --gen-random 16 512)
echo "master key generated: $master_key"
printf %s "$master_key" | $gpg --batch --sign --encrypt \
  $(printf -- '--recipient-file\n%s\n' .encrypt.d/recipient/*.asc) \
  --output .encrypt.d/master_key.gpg
echo "Now add .pijul/encrypt/hook-record.sh to record hook.
edit .pijul/config as below:
\`\`\`
[hooks]
record = ['.pijul/encrypt/hook-record.sh']
\`\`\`
"

File addition: hook-record.sh (---x------)

[0.962]

#!/bin/sh
. .pijul/encrypt/scripts.sh
if ! sha256sum=$(command -v sha256sum) >/dev/null; then
  echo "$0 requires sha256sum" >&2
  false
fi
if [ ! -f .encrypt.d/master_key.gpg ]; then
  echo "No master key in repositry. Repositry not initialized for pijul-encrypt" >&2
  false
fi
encrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --passphrase-fd 0 \
      --sign --encrypt --symmetric \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) "$path"
}
decrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --output - --passphrase-fd 0 \
      --decrypt "$path"
}
# globを展開、マッチするディレクトリの中身も全部マッチしたいのでfindを噛ませる
# shellcheck disable=SC2046
worktree_glob=$(find $(cat .encrypt) -type f -not -name '*.gpg')
: "↓debug worktree_glob↓
$worktree_glob"
# pijulが記録しているパスのうち`.encrypt`にマッチするもの
# shellcheck disable=SC2086
# shellcheck disable=SC2046
tracked_glob=$(printf '%s\n' $worktree_glob $(pijul list) | sort | uniq -d)
: "↓debug tracked_glob↓
$tracked_glob"
# shellcheck disable=SC2086
pijul remove $tracked_glob # 秘密のファイルはさっさと記録から除外
# pijulが記録しているパスのうち`*.gpg`にマッチするもの (pijul listが変わってるのでtracked_globとは重複しない)
gpg_tracked=$(pijul list | grep '\.gpg$' | sed 's/\.gpg$//')
: "↓debug gpg_tracked↓
$gpg_tracked"
# 秘密にしなければいけないファイルたち
will_be_encrypted="$tracked_glob
$gpg_tracked"
# 秘密のファイルに変更があれば暗号化し直す
for path in $will_be_encrypted; do
  if [ ! -f "$path" ]; then
    [ "$path" = ".encrypt.d/master_key" ] || pijul remove "$path.gpg"
  else
    if [ -f "$path.gpg" ] &&
      [ "$($sha256sum <"$path")" != "$(decrypt "$path.gpg" | $sha256sum)" ]; then
      rm "$path.gpg"
    fi
    if [ ! -e "$path.gpg" ]; then
      encrypt "$path"
    fi
    pijul add "$path.gpg"
  fi
done

File addition: add-recipients.sh (---x------)

[0.962]

#!/bin/sh
[ -d .pijul ] || {
  echo 'this directory does not seem to be Pijul repositry.' >&2
  false
}
. .pijul/encrypt/scripts.sh
[ "$*" ] || {
  echo 'Please supply the recipients fingerprints as arguments.' >&2
  false
}
mkdir -p .encrypt.d/recipient/
for recipient in "$@"; do
  gpg --armor --export "$recipient" >".encrypt.d/recipient/$recipient.asc"
done
if [ -f .encrypt.d/master_key.gpg ]; then
  echo 're-encrypting master key...'
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --sign --encrypt \
      $(printf -- "--recipient-file$IFS%s$IFS" .encrypt.d/recipient/*.asc) \
      --output .encrypt.d/master_key.gpg.tmp
  mv .encrypt.d/master_key.gpg.tmp .encrypt.d/master_key.gpg
  echo 'done'
fi

File addition: .ignore (----------)
[3.1]
```
.git
.DS_Store
```
File addition: .encrypt.d (d--x------)
[3.1]
File addition: recipient (d--x------)
[0.4934]

File addition: 709D50D8B911D7803BBEB84B49333C087767B9C1.asc (----------)

[0.4957]

File addition: master_key.gpg (----------)
[0.4934]
File addition: .encrypt (----------)
[3.1]
```
**/secret/*
Hello World
```

わけわからん、ちゃんと動いてるかこれ?

Dependencies

In channels

Change contents

File deletion: hello

File deletion: secret

File deletion: hello.gpg

File deletion: world

File deletion: hello.gpg

File deletion: .pijul

File deletion: config

File deletion: encrypt

File deletion: add-recipients.sh

File deletion: init.sh

File deletion: scripts.sh

File deletion: hook-record.sh, hook-encrypt.sh

File deletion: Hello World.gpg

File deletion: .ignore

File deletion: .encrypt.d

File deletion: master_key.gpg

File deletion: .encrypt

File addition: hello (d--x------)

File addition: secret (d--x------)

File addition: world (d--x------)

File addition: hello.gpg (----------)

File addition: Hello World.gpg (----------)

File addition: .pijul (d--x------)

File addition: encrypt (d--x------)

File addition: scripts.sh (----------)

File addition: init.sh (---x------)

File addition: hook-record.sh (---x------)

File addition: add-recipients.sh (---x------)

File addition: .ignore (----------)

File addition: .encrypt.d (d--x------)

File addition: recipient (d--x------)

File addition: 709D50D8B911D7803BBEB84B49333C087767B9C1.asc (----------)

File addition: master_key.gpg (----------)

File addition: .encrypt (----------)