Add passv: a Vault-backed drop-in for pass

Provide a password-store CLI that keeps pass's on-disk layout (<name>.gpg binary OpenPGP under $PASSWORD_STORE_DIR) but routes all encryption and decryption through a vault-plugin-secrets-gpg engine mount, so the GPG private key never lives on the client. - Implement init/show/ls/insert/generate/edit/rm/mv/cp/find/grep/git with pass-compatible flags and implicit `passv <name>`=show dispatch. - Resolve the recipient from a Vault ref: .gpg-id holds <mount>/<key> for passv-native stores, or a sibling .vault-id lets a store keep real GPG fingerprints in .gpg-id for dual gpg+Vault use. - mv/cp re-encrypt across differing recipients; same-recipient moves copy the ciphertext verbatim. - Ship the sibling build/packaging/CI: nfpm RPM to /usr/bin/passv (artifactapi rpm-internal on v* tag), Woodpecker PR/release pipelines, unit tests plus a real-Vault e2e that also proves dual gpg+Vault decryption. - README covers store creation, migrating a GPG pass store, and dual-mode.
2026-07-16 22:23:16 +10:00
parent bacfc8925a
commit 408eacf7e2
26 changed files with 2117 additions and 1 deletions
@@ -0,0 +1,172 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestSplitRef(t *testing.T) {
+	cases := []struct {
+		in         string
+		mount, key string
+		wantErr    bool
+	}{
+		{"gpg/app", "gpg", "app", false},
+		{"/gpg/app/", "gpg", "app", false},
+		{"secret/gpg/team", "secret/gpg", "team", false},
+		{"app", "", "", true},
+		{"gpg/", "", "", true},
+		{"/app", "", "", true},
+	}
+	for _, c := range cases {
+		m, k, err := splitRef(c.in)
+		if c.wantErr {
+			if err == nil {
+				t.Errorf("splitRef(%q): expected error", c.in)
+			}
+			continue
+		}
+		if err != nil {
+			t.Errorf("splitRef(%q): %v", c.in, err)
+			continue
+		}
+		if m != c.mount || k != c.key {
+			t.Errorf("splitRef(%q) = (%q,%q), want (%q,%q)", c.in, m, k, c.mount, c.key)
+		}
+	}
+}
+
+func TestParseClip(t *testing.T) {
+	cases := []struct {
+		in       []string
+		clip     bool
+		line     int
+		restName string
+	}{
+		{[]string{"foo"}, false, 1, "foo"},
+		{[]string{"-c", "foo"}, true, 1, "foo"},
+		{[]string{"foo", "--clip"}, true, 1, "foo"},
+		{[]string{"--clip=3", "foo"}, true, 3, "foo"},
+		{[]string{"-c2", "foo"}, true, 2, "foo"},
+	}
+	for _, c := range cases {
+		clip, line, rest := parseClip(c.in)
+		if clip != c.clip || line != c.line {
+			t.Errorf("parseClip(%v) = (%v,%d), want (%v,%d)", c.in, clip, line, c.clip, c.line)
+		}
+		if len(rest) != 1 || rest[0] != c.restName {
+			t.Errorf("parseClip(%v) rest = %v, want [%q]", c.in, rest, c.restName)
+		}
+	}
+}
+
+func TestGpgIDWalkUp(t *testing.T) {
+	dir := t.TempDir()
+	s := &store{dir: dir}
+
+	// Root .gpg-id, plus a subtree override.
+	if err := os.WriteFile(filepath.Join(dir, ".gpg-id"), []byte("gpg/personal\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(dir, "work", "team"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "work", ".gpg-id"), []byte("gpg/work\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	cases := map[string]string{
+		"email/gmail":      "gpg/personal",
+		"work/deploy":      "gpg/work",
+		"work/team/secret": "gpg/work",
+		"root-entry":       "gpg/personal",
+	}
+	for name, want := range cases {
+		got, err := s.vaultRef(name)
+		if err != nil {
+			t.Errorf("vaultRef(%q): %v", name, err)
+			continue
+		}
+		if got != want {
+			t.Errorf("vaultRef(%q) = %q, want %q", name, got, want)
+		}
+	}
+}
+
+func TestVaultRefUninitialized(t *testing.T) {
+	s := &store{dir: t.TempDir()}
+	if _, err := s.vaultRef("anything"); err == nil {
+		t.Fatal("expected error for store with no .gpg-id / .vault-id")
+	}
+}
+
+// TestDualModeVaultID covers a store shared with plain gpg `pass`: `.gpg-id`
+// holds GPG fingerprints, and a sibling `.vault-id` carries the Vault ref that
+// passv must use.
+func TestDualModeVaultID(t *testing.T) {
+	dir := t.TempDir()
+	s := &store{dir: dir}
+	// .gpg-id has real GPG fingerprints (as plain pass would write); passv must
+	// not treat those as a Vault ref.
+	if err := os.WriteFile(filepath.Join(dir, ".gpg-id"),
+		[]byte("ABCD1234ABCD1234ABCD1234ABCD1234ABCD1234\nDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	// Without a .vault-id, passv cannot know which Vault key to use.
+	if _, err := s.vaultRef("email/gmail"); err == nil {
+		t.Fatal("expected error when .gpg-id holds fingerprints and no .vault-id exists")
+	}
+	// Adding .vault-id resolves it.
+	if err := os.WriteFile(filepath.Join(dir, ".vault-id"), []byte("gpg/app\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	got, err := s.vaultRef("email/gmail")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "gpg/app" {
+		t.Fatalf("vaultRef = %q, want gpg/app", got)
+	}
+}
+
+func TestGenPassword(t *testing.T) {
+	pw, err := genPassword(32, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(pw) != 32 {
+		t.Fatalf("length = %d, want 32", len(pw))
+	}
+	for _, r := range pw {
+		if !((r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9')) {
+			t.Fatalf("no-symbols password contains symbol %q", r)
+		}
+	}
+
+	// Two generations must differ (astronomically unlikely to collide).
+	a, _ := genPassword(25, true)
+	b, _ := genPassword(25, true)
+	if a == b {
+		t.Fatal("consecutive generated passwords collided")
+	}
+}
+
+func TestListSkipsHidden(t *testing.T) {
+	dir := t.TempDir()
+	s := &store{dir: dir}
+	os.MkdirAll(filepath.Join(dir, ".git"), 0o700)
+	os.WriteFile(filepath.Join(dir, ".git", "config.gpg"), []byte("x"), 0o600)
+	os.WriteFile(filepath.Join(dir, ".gpg-id"), []byte("gpg/app"), 0o600)
+	os.MkdirAll(filepath.Join(dir, "email"), 0o700)
+	os.WriteFile(filepath.Join(dir, "email", "gmail.gpg"), []byte("x"), 0o600)
+	os.WriteFile(filepath.Join(dir, "note.txt"), []byte("x"), 0o600)
+
+	names, err := s.list("")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(names) != 1 || names[0] != "email/gmail" {
+		t.Fatalf("list = %v, want [email/gmail]", names)
+	}
+}