moss

commit 09bc12d485c7c3b9f67416bb2ae217d8a1aa8a43
parent faf2ce6bc786ade9a605d5f46053cca6a3efc8e3
Author: Daniel Barlow <dan@telent.net>
Date:   Mon,  9 Aug 2021 15:04:33 +0100

git-controlled stores

Diffstat:
M
features/moss.feature
 | 
5
+++++
M
features/step_definitions/steps.rb
 | 
9
+++++++++
M
moss.rb
 | 
7
+++++++

3 files changed, 21 insertions(+), 0 deletions(-)
diff --git a/features/moss.feature b/features/moss.feature
@@ -64,6 +64,11 @@ Feature: command-line password management
     And I cannot decrypt it with key "work.key"
     
   Scenario: Secrets are stored in a git repo
+    Given I am using a temporary password store
+    And the store is version-controlled
+    When I store a secret for "home/ebay" with content "horsebattery"
+    Then the change to "home/ebay.age" is committed to version control
+    
 
   Scenario: It pushes changes to a git remote
 
diff --git a/features/step_definitions/steps.rb b/features/step_definitions/steps.rb
@@ -123,3 +123,12 @@ Given("there are recipient files in different subtrees") do |table|
     add_to_store("#{row['pathname']}/.recipients", recipients)
   end
 end
+
+Given("the store is version-controlled") do
+  shell "cd #{ENV["MOSS_STORE"]} && git init --initial-branch=main"
+end
+
+Then("the change to {string} is committed to version control") do |name|
+  log = shell "cd #{ENV["MOSS_STORE"]} && git log #{name}"
+  expect(log).to match /new secret/
+end
diff --git a/moss.rb b/moss.rb
@@ -6,6 +6,10 @@ require 'tempfile'
 STORE = Pathname.new(ENV['MOSS_STORE'] || "/tmp/store").realpath
 IDENTITY_FILE = ENV['MOSS_IDENTITY_FILE']
 
+def git_managed?
+  STORE.join(".git").exist?
+end
+
 def random_alnum(length)
   bytes = File.open("/dev/urandom", "rb") do |random|
     random.read(length).unpack("C*").map {|c|
@@ -29,6 +33,9 @@ def write_secret(name, content)
   IO.popen("age -a --recipients-file #{recipients_for_secret(name)} -o #{pathname.to_s}", "w") do |f|
     f.write(content)
   end
+  if git_managed?
+    Kernel.system("cd #{STORE.to_s} && git add #{pathname.relative_path_from(STORE).to_s.inspect} && git commit -m'new secret'")
+  end
 end
 
 def find_in_subtree(subtree, filename)