penguin/utils

commit 9a5bd09f059ea7fd061dad54ff1cd155ca223b1b

commit 9a5bd09f059ea7fd061dad54ff1cd155ca223b1b
Author: 斟酌 鵬兄 <tgckpg@gmail.com>
Date:   2026-06-27T01:41:52Z

    Strengthen enc for kstore a little
---
 bash/sources/16_keystore | 58 +++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 8 deletions(-)

diff --git a/bash/sources/16_keystore b/bash/sources/16_keystore
index 9cdf137..9c28cf7 100644
--- a/bash/sources/16_keystore
+++ b/bash/sources/16_keystore
@@ -17,6 +17,7 @@ _AUTH_SECRET=
 _KSTORE_DEF_PROP=${_KSTORE_DEF_PROP:-val}
 _KSTORE_DEC_FAILED="$RBASH_HOME/.decypt-failed"
 _KSTORE_TABLE=store
+: "${_KSTORE_OPENSSL_ITER:=1000000}"
 
 if [ -f "$RBASH_HOME/keystore.secret" ]; then
 	_AUTH_SECRET=$( cat "$RBASH_HOME/keystore.secret" )
@@ -120,12 +121,43 @@ function _kstoreenc {
 		return 1
 	fi
 
-	if [ "$1" == "-" ]; then
-		openssl enc -e -aes-256-cbc -pbkdf2 -k "$_AUTH_SECRET" -a -A
+	if [ "$1" = "-" ]; then
+		openssl enc \
+			-e \
+			-aes-256-cbc \
+			-pbkdf2 \
+			-iter "$_KSTORE_OPENSSL_ITER" \
+			-md sha256 \
+			-salt \
+			-a \
+			-A \
+			-pass fd:3 \
+			3<<<"$_AUTH_SECRET"
 	elif [ -f "$1" ]; then
-		openssl enc -e -aes-256-cbc -pbkdf2 -k "$_AUTH_SECRET" -a -A -in "$1"
+		openssl enc \
+			-e \
+			-aes-256-cbc \
+			-pbkdf2 \
+			-iter "$_KSTORE_OPENSSL_ITER" \
+			-md sha256 \
+			-salt \
+			-a \
+			-A \
+			-in "$1" \
+			-pass fd:3 \
+			3<<<"$_AUTH_SECRET"
 	else
-		echo -n "$1" | openssl enc -e -aes-256-cbc -pbkdf2 -k "$_AUTH_SECRET" -a -A
+		printf "%s" "$1" | openssl enc \
+			-e \
+			-aes-256-cbc \
+			-pbkdf2 \
+			-iter "$_KSTORE_OPENSSL_ITER" \
+			-md sha256 \
+			-salt \
+			-a \
+			-A \
+			-pass fd:3 \
+			3<<<"$_AUTH_SECRET"
 	fi
 }
 
@@ -135,11 +167,21 @@ function _kstoredec {
 		return 1
 	fi
 
-	openssl enc -d -aes-256-cbc -pbkdf2 -k "$_AUTH_SECRET" -a -A
+	openssl enc \
+		-d \
+		-aes-256-cbc \
+		-pbkdf2 \
+		-iter "$_KSTORE_OPENSSL_ITER" \
+		-md sha256 \
+		-a \
+		-A \
+		-pass fd:3 \
+		3<<<"$_AUTH_SECRET"
+
 	_code=$?
-	if [ $_code -ne 0 ]; then
-		touch $_KSTORE_DEC_FAILED
-		return $_code
+	if [ "$_code" -ne 0 ]; then
+		[ -n "$_KSTORE_DEC_FAILED" ] && touch "$_KSTORE_DEC_FAILED"
+		return "$_code"
 	fi
 }