mirror of
https://github.com/gopasspw/gopass.git
synced 2026-05-30 11:18:48 +02:00
google-labs-jules[bot]
882d06e001
* feat: Add cryptfs storage backend for filename encryption This commit introduces a new storage backend called `cryptfs`. This backend encrypts the filenames of secrets to enhance privacy while maintaining compatibility with existing VCS backends like Git. Key features: - For each secret, a cryptographically secure hash (SHA-256) of its name is generated and used as the filename for the underlying storage. - A mapping from the original secret name to the hashed filename is maintained in an encrypted file (`.gopass-mapping.age`) within the repository. - The mapping file is encrypted using the `age` encryption backend, with recipients read from the store's `.age-recipients` file. - The `cryptfs` backend is implemented as a wrapper around any existing storage backend (e.g., `gitfs`, `fs`), which can be configured by the user. - The backend is registered with gopass and can be enabled by setting `storage: cryptfs` in the store's configuration. This implementation addresses issue #2634. * [fix] Fix lint errors Signed-off-by: Dominik Schulz <dominik.schulz@gauner.org> * [chore] Fix the remaining tests and add some docs. Signed-off-by: Dominik Schulz <dominik.schulz@gauner.org> --------- Signed-off-by: Dominik Schulz <dominik.schulz@gauner.org> Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: Dominik Schulz <dominik.schulz@gauner.org>
58 lines
1.3 KiB
Go
58 lines
1.3 KiB
Go
package gitfs
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"path/filepath"
|
|
|
|
"github.com/gopasspw/gopass/internal/backend"
|
|
"github.com/gopasspw/gopass/pkg/fsutil"
|
|
"github.com/gopasspw/gopass/pkg/termio"
|
|
)
|
|
|
|
const (
|
|
name = "gitfs"
|
|
)
|
|
|
|
func init() {
|
|
backend.StorageRegistry.Register(backend.GitFS, name, &loader{})
|
|
}
|
|
|
|
type loader struct{}
|
|
|
|
func (l loader) New(ctx context.Context, path string) (backend.Storage, error) {
|
|
return New(path)
|
|
}
|
|
|
|
// Open implements backend.RCSLoader.
|
|
func (l loader) Open(ctx context.Context, path string) (backend.Storage, error) {
|
|
return New(path)
|
|
}
|
|
|
|
// Clone implements backend.RCSLoader.
|
|
func (l loader) Clone(ctx context.Context, repo, path string) (backend.Storage, error) {
|
|
return Clone(ctx, repo, path, termio.DetectName(ctx, nil), termio.DetectEmail(ctx, nil))
|
|
}
|
|
|
|
// Init implements backend.RCSLoader.
|
|
func (l loader) Init(ctx context.Context, path string) (backend.Storage, error) {
|
|
return Init(ctx, path, termio.DetectName(ctx, nil), termio.DetectEmail(ctx, nil))
|
|
}
|
|
|
|
func (l loader) Handles(ctx context.Context, path string) error {
|
|
path = fsutil.ExpandHomedir(path)
|
|
if !fsutil.IsDir(filepath.Join(path, ".git")) {
|
|
return fmt.Errorf("no .git at %s", path)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (l loader) Priority() int {
|
|
return 11
|
|
}
|
|
|
|
func (l loader) String() string {
|
|
return name
|
|
}
|