This is a safety measure to ensure that GnuPG may not be fed arbitrary
commandline arguments from the .gpg-id file. Normally, that file is
considered trusted, but it might be possible, in a multi-user
password-store, that it contains untrusted input from other users,
even if signed.
In that sense, it's technically possible for other users to add
arbitrary content in there, and therefore arbitrary commandline
arguments to GnuPG. There are two things that mitigate that possible
security issue already:
1. each .gpg-id line is passed individually, in a list, so it will
not get expanded by a shell, which also means only a single
argument can be passed
2. the --list-keys argument is already passed, so it is probably
not possible to change the "mode" of GnuPG (say make it encrypt or
sign content)
However, the GnuPG commandline interface being particularly
unscrutable, it seems safer to terminate the commandline using the
colloquial --.
This is copied from pass-audit, in:
https://github.com/roddhjav/pass-audit/pull/28
... but the same audit was not performend on pass-import.
* '1p-otp' of https://github.com/b123400/pass-import:
Add `email` and `otpauth` to standard keys according to manager.py's key list
Read OTP from 1Password's 1pif format
I have encountered various scenarios where LastPass will truncate
entries in the CSV file it generates during an export, leading to
a CSV file with invalid rows!
In many of these cases, the result is that the "group" field will
appear to be empty, which is not correct and hence was not expected by
LastpassCSV. Here we don't attempt to ignore the issue, but instead
provide a slightly more helpful error message when we fail.
* 'duplicate_fixes' of https://github.com/boltronics/pass-import:
Fix possible infinite loop (issue #154)
Consider full string when incrementing path count
Increase test_numbers test complexity
Add test_duplicate tests
