dotfiles

Shell, editor and terminal configuration, the tools that go with them, and
szecret, an age-based secret manager whose store lives elsewhere.

History restarts here. What came before was not written to be read by
anyone else, and carried machine names, addresses and an encrypted secret
store; it is kept privately instead. What is left is meant to be safe on
any machine, including one whose owner is not me: see CLAUDE.md for the
rule it is written to.

1 files changed, 96 insertions, 0 deletions

diff --git a/secrets/get-local.sh b/secrets/get-local.sh
new file mode 100755
index 0000000..719a914
--- /dev/null
+++ b/secrets/get-local.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ "$#" -gt 0 && ("$1" == "-h" || "$1" == "--help") ]]; then
+    cat <<EOF
+get-local: Retrieve and decrypt a secret from a localized store
+
+Decrypts and outputs a secret value from a localized store. The store name
+is read from the .szecret metadata file in the file's directory.
+
+Usage:
+  get-local <file-path>
+  get-local -h|--help
+
+Arguments:
+  file-path    Path to the encrypted file to decrypt
+
+The command will:
+1. Read the store name from <directory>/.szecret
+2. Retrieve the local store's private key from global store
+3. Check if the encrypted file exists and is readable
+4. Decrypt the file using age with the local store's private key
+5. Output the decrypted content to stdout
+
+Legacy usage (deprecated):
+  get-local <local-store-name> <file-path>
+
+Note: Exits with error if file doesn't exist or decryption fails.
+EOF
+    exit 0
+fi
+
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+source "${this_dir}/common.sh"
+
+if [[ "$#" -lt 1 ]]; then
+    >&2 echo "ERROR: Need file path"
+    exit 1
+fi
+
+# Determine if using legacy or new syntax
+if [[ "$#" -ge 2 ]]; then
+    # Legacy syntax: get-local <store-name> <file-path>
+    local_store_name="$1"
+    file_path="$2"
+    target_dir="$(dirname "${file_path}")"
+    metadata_file="${target_dir}/.szecret"
+
+    >&2 echo "WARN: Using deprecated syntax. Use: szecret get-local ${file_path}"
+    if [[ ! -r "${metadata_file}" ]]; then
+        >&2 echo "  To migrate, run: szecret create-local ${local_store_name} ${target_dir}"
+    fi
+
+    ensure_local_store "${local_store_name}"
+    ensure_age
+    # No pubkey verification for legacy syntax
+else
+    # New syntax: get-local <file-path>
+    file_path="$1"
+    target_dir="$(dirname "${file_path}")"
+    metadata_file="${target_dir}/.szecret"
+
+    if ! read_local_metadata "${metadata_file}"; then
+        >&2 echo "ERROR: No .szecret metadata in ${target_dir}"
+        >&2 echo "Run 'szecret create-local <store-name> ${target_dir}' first"
+        exit 1
+    fi
+
+    local_store_name="${_metadata_store}"
+    expected_pubkey="${_metadata_pubkey}"
+
+    ensure_local_store "${local_store_name}"
+    ensure_age
+
+    # Verify pubkey matches
+    actual_pubkey="$(get_local_public_key "${local_store_name}")"
+    verify_local_pubkey "${expected_pubkey}" "${actual_pubkey}" "${local_store_name}"
+fi
+
+# Check if the encrypted file exists
+if ! [[ -r "${file_path}" ]]; then
+    >&2 echo "ERROR: File '${file_path}' not found or not readable"
+    exit 1
+fi
+
+# Get the local private key from the global store
+local_private_key="$(get_local_private_key "${local_store_name}")"
+
+# Create a temporary file for the private key
+temp_private_key="$(mktemp)"
+trap 'rm -f "${temp_private_key}"' EXIT
+echo "${local_private_key}" > "${temp_private_key}"
+
+# Decrypt the file using the local private key
+age_decrypt "${temp_private_key}" "${file_path}"