Skip to content

Commit c37642e

Browse files
ErotemicErotemic
committed
Make my options configurable
1 parent 20263c8 commit c37642e

File tree

6 files changed

+694
-72
lines changed

6 files changed

+694
-72
lines changed

‎.gitattributes‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +0,0 @@
1-
sensitive_file filter=crypt diff=crypt merge=crypt

‎bash_helpers.sh‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
#!/usr/bin/env bash
2+
3+
_is_contained_str(){
4+
__doc__='
5+
Args:
6+
arg : the query to check if it is contained in the values
7+
values : a string of space separated values
8+
9+
Example:
10+
source ~/code/transcrypt/bash_helpers.sh
11+
# Demo using raw call
12+
(_is_contained_str "foo" "foo bar baz" && echo "contained") || echo "missing"
13+
(_is_contained_str "bar" "foo bar baz" && echo "contained") || echo "missing"
14+
(_is_contained_str "baz" "foo bar baz" && echo "contained") || echo "missing"
15+
(_is_contained_str "biz" "foo bar baz" && echo "contained") || echo "missing"
16+
# Demo using variables
17+
arg="bar"
18+
values="foo bar baz"
19+
(_is_contained_str "$arg" "$values" && echo "contained") || echo "missing"
20+
'
21+
arg=$1
22+
values=$2
23+
echo "$values" | tr -s ' ' '\n' | grep -Fx "$arg" &>/dev/null
24+
}
25+
26+
_is_contained_arr(){
27+
__doc__='
28+
Check if the first value is contained the rest of the values
29+
30+
Args:
31+
arg : the query to check if it is contained in the values
32+
*values : the rest of the arguments are individual elements in the values
33+
34+
Example:
35+
source ~/code/transcrypt/bash_helpers.sh
36+
# Demo using raw call
37+
(_is_contained_arr "bar" "foo" "bar" "baz" && echo "contained") || echo "missing"
38+
(_is_contained_arr "biz" "foo" "bar" "baz" && echo "contained") || echo "missing"
39+
# Demo using variables
40+
values=("foo" "bar" "baz")
41+
arg="bar"
42+
(_is_contained_arr "$arg" "${values[@]}" && echo "contained") || echo "missing"
43+
arg="biz"
44+
(_is_contained_arr "$arg" "${values[@]}" && echo "contained") || echo "missing"
45+
'
46+
# The first argument must be equal to one of the subsequent arguments
47+
local arg=$1
48+
shift
49+
local arr=("$@")
50+
for val in "${arr[@]}";
51+
do
52+
if [[ "${arg}" == "${val}" ]]; then
53+
return 0
54+
fi
55+
done
56+
return 1
57+
}
58+
59+
_benchmark_methods(){
60+
arg="sha512"
61+
source ~/code/transcrypt/bash_helpers.sh
62+
time (openssl list -digest-commands | tr -s ' ' '\n' | grep -Fx "$arg")
63+
echo $?
64+
time _is_contained_str "$arg" "$(openssl list -digest-commands)"
65+
echo $?
66+
time (readarray -t available <<< "$(openssl list -digest-commands | tr -s ' ' '\n')" && _is_contained_arr "$arg" "${available[@]}")
67+
echo $?
68+
#bash_array_repr "${available[@]}"
69+
}
70+
71+
72+
joinby(){
73+
__doc__='
74+
A function that works similar to a Python join
75+
76+
Args:
77+
SEP: the separator
78+
*ARR: elements of the strings to join
79+
80+
Usage:
81+
source $HOME/local/init/utils.sh
82+
ARR=("foo" "bar" "baz")
83+
RESULT=$(joinby / "${ARR[@]}")
84+
echo "RESULT = $RESULT"
85+
86+
RESULT = foo/bar/baz
87+
88+
References:
89+
https://stackoverflow.com/questions/1527049/how-can-i-join-elements-of-an-array-in-bash
90+
'
91+
_handle_help "$@" || return 0
92+
local d=${1-} f=${2-}
93+
if shift 2; then
94+
printf %s "$f" "${@/#/$d}"
95+
fi
96+
}
97+
98+
_set_global(){
99+
# sets a bash global variable by name
100+
key=$1
101+
val=$2
102+
printf -v "$key" '%s' "$val"
103+
}
104+
105+
_validate_variable_arr(){
106+
__doc__='
107+
Example:
108+
source bash_helpers.sh
109+
foo="bar"
110+
valid_values=("bar" "biz")
111+
_validate_variable "foo" "${valid_values[@]}"
112+
interactive=1
113+
_validate_variable "blaz" "${valid_values[@]}"
114+
'
115+
local varname=$1
116+
local valid_values=$2
117+
local varval=${!varname}
118+
if ! _is_contained_arr "$varval" "${valid_values[@]}"; then
119+
local valid_values_str
120+
valid_values_str=$(joinby ', ' "${valid_values[@]}")
121+
message=$(printf "%s is %s, but must be one of: %s" "$varname" "$varval" "$valid_values_str")
122+
if [[ $interactive ]]; then
123+
_set_global "$varname" ""
124+
echo "$message"
125+
else
126+
die 1 "$message"
127+
fi
128+
fi
129+
}
130+
131+
132+
_validate_variable_str(){
133+
__doc__='
134+
Checks if the target variable is in the set of valid values.
135+
If it is not, it unsets the target variable, then if not in interactive
136+
mode it calls die.
137+
138+
Args:
139+
varname: name of variable to validate
140+
valid_values: space separated string of valid values
141+
142+
Example:
143+
source bash_helpers.sh
144+
valid_values="bar biz"
145+
foo="bar"
146+
_validate_variable_str "foo" "$valid_values"
147+
interactive=1
148+
blaz=fds
149+
_validate_variable_str "blaz" "$valid_values"
150+
'
151+
local varname=$1
152+
local valid_values=$2
153+
local varval=${!varname}
154+
if ! _is_contained_str "$varval" "$valid_values"; then
155+
message=$(printf '%s is `%s`, but must be one of: %s' "$varname" "$varval" "$valid_values")
156+
if [[ $interactive ]]; then
157+
_set_global "$varname" ""
158+
echo "$message"
159+
else
160+
die 1 "$message"
161+
fi
162+
fi
163+
}
164+
165+
_get_user_input2() {
166+
__doc__='
167+
Helper to prompt the user, store a response, and validate the result
168+
Args:
169+
varname : name of the bash variable to populate
170+
default : the default value to use if the user provides no answer
171+
valid_values: space separated string of valid values
172+
prompt : string to present to the user
173+
174+
Example:
175+
source ~/code/transcrypt/bash_helpers.sh
176+
interactive=1
177+
myvar=
178+
echo "myvar = <$myvar>"
179+
_get_user_input2 "myvar" "a" "a b c" "choose one"
180+
'
181+
local varname=$1
182+
local default=$2
183+
local valid_values=$3
184+
local prompt=$4
185+
186+
while [[ ! ${!varname} ]]; do
187+
local answer=
188+
if [[ $interactive ]]; then
189+
printf '%s > ' "$prompt"
190+
read -r answer
191+
fi
192+
# use the default value if the user gave no answer; otherwise call the
193+
# validate function, which should set the varname to empty if it is
194+
# invalid and the user should continue, otherwise it should die.
195+
if [[ ! $answer ]]; then
196+
_set_global "$varname" "$default"
197+
else
198+
_set_global "$varname" "$answer"
199+
_validate_variable_str "$varname" "$valid_values"
200+
fi
201+
done
202+
}
203+
204+
_openssl_list(){
205+
# Args: the openssl commands to list
206+
__doc__='
207+
source ~/code/transcrypt/bash_helpers.sh
208+
arg=digest-commands
209+
_openssl_list digest-commands
210+
_openssl_list cipher-commands
211+
'
212+
openssl_path=openssl
213+
arg=$1
214+
if "${openssl_path} list-$arg" &>/dev/null; then
215+
# OpenSSL < v1.1.0
216+
"${openssl_path}" "list-$arg"
217+
else
218+
# OpenSSL >= v1.1.0
219+
"${openssl_path}" "list" "-$arg"
220+
fi
221+
}
222+
223+
224+
# shellcheck disable=SC2155
225+
_check_config_poc(){
226+
# Notes on custom config
227+
# https://unix.stackexchange.com/questions/175648/use-config-file-for-my-shell-script
228+
mkdir -p "${VERSIONED_CONFIG_DPATH}"
229+
touch "${VERSIONED_TC_CONFIG}"
230+
git config -f "$VERSIONED_TC_CONFIG" --get transcrypt.cipher
231+
git config -f "$VERSIONED_TC_CONFIG" --get transcrypt.rotating.salt
232+
233+
# POC for using git to store cross-checkout configs
234+
extra_salt=$(openssl rand -hex 32)
235+
git config --file "${VERSIONED_TC_CONFIG}" transcrypt.cipher "aes-256-cbc"
236+
git config --file "${VERSIONED_TC_CONFIG}" transcrypt.use-pbkdf2 "true" --type=bool
237+
git config --file "${VERSIONED_TC_CONFIG}" transcrypt.digest "SHA512"
238+
git config --file "${VERSIONED_TC_CONFIG}" transcrypt.salt-method "auto"
239+
git config --file "${VERSIONED_TC_CONFIG}" transcrypt.extra-salt "${extra_salt}"
240+
}

‎example/end_to_end_example.sh‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#!/bin/bash
2+
__doc__="
3+
A simple demo of transcrypt
4+
"
5+
6+
TMP_DIR=$HOME/tmp/transcrypt-demo
7+
mkdir -p "$TMP_DIR"
8+
rm -rf "$TMP_DIR"
9+
10+
11+
12+
# Make a git repo and add some public content
13+
DEMO_REPO=$TMP_DIR/repo
14+
mkdir -p "$DEMO_REPO"
15+
cd "$DEMO_REPO"
16+
git init
17+
echo "content" > README.md
18+
git add README.md
19+
git commit -m "add readme"
20+
21+
22+
# Create safe directory that we will encrypt
23+
echo "
24+
safe/* filter=crypt diff=crypt merge=crypt
25+
" > .gitattributes
26+
git add .gitattributes
27+
git commit -m "add attributes"
28+
29+
mkdir -p "$DEMO_REPO"/safe
30+
31+
32+
# Configure transcrypt with legacy defaults
33+
transcrypt -c aes-256-cbc -p 'correct horse battery staple' -md MD5 --use-pbkdf2=0 -sm password -y
34+
35+
echo "Secret contents" > "$DEMO_REPO"/safe/secret_file
36+
cat "$DEMO_REPO"/safe/secret_file
37+
38+
git add safe/secret_file
39+
git commit -m "add secret with config1"
40+
transcrypt -s safe/secret_file
41+
42+
43+
# Rekey with more secure settings
44+
transcrypt --rekey -c aes-256-cbc -p 'correct horse battery staple' -md SHA256 --use-pbkdf2=1 -sm password -y
45+
git commit -am "changed crypto settings"
46+
47+
48+
echo "New secret contents" >> "$DEMO_REPO"/safe/secret_file
49+
git commit -am "added secrets"
50+
51+
transcrypt -f -y

‎sensitive_file‎

1.81 KB
Binary file not shown.

‎tests/local_test.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#./transcrypt -F -c aes-256-cbc -p "foobar" -md SHA512 -sm configured --use_pbkdf2=0
2+
./transcrypt -F -c aes-256-cbc -pbkdf2 -p "foobar" -md SHA512 -sm configured
3+
4+
./transcrypt -d
5+
6+
transcrypt --uninstall -y

0 commit comments

Comments
 (0)