xoebus / cryptdo Goto Github PK

View Code? Open in Web Editor NEW

5.0 5.0 2.0 2.52 MB

a simple wrapper for commands which access sensitive files

License: BSD 3-Clause "New" or "Revised" License

Go 53.56% Shell 21.35% Python 25.09%

cryptography encryption security tools

cryptdo's People

Contributors

Stargazers

Forkers

jfmyers9 sentinelleader

cryptdo's Issues

Add version command

I have built a version of cryptdo, but I don't have any way of telling which version this binary is.

I don't really care what the versioning scheme is, but I'd like a --version command (or similar) which allows me to do two things:

determine that two binaries are the same version (or different)
determine that one binary is newer than another (i.e. a versioning scheme that is increasing over time in an intuitive, deterministic manner).

Fails to build on arch linux with bazel version 0.5.3

[jfmyers9@jfmyers9 cryptdo]$ bazel build //...
Extracting Bazel installation...
...........
WARNING: /home/jfmyers9/.cache/bazel/_bazel_jfmyers9/e98d2b9cb4b10236e6ed586e39086627/external/bazel_tools/tools/build_defs/pkg/pkg.bzl:196:9: pkg_tar: renaming non-dict `files` attribute to `srcs`.
ERROR: /home/jfmyers9/.cache/bazel/_bazel_jfmyers9/e98d2b9cb4b10236e6ed586e39086627/external/io_bazel_rules_go/go/tools/builders/BUILD:22:1: in go_tool_binary rule @io_bazel_rules_go//go/tools/builders:compile:
Traceback (most recent call last):
        File "/home/jfmyers9/.cache/bazel/_bazel_jfmyers9/e98d2b9cb4b10236e6ed586e39086627/external/io_bazel_rules_go/go/tools/builders/BUILD", line 22
                go_tool_binary(name = 'compile')
        File "/home/jfmyers9/.cache/bazel/_bazel_jfmyers9/e98d2b9cb4b10236e6ed586e39086627/external/io_bazel_rules_go/go/private/go_tool_binary.bzl", line 35, in _go_tool_binary_impl
                ctx.action(inputs = ((ctx.files.srcs + tool...), <4 more arguments>)
        File "/home/jfmyers9/.cache/bazel/_bazel_jfmyers9/e98d2b9cb4b10236e6ed586e39086627/external/io_bazel_rules_go/go/private/go_tool_binary.bzl", line 36, in ctx.action
                toolchain.tools
object of type 'Target' has no field 'tools'.
ERROR: Analysis of target '//cryptdopb:go_default_library' failed; build aborted.
INFO: Elapsed time: 98.510s

[jfmyers9@jfmyers9 cryptdo]$ bazel version
Build label: 0.5.3- (@non-git)
Build target: bazel-out/local-opt/bin/src/main/java/com/google/devtools/build/lib/bazel/BazelServer_deploy.jar
Build time: Sat Aug 12 19:43:34 2017 (1502567014)
Build timestamp: 1502567014
Build timestamp as int: 1502567014

[jfmyers9@jfmyers9 cryptdo]$ uname -a
Linux jfmyers9 4.12.4-1-ARCH #1 SMP PREEMPT Fri Jul 28 18:54:18 UTC 2017 x86_64 GNU/Linux

Cryptdo Leaves around unencrypted files.

16:44:24 mission in ~/workspace/sec-red-meta/deployments/bbl
✓ master → git status
On branch master
Your branch is up-to-date with 'origin/master'.

nothing to commit, working tree clean

16:44:32 mission in ~/workspace/sec-red-meta/deployments/bbl
✓ master → source <(cryptdo -p REDACTED bbl print-env)

16:44:41 mission in ~/workspace/sec-red-meta/deployments/bbl
✗ master → git status
On branch master
Your branch is up-to-date with 'origin/master'.

Untracked files:
  (use "git add <file>..." to include in what will be committed)

        *.sec-blue.red.cf-app.com.key
        bbl-account.key.json
        bbl-state.json
        cf-deployment-vars.yml
        id_rsa_bosh
        sec-blue.key

nothing added to commit but untracked files present (use "git add" to track)

I find this behavior surprising.

It makes it incredibly easy to check in the files unencrypted as git add -p does not work on binary files, so users often result to using git add . in this scenario.

Homebrew formula?

A brew formula would be pretty great handy :)

use unix standard flags

--passphrase

passphrase: should be printed on stderr

split up bats tests into many files

Make 1.0 Release

Add crypto generation versioning field to protocol and document what that implies.
Add test to verify that future versions can still open v1.0 encrypted blobs
Publish my public key on my website
Add instructions on how to install and verify that you have a good binary
Make release and publish

increase salt size to 384

use a sensible serialisation format

protobuf

encode other encryption parameters

Recursively decrypt files

cryptdo-filter should have some way of showing diffs

I think a feature that let's you put a file with passphrases (or commands to fetch passphrases) in the home directory might get around the no TTY issue.

xoebus / cryptdo Goto Github PK

cryptdo's People

Contributors

Stargazers

Forkers

cryptdo's Issues

Recommend Projects

Recommend Topics

Recommend Org