commit 1e2ed5812d09839ab329034d33f90c1d5eaf24ca
| author | 斟酌 鵬兄 <tgckpg@gmail.com> |
|---|
| date | 2026-06-27T09:14:12Z |
|---|
| subject | Improve kstoresecret handling |
|---|
commit 1e2ed5812d09839ab329034d33f90c1d5eaf24ca
Author: 斟酌 鵬兄 <tgckpg@gmail.com>
Date: 2026-06-27T09:14:12Z
Improve kstoresecret handling
---
bash/sources/16_keystore | 89 ++++++++++++++++++++++++++----------------------
1 file changed, 48 insertions(+), 41 deletions(-)
diff --git a/bash/sources/16_keystore b/bash/sources/16_keystore
index 7df093e..d53014e 100644
--- a/bash/sources/16_keystore
+++ b/bash/sources/16_keystore
@@ -19,11 +19,6 @@ _KSTORE_DEC_FAILED="$RBASH_HOME/.decypt-failed"
_KSTORE_TABLE=store
: "${_KSTORE_OPENSSL_ITER:=1000000}"
-if [ -f "$RBASH_HOME/keystore.secret" ]; then
- _AUTH_SECRET=$( cat "$RBASH_HOME/keystore.secret" )
-fi
-
-
function kstore {
case $1 in
add) shift; _kstoreadd "$@" ;;
@@ -205,14 +200,14 @@ function _kstoresecret-cygwin {
case $1 in
get)
- _A=$( kstorecred get )
+ _A=$(kstorecred get)
if [ $? -ne 0 ]; then
return 1
fi
_AUTH_SECRET="$_A"
;;
set)
- kstorecred set "$_AUTH_SECRET"
+ printf "%s" "$_AUTH_SECRET" | kstorecred set
;;
del)
kstorecred del
@@ -226,19 +221,16 @@ function _kstoresecret-cygwin {
function _kstoresecret-macos {
local _A
- case $1 in
+ case "$1" in
get)
- _A=`security find-generic-password -a default -gs rbash-kstore 2>&1 | grep ^password | cut -c 11-`
- if [ $? -ne 0 ]; then
- return 1
- fi
- _AUTH_SECRET="${_A:1:-1}"
+ _A=$(security find-generic-password -a default -s rbash-kstore -w 2>/dev/null) || return 1
+ _AUTH_SECRET="$_A"
;;
set)
- security add-generic-password -a default -s rbash-kstore -w "$_AUTH_SECRET"
+ security add-generic-password -a default -s rbash-kstore -w "$_AUTH_SECRET" -U
;;
del)
- security delete-generic-password -a default -s rbash-kstore
+ security delete-generic-password -a default -s rbash-kstore 2>/dev/null
;;
*)
echo "Unknown action: $1" >&2
@@ -503,65 +495,80 @@ function _kstoreinit-s3au {
}
function _kstoreupload-db {
- local _T _W
+ local _T
_kstoreinit || return 1
- _T=$( date +%Y%m%d%H%M%S )
- echo $_T > "$RBASH_HOME/keystore.latest"
+ _T=$(date +%Y%m%d%H%M%S)
+ echo "$_T" > "$RBASH_HOME/keystore.latest"
- which arch-upload-aws4 2>&1 > /dev/null
+ which arch-upload-aws4 >/dev/null 2>&1
if [ $? -ne 0 ]; then
- _kstoreinit-s3au
+ _kstoreinit-s3au || return 1
fi
- _kstoreenc $_AUTH_DB > "$RBASH_HOME/$_T.enc"
- arch-upload-aws4 "keystore/$_T.enc" "$RBASH_HOME/$_T.enc"
- arch-upload-aws4 "keystore/latest" "$RBASH_HOME/keystore.latest"
+ _kstoreenc "$_AUTH_DB" > "$RBASH_HOME/$_T.enc" || return 1
+ chmod 600 "$RBASH_HOME/$_T.enc"
+
+ arch-upload-aws4 "keystore/$_T.enc" "$RBASH_HOME/$_T.enc" || return 1
+ arch-upload-aws4 "keystore/latest" "$RBASH_HOME/keystore.latest" || return 1
- rm "$RBASH_HOME/$_T.enc"
- rm "$RBASH_HOME/keystore.latest"
+ rm -f "$RBASH_HOME/$_T.enc" "$RBASH_HOME/keystore.latest"
}
function _kstoredownload-db {
- local _T _DOMAIN _URL _TMP _CONFIRM
+ local _T _TMP _CONFIRM _OLD_PIPEFAIL
+
kstore secret config || return 1
- which arch-download-aws4 2>&1 > /dev/null
+ which arch-download-aws4 >/dev/null 2>&1
if [ $? -ne 0 ]; then
- _kstoreinit-s3au
+ _kstoreinit-s3au || return 1
fi
- _T=$( arch-download-aws4 "keystore/latest" )
- if [ $? -ne 0 ]; then
+ _T=$(arch-download-aws4 "keystore/latest") || return 1
+
+ _TMP=$(mktemp) || return 1
+
+ _OLD_PIPEFAIL=$(set +o | grep pipefail)
+ set -o pipefail
+
+ if ! arch-download-aws4 "keystore/$_T.enc" | _kstoredec > "$_TMP"; then
+ eval "$_OLD_PIPEFAIL"
+ rm -f "$_TMP"
+ echo "Download/decrypt failed. Incorrect bucket? ($ARCH_S3_BUCKET_URL)" >&2
return 1
fi
- _TMP=$( mktemp )
- arch-download-aws4 "keystore/$_T.enc" | _kstoredec > $_TMP
- if [ $? -ne 0 ]; then
- echo "Incorrect bucket? ($ARCH_S3_BUCKET_URL)" >&2
+ eval "$_OLD_PIPEFAIL"
+
+ if [ "$($_SQLITE "$_TMP" "PRAGMA integrity_check;")" != "ok" ]; then
+ rm -f "$_TMP"
+ echo "Downloaded DB failed SQLite integrity check" >&2
return 1
fi
- _T=$( $_SQLITE "$_TMP" "SELECT COUNT( * ) FROM $_KSTORE_TABLE" )
- if [ $? -ne 0 ]; then
+ if ! $_SQLITE "$_TMP" "SELECT COUNT(*) FROM $_KSTORE_TABLE;" >/dev/null; then
+ rm -f "$_TMP"
+ echo "Downloaded DB does not look like a kstore DB" >&2
return 1
fi
+ chmod 600 "$_TMP"
+
if [ -f "$_AUTH_DB" ]; then
read -p "Replace existing db? (yes/no): " _CONFIRM
- if [ "$_CONFIRM" == "yes" ]; then
- _T="$_AUTH_DB.old.$( date +%Y%m%d%H%M%S )"
+ if [ "$_CONFIRM" = "yes" ]; then
+ _T="$_AUTH_DB.old.$(date +%Y%m%d%H%M%S)"
mv "$_AUTH_DB" "$_T"
- mv $_TMP $_AUTH_DB
+ mv "$_TMP" "$_AUTH_DB"
echo "Original copy: $_T"
else
echo "action canceled"
- rm $_TMP
+ rm -f "$_TMP"
fi
else
- mv $_TMP $_AUTH_DB
+ mv "$_TMP" "$_AUTH_DB"
fi
}