Add passv: a Vault-backed drop-in for pass #1

2026-07-16T22:23:34+10:00

unkinben commented

2026-07-16 22:23:34 +10:00

Provide a password-store CLI that keeps pass's on-disk layout (<name>.gpg binary OpenPGP under $PASSWORD_STORE_DIR) but routes all encryption and decryption through a vault-plugin-secrets-gpg engine mount, so the GPG private key never lives on the client.

Implement init/show/ls/insert/generate/edit/rm/mv/cp/find/grep/git with pass-compatible flags and implicit passv <name>=show dispatch.
Resolve the recipient from a Vault ref: .gpg-id holds <mount>/<key> for passv-native stores, or a sibling .vault-id lets a store keep real GPG fingerprints in .gpg-id for dual gpg+Vault use.
mv/cp re-encrypt across differing recipients; same-recipient moves copy the ciphertext verbatim.
Ship the sibling build/packaging/CI: nfpm RPM to /usr/bin/passv (artifactapi rpm-internal on v* tag), Woodpecker PR/release pipelines, unit tests plus a real-Vault e2e that also proves dual gpg+Vault decryption.
README covers store creation, migrating a GPG pass store, and dual-mode.

Provide a password-store CLI that keeps pass's on-disk layout (`<name>.gpg` binary OpenPGP under $PASSWORD_STORE_DIR) but routes all encryption and decryption through a [vault-plugin-secrets-gpg](https://git.unkin.net/unkin/vault-plugin-secrets-gpg) engine mount, so the GPG private key never lives on the client. - Implement `init/show/ls/insert/generate/edit/rm/mv/cp/find/grep/git` with pass-compatible flags and implicit `passv <name>`=show dispatch. - Resolve the recipient from a Vault ref: `.gpg-id` holds `<mount>/<key>` for passv-native stores, or a sibling `.vault-id` lets a store keep real GPG fingerprints in `.gpg-id` for dual gpg+Vault use. - `mv`/`cp` re-encrypt across differing recipients; same-recipient moves copy the ciphertext verbatim. - Ship the sibling build/packaging/CI: nfpm RPM to /usr/bin/passv (artifactapi rpm-internal on v* tag), Woodpecker PR/release pipelines, unit tests plus a real-Vault e2e that also proves dual gpg+Vault decryption. - README covers store creation, migrating a GPG pass store, and dual-mode.

unkinben added 1 commit 2026-07-16 22:25:36 +10:00

Add passv: a Vault-backed drop-in for pass

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

06da0a668a

Provide a password-store CLI that keeps pass's on-disk layout (<name>.gpg
binary OpenPGP under $PASSWORD_STORE_DIR) but routes all encryption and
decryption through a vault-plugin-secrets-gpg engine mount, so the GPG private
key never lives on the client.

- Implement init/show/ls/insert/generate/edit/rm/mv/cp/find/grep/git with
  pass-compatible flags and implicit `passv <name>`=show dispatch.
- Resolve the recipient from a Vault ref: .gpg-id holds <mount>/<key> for
  passv-native stores, or a sibling .vault-id lets a store keep real GPG
  fingerprints in .gpg-id for dual gpg+Vault use.
- mv/cp re-encrypt across differing recipients; same-recipient moves copy the
  ciphertext verbatim.
- Ship the sibling build/packaging/CI: nfpm RPM to /usr/bin/passv (artifactapi
  rpm-internal on v* tag), Woodpecker PR/release pipelines, unit tests plus a
  real-Vault e2e that also proves dual gpg+Vault decryption.
- README covers store creation, migrating a GPG pass store, and dual-mode.

unkinben force-pushed benvin/passv from 408eacf7e2 to 06da0a668a

2026-07-16 22:25:36 +10:00

Compare

benvin merged commit 74ac0b1744 into main

2026-07-16 22:28:44 +10:00

benvin deleted branch benvin/passv

2026-07-16 22:28:44 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/passv#1