blob: cba71c6151fa616f7826e9b4c718d6ccd2f783c6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
#!/bin/bash
set -euo pipefail
if [[ "$#" -gt 0 && ("$1" == "-h" || "$1" == "--help") ]]; then
cat <<EOF
put-local: Store a secret in a localized store
Encrypts data from stdin and stores it in a localized store. The store name
is read from the .szecret metadata file in the file's directory.
Usage:
put-local <file-path>
echo "secret-value" | put-local <file-path>
put-local -h|--help
Arguments:
file-path Path where to store the encrypted file
The command will:
1. Read the store name from <directory>/.szecret
2. Retrieve the local store's private key from global store
3. Generate the corresponding public key from the private key
4. Read data from stdin
5. Encrypt the data using age with the local store's public key
6. Store the encrypted data at the specified file path
Note: Will overwrite existing files at the target path.
EOF
exit 0
fi
this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"
if [[ "$#" -lt 1 ]]; then
>&2 echo "ERROR: Need file path"
exit 1
fi
file_path="$1"
target_dir="$(dirname "${file_path}")"
metadata_file="${target_dir}/.szecret"
# Read store name and pubkey from metadata
if ! read_local_metadata "${metadata_file}"; then
>&2 echo "ERROR: No .szecret metadata in ${target_dir}"
>&2 echo "Run 'szecret create-local <store-name> ${target_dir}' first"
exit 1
fi
local_store_name="${_metadata_store}"
expected_pubkey="${_metadata_pubkey}"
ensure_local_store "${local_store_name}"
ensure_age
# Verify pubkey matches
actual_pubkey="$(get_local_public_key "${local_store_name}")"
verify_local_pubkey "${expected_pubkey}" "${actual_pubkey}" "${local_store_name}"
# Get the local private key from the global store
local_private_key="$(get_local_private_key "${local_store_name}")"
# Create a temporary file for the public key (needed because age_encrypt uses pipes)
temp_public_key="$(mktemp)"
trap 'rm -f "${temp_public_key}"' EXIT
age-keygen -y <<<"${local_private_key}" > "${temp_public_key}"
# Encrypt data from stdin to the specified file path using the local store's public key
age_encrypt "${temp_public_key}" "${file_path}"
|
