dotfiles

Shell, editor and terminal configuration, the tools that go with them, and
szecret, an age-based secret manager whose store lives elsewhere.

History restarts here. What came before was not written to be read by
anyone else, and carried machine names, addresses and an encrypted secret
store; it is kept privately instead. What is left is meant to be safe on
any machine, including one whose owner is not me: see CLAUDE.md for the
rule it is written to.

1 files changed, 307 insertions, 0 deletions

diff --git a/secrets/common.sh b/secrets/common.sh
new file mode 100644
index 0000000..ef1b7b5
--- /dev/null
+++ b/secrets/common.sh
@@ -0,0 +1,307 @@
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+
+exists() { command -v "$1" >/dev/null 2>&1; } # Check if command exists (is in path).
+
+if [[ "$(whoami)" == "root" ]]; then
+    # find out who the normal user is based on $this_dir,
+    # since $this_dir will be somewhere within /Users/<user>/... or /home/<user>/...
+    # and then switch to that user, using exec to avoid forking
+    
+    # Cross-platform user detection
+    user=""
+    
+    # Use uname to detect OS and choose appropriate stat command
+    if command -v stat >/dev/null 2>&1; then
+        if [[ "$(uname)" == "Darwin" ]]; then
+            user="$(stat -f '%Su' "${this_dir}" 2>/dev/null || true)"
+        elif [[ "$(uname)" == "Linux" ]]; then
+            user="$(stat -c '%U' "${this_dir}" 2>/dev/null || true)"
+        else
+            >&2 echo "ERROR: Unsupported OS: $(uname)"
+            exit 1
+        fi
+    fi
+    
+    # Fallback method: Parse user from directory path
+    if [[ -z "${user}" ]]; then
+        # Extract username from path like /Users/username/... or /home/username/...
+        if [[ "$(uname)" == "Darwin" ]] && [[ "${this_dir}" =~ ^/Users/([^/]+) ]]; then
+            user="${BASH_REMATCH[1]}"
+        elif [[ "$(uname)" == "Linux" ]] && [[ "${this_dir}" =~ ^/home/([^/]+) ]]; then
+            user="${BASH_REMATCH[1]}"
+        fi
+    fi
+
+    if [[ -n "${user}" ]]; then
+        if id "${user}" >/dev/null 2>&1; then
+            # exec to avoid forking,
+            # and make sure to use a login shell
+            # propagate all arguments using "$@"
+            # The command structure: su - user -c "command" -- args
+            # - su - user: switch to user with login shell
+            # - -c "command": execute the quoted command
+            # - -- args: separator, everything after -- goes to the command
+            # - "$@": all original script arguments
+            # - \"\$@\": escaped version for the inner command string
+            exec su - "${user}" -c "exec bash -l $0 \"\$@\"" -- "$@"
+            >&2 echo "ERROR: Failed to switch to user ${user}"
+        else
+            >&2 echo "ERROR: Detected user ${user} does not exist"
+        fi
+    else
+        >&2 echo "WARN: Failed to determine user from szecret dir: ${this_dir}"
+    fi
+    >&2 echo "ERROR: Refusing to run szecret as root"
+    exit 1
+fi
+
+if ! exists age ; then
+    >&2 cat <<EOF
+ERROR: age tool not found
+
+Install from: https://github.com/FiloSottile/age
+EOF
+    exit 1
+fi
+
+XDG_DATA_HOME=${XDG_DATA_HOME:-"$HOME/.local/share"}
+
+# Private key directory. Files must be named after their public key (age1...).
+# SZECRET_PRIVATE_KEY can still be used as a full single-file override (mainly for tests).
+private_key_dir="${SZECRET_PRIVATE_KEY_DIR:-${XDG_DATA_HOME}/szecret}"
+
+# The global store and the public key its secrets are encrypted to. This code
+# carries neither: a machine with only these scripts holds no secrets. Looked
+# for in order:
+#
+#   1. SZECRET_STORE / SZECRET_PUBLIC_KEY, if set (tests, or a separate store).
+#   2. store/ and id.pub in ~/.local/share/szecret, beside the private keys.
+#      Normally links into whichever checkout holds the store.
+#
+# With none of these, every command fails with the instructions below.
+szecret_data_dir="${XDG_DATA_HOME}/szecret"
+
+if [[ -n "${SZECRET_STORE:-}" ]]; then
+    store="${SZECRET_STORE}"
+    mkdir -p "${store}"
+elif [[ -d "${szecret_data_dir}/store" ]]; then
+    store="${szecret_data_dir}/store"
+else
+    store=""
+fi
+
+if [[ -n "${SZECRET_PUBLIC_KEY:-}" ]]; then
+    public_key="${SZECRET_PUBLIC_KEY}"
+elif [[ -r "${szecret_data_dir}/id.pub" ]]; then
+    public_key="${szecret_data_dir}/id.pub"
+else
+    public_key="${szecret_data_dir}/id.pub"
+fi
+
+if [[ -z "${store}" || ! -r "${public_key}" ]]; then
+    # `ready` is asked by every interactive shell; a machine with no store is
+    # simply not ready, which needs no explanation each time.
+    if [[ -n "${szecret_quiet:-}" ]]; then
+        exit 1
+    fi
+    >&2 cat <<EOF
+ERROR: no szecret store on this machine.
+
+Looked for ${szecret_data_dir}/store and ${szecret_data_dir}/id.pub.
+Link them to an existing store, point SZECRET_STORE and SZECRET_PUBLIC_KEY at
+one, or start a new one:
+
+    age-keygen -o private
+    pubkey="\$(age-keygen -y private)"
+    mkdir -p ${szecret_data_dir}/store
+    echo "\${pubkey}" > ${szecret_data_dir}/id.pub
+    mv private "${private_key_dir}/\${pubkey}"
+
+EOF
+    exit 1
+fi
+
+key_id="$(cat "${public_key}" 2>/dev/null || true)"
+if [[ -z "$key_id" ]]; then
+    >&2 echo "WARN: Invalid public key: ${public_key}"
+    exit 1
+fi
+
+private_key="${SZECRET_PRIVATE_KEY:-${private_key_dir}/${key_id}}"
+
+file_for() {
+    local name="$1"
+    echo "${store}/${name}.age"
+}
+
+local_key_name() {
+    local local_store_name="$1"
+    echo "local-key-${local_store_name}"
+}
+
+ensure_local_store() {
+    local local_store_name="$1"
+    local local_key_name
+    local local_key_file
+    local_key_name="$(local_key_name "${local_store_name}")"
+    local_key_file="$(file_for "${local_key_name}")"
+
+    if ! [[ -r "${local_key_file}" ]]; then
+        >&2 echo "ERROR: Local store '${local_store_name}' does not exist (key: ${local_key_name})"
+        exit 1
+    fi
+}
+
+get_local_private_key() {
+    local local_store_name="$1"
+    local local_key_name
+    local_key_name="$(local_key_name "${local_store_name}")"
+    "${this_dir}/get.sh" "${local_key_name}"
+}
+
+exists() { command -v "$1" >/dev/null 2>&1; } # Check if command exists (is in path).
+pathadd() { [[ -d "$1" ]] && PATH="$1"$(echo ":$PATH:" | sed "s|:$1:|:|" | sed 's|:$||'); }
+
+ensure_age() {
+    if exists age ; then
+        return
+    fi
+    local bin="${this_dir}/.bin"
+    pathadd "${bin}"
+    if [[ -x "${bin}/age" ]]; then
+        return
+    fi
+    local os
+    local arch
+    os="$(uname)"
+    os=${os,,}
+    arch="$(uname -m)"
+    if [[ "$arch" == "aarch64" ]]; then
+      arch="arm64"
+    elif [[ "$arch" == "x86_64" ]]; then
+      arch="amd64"
+    fi
+    tar="$bin/age.tar.gz"
+    curl -LSsfo "$tar" "https://dl.filippo.io/age/latest?for=${os}/${arch}"
+    tar xf "$tar" -C "$bin" --strip-components=1
+}
+
+private_key_is_setup() {
+    check_legacy_private_key_migration
+    if ! [[ -n "${private_key}" && -r "${private_key}" ]]; then
+        >&2 echo "WARN: Missing age key: ${private_key}"
+    fi
+    [[ -r "${private_key}" ]]
+}
+
+ensure_private_key() {
+    mkdir -p "${private_key_dir}"
+    if private_key_is_setup; then
+        return
+    fi
+
+    if [ ! -t 0 ]; then
+        >&2 echo "ERROR: szecret private key not installed: ${public_key}"
+        exit 1
+    fi
+
+    ensure_age
+    echo -n "Enter age private key ${public_key}: "
+    read -s private_key_value
+    echo
+
+    local derived
+    derived="$(age-keygen -y <<<"${private_key_value}" 2>/dev/null || true)"
+    if [[ "$derived" != "$(cat "${public_key}")" ]]; then
+        >&2 echo "ERROR: Invalid private key (does not match ${public_key})"
+        exit 1
+    fi
+
+    mkdir -p "${private_key_dir}"
+    local target="${private_key_dir}/${derived}"
+    echo "${private_key_value}" > "${target}"
+    chmod 600 "${target}" 2>/dev/null || true
+}
+
+check_legacy_private_key_migration() {
+    local f="${private_key_dir}/.id"
+    if [[ ! -r "${f}" ]]; then
+        return
+    fi
+
+    local pub
+    pub="$(age-keygen -y "$f" 2>/dev/null || true)"
+    if [[ -z "$pub" || "$pub" != age1* ]]; then
+        >&2 echo "WARN: stray file in ${private_key_dir} that does not belong there: $f"
+        return
+    fi
+
+    local target="${private_key_dir}/${pub}"
+    mv "$f" "$target"
+}
+
+age_encrypt() {
+    local pubkeyfile="$1"
+    local outputfile="$2"
+    cat | age --encrypt --recipients-file "${pubkeyfile}" --output "${outputfile}"
+}
+
+age_decrypt() {
+    local privatekeyfile="$1"
+    local inputfile="$2"
+    age --decrypt --identity "${privatekeyfile}" "${inputfile}"
+}
+
+# Local store metadata helpers
+
+write_local_metadata() {
+    local metadata_file="$1"
+    local store_name="$2"
+    local pubkey="$3"
+    cat > "${metadata_file}" <<EOF
+store=${store_name}
+pubkey=${pubkey}
+EOF
+}
+
+# Read local metadata file
+# Sets global variables: _metadata_store and _metadata_pubkey
+read_local_metadata() {
+    local metadata_file="$1"
+    _metadata_store=""
+    _metadata_pubkey=""
+
+    if [[ ! -r "${metadata_file}" ]]; then
+        return 1
+    fi
+
+    _metadata_store="$(grep '^store=' "${metadata_file}" | cut -d= -f2)"
+    _metadata_pubkey="$(grep '^pubkey=' "${metadata_file}" | cut -d= -f2)"
+
+    if [[ -z "${_metadata_store}" || -z "${_metadata_pubkey}" ]]; then
+        >&2 echo "ERROR: Invalid metadata format in ${metadata_file}"
+        >&2 echo "Run 'szecret create-local <store-name> <directory>' to recreate"
+        return 1
+    fi
+}
+
+get_local_public_key() {
+    local local_store_name="$1"
+    local local_private_key
+    local_private_key="$(get_local_private_key "${local_store_name}")"
+    age-keygen -y <<<"${local_private_key}"
+}
+
+verify_local_pubkey() {
+    local expected_pubkey="$1"
+    local actual_pubkey="$2"
+    local store_name="$3"
+
+    if [[ "${expected_pubkey}" != "${actual_pubkey}" ]]; then
+        >&2 echo "ERROR: Public key mismatch for store '${store_name}'"
+        >&2 echo "  Expected: ${expected_pubkey}"
+        >&2 echo "  Actual:   ${actual_pubkey}"
+        return 1
+    fi
+}
+