Comments (2)
I'm not sure I follow your report.
You are saying that gopass incorrectly used a sub-keyid as a recipient for a secret outside of that folder?
Can you please provide more details information and steps to reproduce?
Please set GOPASS_DEBUG_LOG=/tmp/gopass.log
(or simliar), GOPASS_HOMEDIR=/tmp/gopass
and then execute all the steps necessary from the shell where these variables are set. This should allow you to operate in an isolated password store. Please provide the exact commands used and the log file.
from gopass.
@dominikschulz recreating from zero on emtpy user
-
adduser testuser
-
sudo usermod -a -G sudo testuser
-
su - user
-
apt install screen
-
script /dev/null
-
screen
(and press enter), just su user does not have right to use gpg, we usescreen
to go around this problem -
gpg --full-generate-key
(picking default, default, default, name: mykey1) first key. optionally making it passworded by better visibility of a bug, but not necessary -
pass init mykey1
create pass storage -
gpg --full-generate-key
create second gpg key, named mykey2 -
pass init --path=api mykey2
creating subfolder
$ cat /home/testuser/.password-store/.gpg-id
mykey1
$ cat /home/testuser/.password-store/api/.gpg-id
mykey2
- pass insert smth1
- cd /home/testuser/.password-store/
$ gpg -d smth1.gpg
gpg: encrypted with 3072-bit RSA key, ID CB6FC1F250432CDC, created 2024-07-30
"mykey1 [email protected]"
123
// All is good, encrypted with one key.
$ sudo snap install go --classic
$ go install github.com/gopasspw/gopass@latest
$ ~/go/bin/gopass
gopass> insert smth2
gopass> quit
$ gpg -d smth2.gpg
gpg: encrypted with 3072-bit RSA key, ID CB6FC1F250432CDC, created 2024-07-30
"mykey1 [email protected]"
123123
// :thinking: okay one key is used
$ ~/go/bin/gopass
gopass> insert api/smth3
gopass> insert smth4
gopass> quit
$ gpg -d api/smth3.gpg
gpg: encrypted with 3072-bit RSA key, ID CB6FC1F250432CDC, created 2024-07-30
"mykey1 [email protected]"
gpg: encrypted with 3072-bit RSA key, ID 1B8A2CABDBA7ACB1, created 2024-07-30
"mykey2"
123123
// :exclamation: aha. bug is reproduced partially from zero. i expected seeing only mykey2 here, but we see both keys used to encrypt api/smth3.gpg
$ gpg -d smth4.gpg
gpg: encrypted with 3072-bit RSA key, ID CB6FC1F250432CDC, created 2024-07-30
"mykey1 [email protected]"
123123
// okay, this one still encrypted with mykey1 only, but i had bug before where both mykey1 and mykey2 shown for non root path
// this time i only caught where subfolder inserted record (with gopass) for some reason acquired mykey1 and mykey2 keys both at the same time, while it should have used mykey2 only
$ pass insert api/smth5
Enter password for api/smth5:
Retype password for api/smth5:
$ gpg -d api/smth5.gpg
gpg: encrypted with 3072-bit RSA key, ID 1B8A2CABDBA7ACB1, created 2024-07-30
"mykey2"
123
// as u can see pass
encrypts only with one key in subfolder
TLDR: this is instruction for partial bug reproduction, but my original issue was that double gpg key was used for non subfolder inserted keys too. that was issue.
This reproducing instruction a similar uncovered situation where double gpg key (instead of one) is used to encrypt stuff for subfolder
We can note here that those are issues for using gopass
with basically stuff from pass
$ pass version
============================================
= pass: the standard unix password manager =
= =
= v1.7.4 =
= =
= Jason A. Donenfeld =
= [email protected] =
= =
= http://www.passwordstore.org/ =
============================================
from gopass.
Related Issues (20)
- deb package doesn't come with completions or a man page HOT 1
- gopass unable to find PGP keys when running in Github Actions
- Trailing whitespace removed when copying password to clipboard HOT 1
- some checks fail on void linux HOT 1
- [FR] Allow selecting the line to copy HOT 3
- Expired GPG Keys should not be ignored silently + there seems to be no gopass command to refresh life-extended keys
- [Question] Is there anyway to add a pin before showing the password HOT 1
- Hooks not firing HOT 1
- Idea: `config: [mounts] path` should be set using `~` if `GOPASS_HOMEDIR` set. HOT 1
- gopass fsck --decrypt should mention filename where decryption fails HOT 3
- "recipients add" does not add the key HOT 1
- age plugin support HOT 1
- Do not create commits during `setup` with specified remote
- gopass windows 10 qt-pinentry needs two calls to startup
- Gopass Releases public GPG key HOT 1
- config file relies on tabs and spaces HOT 4
- `gopass cp` has a different behaviour depending on whether the recursive directory already exist
- config: git operations do not work using `~` in `mounts.path`
- Add option to retrieve credentials without git sync HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gopass.