57 commits

Author	SHA1	Message	Date
Jörg Thalheim	351c716739	allow non-key group users to access /run/secrets ... This does not significantly decrease security while making it a lot more convinient. There are also services, where it is not possible to set the keys group i.e. if a daemon unsets all groups. Processes still won't be able to list other secrets if they are not in the secret group. fixes #86	2021-06-05 17:59:22 +02:00
Jörg Thalheim	f540b74ced	remove ssh-to-pgp from sops-nix	2021-02-22 06:49:46 +01:00
Nicolas Berbiche	a3b53c6087	Fix sops-pgp-hook erroring in a strict shell	2021-02-08 15:49:30 -05:00
Jörg Thalheim	d665aecd88	fix 32-bit build	2021-02-01 13:50:17 +01:00
Bernardo Meurer	dd7dfdcb6a	pkgs: don't reference deprecated stdenv.lib ... `stdenv.lib` has been deprecated in favor of using `lib` directly.	2021-01-31 18:02:23 -08:00
Jörg Thalheim	4de7358a2b	only mount ramfs once	2021-01-28 22:36:12 +01:00
Jörg Thalheim	47a99b6957	Merge branch 'master' into lists	2021-01-27 06:23:50 +00:00
Jörg Thalheim	80ad73c347	fix sops files that contains lists ... fixes #68	2021-01-27 07:22:56 +01:00
Eduard Bopp	0be44e088b	Fix impurity in test invocation ... The system must be specified, as its default is `builtins.currentSystem`, which is disallowed as an impure function during flake evaluation.	2021-01-26 15:48:56 +01:00
Martin Potier	40f42e95b6	Keep the original shellHook if it is set	2021-01-07 16:24:18 +02:00
Jörg Thalheim	9b65d30bad	ssh-to-pgp: fix tests	2020-12-15 04:05:56 +01:00
Jörg Thalheim	378fe484f9	fix sops-install-secrets with nixpkgs unstable	2020-11-18 16:08:59 +01:00
Jörg Thalheim	c7826f534e	parallelize CI	2020-11-13 12:54:33 +01:00
Cole Mickens	24fd158fe6	sops-install-secrets: symlinkSecret: set uid/gid (with Fchownat) (#32) ... Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>	2020-08-24 09:24:43 +01:00
Jörg Thalheim	7d2b22a18d	sops-install-secrets: disable tests	2020-08-10 18:22:59 +01:00
Jörg Thalheim	32c42617e4	sshkeys: use %w in fmt.Errorf calls	2020-07-30 16:22:43 +01:00
Jörg Thalheim	df86cc4e71	ssh-to-pgp: use %w for fmt.Errorf calls	2020-07-30 16:21:47 +01:00
Jörg Thalheim	01e4038c9a	don't print full executable path logging key import	2020-07-30 16:19:51 +01:00
Jörg Thalheim	9cd8bb080f	sops-install-secrets: use %w for fmt.Errorf calls	2020-07-30 16:19:14 +01:00
Jörg Thalheim	59e6df1acf	sops-init-gpg-key: include hostname on darwin	2020-07-23 08:45:32 +01:00
Jörg Thalheim	98afd85ef8	sops-ini-gpg-key: add install check	2020-07-23 08:20:08 +01:00
Jörg Thalheim	b8d91d61ac	restrict sops-install-secrets to linux ... ramfs is not available elswhere.	2020-07-22 23:46:05 +01:00
Jörg Thalheim	4a41039ab3	mark sops-install-secrets as Linux only	2020-07-22 23:12:13 +01:00
Jörg Thalheim	5e95616f0f	use a shorter tempdir on macOS ... By default macOS does something like this: /var/folders/08/j4g_jn953lngpvgmyg8dygk00000gn/T/ breaking unix socket paths of gnupg.	2020-07-22 23:10:22 +01:00
Andreas Fuchs	1279274ddc	Use /tmp as the temporary dir for ssh-to-gpg ... This isn't great: but it might prevent the agent from complaining.	2020-07-22 23:10:22 +01:00
Andreas Fuchs	0d885b439f	Create a temporary GNUPGHOME dir ... This should prevent the paths from getting unwieldy, we'll see.	2020-07-22 23:10:22 +01:00
Jörg Thalheim	3095053dd4	darwin fixes	2020-07-22 22:29:01 +01:00
Jörg Thalheim	66393a1c82	sops-pgp-hook: ignore subkeys ... fixes #17	2020-07-22 15:07:51 +01:00
Jörg Thalheim	0729c15de3	sops-pgp-hook: make test robust against file order ... There is no guarantee that keys will be returned in a certain order	2020-07-22 14:32:08 +01:00
Jörg Thalheim	fd28d45f10	make golangci-lint happy	2020-07-19 23:30:28 +01:00
Jörg Thalheim	bffb0afb48	fix replace existing files	2020-07-19 23:23:38 +01:00
Jörg Thalheim	59803f7530	fix user manifest validation in sandbox ... we should not lookup users there	2020-07-19 21:04:58 +01:00
Jörg Thalheim	30c6879b42	add validation mode	2020-07-19 17:09:27 +01:00
Jörg Thalheim	4224ec9ede	add validate flag	2020-07-19 11:32:59 +01:00
Jörg Thalheim	b1131e035d	sops-install-secrets: improve error message	2020-07-14 13:49:54 +01:00
Jörg Thalheim	6508df75b6	sops-install-secrets: include newline in log	2020-07-14 13:48:30 +01:00
Jörg Thalheim	cf34042dc2	sops-install-secrets: log gpg fingerprint	2020-07-14 13:42:32 +01:00
Jörg Thalheim	8cdca9dd6d	secring: open with more secure umask	2020-07-14 13:41:03 +01:00
Jörg Thalheim	4eda6711ba	fix /etc/secrets.d permissions	2020-07-14 13:21:07 +01:00
Jörg Thalheim	fe7f6360e8	add integration test for sops-pgp-hook	2020-07-14 11:26:54 +01:00
Jörg Thalheim	7c6f438d05	rework sops-pgp-hook and document it.	2020-07-13 09:51:53 +01:00
Jörg Thalheim	6286c5cc75	fix public gpg key import	2020-07-13 09:12:47 +01:00
Jörg Thalheim	71976f5a55	ssh-to-pgp: make armor encoding the default	2020-07-13 08:05:03 +01:00
Jörg Thalheim	bdfd4c3389	sops-init-gpg-key: print fingerprint	2020-07-13 07:25:08 +01:00
Jörg Thalheim	d8e505804a	ssh-to-pgp: print fingerprint	2020-07-13 07:24:51 +01:00
Jörg Thalheim	ec604e56c6	sops-shell-hook: look for both .asc/.gpg	2020-07-13 07:17:18 +01:00
Jörg Thalheim	81ab902811	don't panic when ssh key is encrypted	2020-07-13 06:26:45 +01:00
Jörg Thalheim	dfedaea239	avoid partial writes with ascii armor ... Sill not perfect because it still prints the header	2020-07-13 06:26:41 +01:00
Jörg Thalheim	7bd84011ef	fix sops nixos module	2020-07-12 17:52:03 +01:00
Jörg Thalheim	1745bb9f95	build nixos tests on CI.	2020-07-12 17:45:31 +01:00