FR: Per-file or per-subfolder access controls about blackbox HOT 5 CLOSED

For example... how would you specify that a particular subdirectory is encrypted with a particular keychain?

from blackbox.

Thanks for blackbox - we've been using it in a multi-project, single team environment and it's been great. We're now rolling it's use out to multiple teams and were hoping for a single github project with subfolder access controls for each team. e.g.

secrets/
├── team1
│   ├── decrypt.sh
│   ├── keyrings
│   │   └── live
│   │       ├── blackbox-admins.txt
│   │       ├── blackbox-files.txt
│   │       ├── pubring.gpg
│   │       └── trustdb.gpg
│   └── project-a
│       ├── live.json
│       └── staging.json
├── team2
│   ├── decrypt.sh
│   ├── keyrings
│   │   └── live
│   │       ├── blackbox-admins.txt
│   │       ├── blackbox-files.txt
│   │       ├── pubring.gpg
│   │       └── trustdb.gpg
│   └── project-b
│       ├── live.json
│       └── staging.json
├── team3
│   ├── decrypt.sh
│   ├── keyrings
│   │   └── live
│   │       ├── blackbox-admins.txt
│   │       ├── blackbox-files.txt
│   │       ├── pubring.gpg
│   │       └── trustdb.gpg
│   └── project-c
│       ├── live.json
│       └── staging.json

Unfortunately blackbox_register_new_file didn't work because it's looking in the root directory for the blackbox admins file.

I appreciate that this model isn't appropriate for everyone and implies we will have to duplicate some common passwords and admins, but we're prepared to live with that. Is there an option to specify a different root folder?

from blackbox.

@cressie176 sadly that kind of functionality doesn't exist in the code right now. If you'd like to implement it, I'd be glad to accept the PR.

from blackbox.

I want to record some thinking about how to implement this feature:

A. Per-directory
Rather than assuming "keyrings" is in the repo root, search for it in the parent, parent's parent, etc. until it is found. At that point, it then uses what was found. blackbox_initialize will have to be changed to support creating a new keyrings file.

B. Per file:
Each file listed in blackbox-files.txt would also list which keychain is used to encrypt it. The default would be "live". If something else is specified, then /keyrings/WHATEVER would be used.
This would require moving blackbox-files.txt to the "keyrings" directory (it is currently in keyrings/live. It would also require storing the name of the keyring in a secure manner (i.e. wouldn't be confused by a filename with a TAB or space in it, and so on).

A is easiest to implement but is less flexible. It is backwards compatible with existing repos.
B is more flexible, but requires a lot of changes to various parts of code. Plus, old repos will need to be transitioned.

NOTE: If we're going to make big changes, we might want to take this opportunity to change "keyrings" to ".blackbox" (the "." at the start would make blackbox less visible and less likely to conflict with people's existing file schemes)

from blackbox.

This has been fixed for a while. By setting the env variable "BLACKBOXDATA", you can select different keychains. You have to manually set is when in different directories.

from blackbox.