@gorlitzer-labs/comb 0.1.2 → 0.1.3

package/README.md

@@ -55,7 +55,7 @@ matters. Everything else is recoverable; that is not. Back it up somewhere real.
 |---|---|
 | `comb init` | create the age key and the encrypted store |
 | `comb set <NAME> [--url <where>]` | take a value without echoing it, and store it |
-| `comb ls` | names, dates and notes — never values |
+| `comb ls` | names, age and notes — never values |
 | `comb run --with A,B -- <cmd>` | run a command with those secrets in its environment |
 | `comb rotate <NAME>` | tell you where to go, then take the new value |
 | `comb audit` | which secrets leaked into transcripts and shell history |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gorlitzer-labs/comb",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Keep your keys out of your conversations. A small vault front-end over SOPS + age.",
   "type": "module",
   "bin": {

package/src/realms.mjs

@@ -11,8 +11,9 @@
 // be rotated, because that realm can no longer decrypt anything, old copies
 // included (its key never changes what the current ciphertext is encrypted to).
 import { spawnSync } from "node:child_process";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync, mkdtempSync } from "node:fs";
 import { join } from "node:path";
+import { tmpdir } from "node:os";
 import { combHome, storePath, keyPath } from "./backends/sops.mjs";
 
 export const recipientsDir = (home = combHome()) => join(home, "recipients");
@@ -54,11 +55,20 @@ export function rekeyStore(home = combHome()) {
   // Decrypt to JSON in memory, then re-encrypt to the new recipient set.
   const dec = spawnSync("sops", ["--decrypt", "--output-type", "json", storePath(home)], { encoding: "utf-8", env });
   if (dec.status !== 0) throw new Error(`could not decrypt to re-key: ${dec.stderr?.trim()}`);
-  const enc = spawnSync("sops",
-    ["--encrypt", "--age", recipients.join(","), "--input-type", "json", "--output-type", "yaml", "/dev/stdin"],
-    { input: dec.stdout, encoding: "utf-8", env });
-  if (enc.status !== 0) throw new Error(`could not re-encrypt: ${enc.stderr?.trim()}`);
-  writeFileSync(storePath(home), enc.stdout);
+  // Encrypt from a private temp FILE rather than `/dev/stdin`: /dev/stdin is not
+  // openable in non-interactive contexts (CI, some sandboxes), which broke re-key.
+  const dir = mkdtempSync(join(tmpdir(), "comb-rekey-"));
+  const plain = join(dir, "store.json");
+  try {
+    writeFileSync(plain, dec.stdout, { mode: 0o600 });
+    const enc = spawnSync("sops",
+      ["--encrypt", "--age", recipients.join(","), "--input-type", "json", "--output-type", "yaml", plain],
+      { encoding: "utf-8", env });
+    if (enc.status !== 0) throw new Error(`could not re-encrypt: ${enc.stderr?.trim()}`);
+    writeFileSync(storePath(home), enc.stdout);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });   // wipe the plaintext temp
+  }
   return recipients.length;
 }