StackExchange / blackbox

Safely store secrets in Git/Mercurial/Subversion

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Change the default data directory

aymericbeaumet opened this issue · comments

The default data directory blackbox is looking for is keyrings/live. This merged PR #218 allows the discovery of alternative vault paths (.blackbox for now). But the priority order still makes keyrings/live the first one it looks for, and the one blackbox is going to create during a blackbox_initialize.

Even though changing the default directory to .blackbox should not be breaking, I suggest we do it during a major version bump as it affects assumptions users have on the project.

The backward compatible implementation should be as simple as swapping those two lines.

Besides the two lines that @aymericbeaumet mentions and the documentation, there are a couple of other places that would need to be touched:

  1. In blackbox_initialize.sh, the word keyrings is currently hardcoded, and would need to be replaced by ${KEYRINGDIR} instead.
  2. The is_blackbox_repo() function also has a hardcoded reference to keyrings. It should instead loop through the possible candidate directories and check each one. One possible way to do this is as follows:
diff --git a/bin/_blackbox_common.sh b/bin/_blackbox_common.sh
index 08671e5..213277a 100755
--- a/bin/_blackbox_common.sh
+++ b/bin/_blackbox_common.sh
@@ -92,11 +92,14 @@ SECRING="${KEYRINGDIR}/secring.gpg"
 # Checks if $1 is 0 bytes, and if $1/keyrings
 # is a directory
 function is_blackbox_repo() {
-  if [[ -n "$1" ]] && [[ -d "$1/keyrings" ]]; then
-    return 0 # Yep, its a repo
-  else
-    return 1
-  fi
+  for candidate_path in ${BLACKBOXDATA_CANDIDATES[@]}; do
+    # Just want to test the top-level dir
+    candidate_dir=${candidate_path%%/*}
+    if [[ -n "$1" ]] && [[ -d "$1/$candidate_dir" ]]; then
+      return 0 # Yep, its a repo
+    fi
+  done
+  return 1
 }
 
 # Return error if not on cryptlist.

In case it matters, because that code fragment is just barely big enough that some copyright lawyer might decide to be a jerk about it if you wanted to include it:

I, Robin Munn, hereby declare that new lines in the code fragment above (presented in standard diff format where old lines are prefixed by a minus sign and new lines are prefixed by a plus sign) are entirely my own work, and I hereby release them into the public domain.

Now that the annoying legal requirements are dealt with, this might be a moot point since the is_blackbox_repo() function is only used in one place, the enumerate_blackbox_repos() function. And the enumerate_blackbox_repos() function isn't actually used anywhere; it's dead code. Still, as long as it exists it should probably be kept up-to-date, which means looping through BLACKBOXDATA_CANDIDATES and checking each one.

With that function either changed or deleted, and the output of blackbox_initialize.sh tweaked to print ${KEYRINGDIR} in the "NEXT STEP" instructions at the end, that should be everything that needs to be changed to switch the default directory.

One more change needed, as I discovered in testing: blackbox_initialize.sh should also add the line vcs_add "$FILE" at the end of the if [[ $VCS_TYPE = "git" ]] block (i.e., here). That way the Git commit that gets built includes the just-created .blackbox/.gitattributes file.