@sebastienrousseau/dotfiles 0.2.481 → 0.2.499

package/scripts/security/manage-secrets.sh

@@ -1,415 +0,0 @@
-#!/usr/bin/env bash
-# Secure Configuration Management Script
-# Helps manage environment variables and secrets securely
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-readonly SCRIPT_DIR
-REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
-readonly REPO_ROOT
-readonly ENV_TEMPLATE="${REPO_ROOT}/.github/security-policies/environment-template.env"
-readonly ENV_LOCAL="${REPO_ROOT}/.env.local"
-
-# Color codes (respect NO_COLOR: https://no-color.org)
-if [[ -z "${NO_COLOR:-}" ]] && [[ -t 1 ]]; then
-  readonly RED='\033[0;31m'
-  readonly GREEN='\033[0;32m'
-  readonly YELLOW='\033[1;33m'
-  readonly BLUE='\033[0;34m'
-  readonly NC='\033[0m'
-else
-  readonly RED='' GREEN='' YELLOW='' BLUE='' NC=''
-fi
-
-# Help text
-show_help() {
-  cat <<EOF
-Secure Configuration Management
-
-USAGE:
-    $0 <command> [options]
-
-COMMANDS:
-    init        Initialize secure environment configuration
-    validate    Validate environment variables and security
-    template    Show environment variable template
-    check       Check for hardcoded secrets
-    rotate      Help rotate secrets and tokens
-    clean       Clean temporary files and logs
-
-OPTIONS:
-    -h, --help     Show this help message
-    -v, --verbose  Verbose output
-    -f, --force    Force operations (use with caution)
-
-EXAMPLES:
-    $0 init                 # Initialize .env.local from template
-    $0 validate             # Validate current configuration
-    $0 check                # Scan for hardcoded secrets
-    $0 rotate github        # Guide for rotating GitHub tokens
-    $0 clean                # Clean up temporary files
-
-SECURITY NOTES:
-    - Never commit .env.local to version control
-    - Use different tokens for different environments
-    - Rotate secrets regularly (every 90 days)
-    - Use least-privilege principle
-EOF
-}
-
-# Logging functions
-log_info() {
-  echo -e "${BLUE}[INFO]${NC} $*"
-}
-
-log_success() {
-  echo -e "${GREEN}[SUCCESS]${NC} $*"
-}
-
-log_warning() {
-  echo -e "${YELLOW}[WARNING]${NC} $*"
-}
-
-log_error() {
-  echo -e "${RED}[ERROR]${NC} $*"
-}
-
-# Initialize environment configuration
-init_config() {
-  local force_init=false
-  if [[ "${1:-}" == "--force" ]]; then
-    force_init=true
-  fi
-
-  log_info "Initializing secure environment configuration..."
-
-  if [[ -f "$ENV_LOCAL" ]] && [[ "$force_init" == "false" ]]; then
-    log_warning ".env.local already exists"
-    echo "Use --force to overwrite, or edit the existing file manually"
-    return 1
-  fi
-
-  if [[ ! -f "$ENV_TEMPLATE" ]]; then
-    log_error "Environment template not found: $ENV_TEMPLATE"
-    return 1
-  fi
-
-  # Copy template
-  cp "$ENV_TEMPLATE" "$ENV_LOCAL"
-
-  # Set secure permissions
-  chmod 600 "$ENV_LOCAL"
-
-  log_success ".env.local created from template"
-  log_info "Next steps:"
-  echo "  1. Edit .env.local and configure required variables"
-  echo "  2. Run '$0 validate' to check configuration"
-  echo "  3. Source the file: source .env.local"
-
-  # Add to .gitignore if not present
-  if [[ -f "${REPO_ROOT}/.gitignore" ]]; then
-    if ! grep -q "\.env\.local" "${REPO_ROOT}/.gitignore"; then
-      echo ".env.local" >>"${REPO_ROOT}/.gitignore"
-      log_info "Added .env.local to .gitignore"
-    fi
-  fi
-}
-
-# Validate environment configuration
-validate_config() {
-  log_info "Validating environment configuration..."
-
-  local issues=0
-
-  # Check if .env.local exists
-  if [[ ! -f "$ENV_LOCAL" ]]; then
-    log_error ".env.local not found. Run '$0 init' to create it."
-    return 1
-  fi
-
-  # Check file permissions
-  local perms
-  perms=$(stat -c %a "$ENV_LOCAL" 2>/dev/null || stat -f %A "$ENV_LOCAL")
-  if [[ "$perms" != "600" ]]; then
-    log_warning ".env.local has incorrect permissions ($perms). Should be 600."
-    log_info "Fix with: chmod 600 $ENV_LOCAL"
-    issues=$((issues + 1))
-  fi
-
-  # Source and validate environment
-  # shellcheck source=/dev/null
-  if source "$ENV_LOCAL" 2>/dev/null; then
-    log_success ".env.local loads successfully"
-  else
-    log_error ".env.local has syntax errors"
-    issues=$((issues + 1))
-  fi
-
-  # Check for required variables
-  local required_vars=("GITHUB_TOKEN")
-
-  for var in "${required_vars[@]}"; do
-    if [[ -z "${!var:-}" ]]; then
-      log_warning "Required variable $var is not set or empty"
-      issues=$((issues + 1))
-    else
-      log_success "$var is configured"
-    fi
-  done
-
-  # Check for security patterns
-  if grep -E '(password|secret|key|token)="[^"]{1,}"' "$ENV_LOCAL" >/dev/null 2>&1; then
-    log_warning "Found configured credentials (this is expected)"
-  fi
-
-  if [[ $issues -eq 0 ]]; then
-    log_success "Environment configuration is valid"
-    return 0
-  else
-    log_error "Found $issues configuration issues"
-    return 1
-  fi
-}
-
-# Show template
-show_template() {
-  if [[ -f "$ENV_TEMPLATE" ]]; then
-    log_info "Environment variable template:"
-    echo "----------------------------------------"
-    cat "$ENV_TEMPLATE"
-  else
-    log_error "Template file not found: $ENV_TEMPLATE"
-    return 1
-  fi
-}
-
-# Check for hardcoded secrets
-check_secrets() {
-  log_info "Scanning for hardcoded secrets..."
-
-  local violations=0
-
-  # Define patterns to search for
-  local patterns=(
-    'password\s*=\s*["\047][^"\047]*["\047]'
-    'token\s*=\s*["\047][^"\047]*["\047]'
-    'secret\s*=\s*["\047][^"\047]*["\047]'
-    'key\s*=\s*["\047][^"\047]*["\047]'
-    'AKIA[0-9A-Z]{16}'     # AWS Access Key
-    'ghp_[A-Za-z0-9_]{36}' # GitHub Personal Access Token
-    '[0-9a-f]{32,64}'      # Potential hash/token
-  )
-
-  # Search in specific file types
-  local file_patterns=("*.sh" "*.yml" "*.yaml" "*.toml" "*.json" "*.tmpl")
-
-  for file_pattern in "${file_patterns[@]}"; do
-    while IFS= read -r -d '' file; do
-      # Skip the security management files themselves
-      if [[ "$file" =~ (environment-template\.env|manage-secrets\.sh|\.env\.local) ]]; then
-        continue
-      fi
-
-      for pattern in "${patterns[@]}"; do
-        if grep -H -n -E -i "$pattern" "$file" 2>/dev/null; then
-          log_warning "Potential secret in $file"
-          violations=$((violations + 1))
-        fi
-      done
-    done < <(find "$REPO_ROOT" -name "$file_pattern" -not -path "*/.git/*" -print0)
-  done
-
-  if [[ $violations -eq 0 ]]; then
-    log_success "No hardcoded secrets detected"
-  else
-    log_error "Found $violations potential hardcoded secrets"
-    log_info "Review the output above and replace with environment variables"
-  fi
-
-  return $violations
-}
-
-# Guide for rotating secrets
-rotate_secrets() {
-  local service="${1:-}"
-
-  if [[ -z "$service" ]]; then
-    log_info "Available rotation guides:"
-    echo "  github    - GitHub Personal Access Tokens"
-    echo "  aws       - AWS Access Keys"
-    echo "  gcp       - GCP Service Account Keys"
-    echo "  ssh       - SSH Keys"
-    echo ""
-    echo "Usage: $0 rotate <service>"
-    return 0
-  fi
-
-  case "$service" in
-    "github")
-      cat <<'EOF'
-GitHub Token Rotation Guide:
-
-1. Create new Personal Access Token:
-   - Go to https://github.com/settings/tokens
-   - Click "Generate new token (classic)"
-   - Set expiration (90 days recommended)
-   - Select minimal required scopes:
-     • repo (for private repos)
-     • workflow (for GitHub Actions)
-
-2. Update environment:
-   - Edit .env.local
-   - Replace GITHUB_TOKEN value
-   - Test with: gh auth status
-
-3. Update CI/CD:
-   - Go to repository Settings → Secrets and variables → Actions
-   - Update GITHUB_TOKEN secret
-
-4. Revoke old token:
-   - Go back to https://github.com/settings/tokens
-   - Find old token and click "Delete"
-
-5. Verify:
-   - Run: scripts/security/manage-secrets.sh validate
-   - Test repository operations
-EOF
-      ;;
-    "aws")
-      cat <<'EOF'
-AWS Access Key Rotation Guide:
-
-1. Create new access key:
-   - AWS Console → IAM → Users → [Your User] → Security credentials
-   - Click "Create access key"
-   - Download credentials
-
-2. Update environment:
-   - Edit .env.local
-   - Update AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
-   - Test with: aws sts get-caller-identity
-
-3. Update CI/CD:
-   - Update secrets in GitHub repository
-   - Test AWS operations in pipeline
-
-4. Deactivate old key:
-   - In AWS Console, set old key status to "Inactive"
-   - Wait 24-48 hours, monitor for issues
-   - Delete old key if no issues
-
-5. Security best practices:
-   - Use IAM roles where possible
-   - Implement least privilege access
-   - Enable CloudTrail logging
-EOF
-      ;;
-    "ssh")
-      cat <<'EOF'
-SSH Key Rotation Guide:
-
-1. Generate new SSH key:
-   - Run: ssh-keygen -t ed25519 -C "your_email@example.com"
-   - Save to new file: ~/.ssh/id_ed25519_new
-
-2. Add to SSH agent:
-   - Run: ssh-add ~/.ssh/id_ed25519_new
-
-3. Update remote services:
-   - GitHub: Settings → SSH and GPG keys → Add new key
-   - Servers: Add to ~/.ssh/authorized_keys
-
-4. Update local config:
-   - Edit ~/.ssh/config
-   - Update IdentityFile paths
-
-5. Test connections:
-   - ssh -T git@github.com
-   - Test server connections
-
-6. Remove old keys:
-   - Remove from remote authorized_keys
-   - Remove from local ~/.ssh/
-   - Remove from SSH agent
-EOF
-      ;;
-    *)
-      log_error "Unknown service: $service"
-      log_info "Available services: github, aws, gcp, ssh"
-      return 1
-      ;;
-  esac
-}
-
-# Clean temporary files
-clean_files() {
-  log_info "Cleaning temporary files and logs..."
-
-  local files_to_clean=(
-    "${REPO_ROOT}/.security-audit.log"
-    "${REPO_ROOT}/security-report.md"
-    "${REPO_ROOT}/trivy-results.sarif"
-    "${REPO_ROOT}/grype-results.sarif"
-    "${REPO_ROOT}/checkov-results.sarif"
-    "${REPO_ROOT}/shellcheck-results.sarif"
-    "${REPO_ROOT}/container-scan.sarif"
-    "${REPO_ROOT}/security-attestation.json"
-  )
-
-  local cleaned=0
-  for file in "${files_to_clean[@]}"; do
-    if [[ -f "$file" ]]; then
-      rm "$file"
-      log_success "Removed $file"
-      cleaned=$((cleaned + 1))
-    fi
-  done
-
-  if [[ $cleaned -eq 0 ]]; then
-    log_info "No temporary files to clean"
-  else
-    log_success "Cleaned $cleaned temporary files"
-  fi
-}
-
-# Main function
-main() {
-  local command="${1:-}"
-  shift || true
-
-  case "$command" in
-    "init")
-      init_config "$@"
-      ;;
-    "validate")
-      validate_config
-      ;;
-    "template")
-      show_template
-      ;;
-    "check")
-      check_secrets
-      ;;
-    "rotate")
-      rotate_secrets "$@"
-      ;;
-    "clean")
-      clean_files
-      ;;
-    "-h" | "--help" | "help" | "")
-      show_help
-      ;;
-    *)
-      log_error "Unknown command: $command"
-      echo ""
-      show_help
-      exit 1
-      ;;
-  esac
-}
-
-# Execute if run directly
-if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
-  main "$@"
-fi

package/scripts/security/telemetry-kill.sh

@@ -1,28 +0,0 @@
-#!/bin/sh
-set -e
-
-if [ "${DOTFILES_TELEMETRY:-}" != "1" ]; then
-  echo "Telemetry script is disabled by default."
-  echo "Re-run with DOTFILES_TELEMETRY=1 to apply."
-  exit 1
-fi
-
-case "$(uname -s)" in
-  Linux)
-    echo "Disabling Ubuntu crash reporting (whoopsie/apport)..."
-    sudo systemctl disable --now whoopsie 2>/dev/null || true
-    sudo systemctl disable --now apport 2>/dev/null || true
-    sudo systemctl mask apport 2>/dev/null || true
-    echo "Disabling popularity-contest (if present)..."
-    sudo systemctl disable --now popularity-contest 2>/dev/null || true
-    ;;
-  Darwin)
-    echo "Disabling macOS analytics (manual confirmation may be required)."
-    sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit -bool false || true
-    sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist ThirdPartyDataSubmit -bool false || true
-    ;;
-  *)
-    echo "Unsupported OS for telemetry kill."
-    exit 1
-    ;;
-esac

package/scripts/security/usb-safety.sh

@@ -1,29 +0,0 @@
-#!/bin/sh
-set -e
-
-if [ "${DOTFILES_USB_SAFETY:-}" != "1" ]; then
-  echo "USB safety script is disabled by default."
-  echo "Re-run with DOTFILES_USB_SAFETY=1 to apply."
-  exit 1
-fi
-
-case "$(uname -s)" in
-  Linux)
-    if command -v gsettings >/dev/null; then
-      echo "Disabling GNOME automount for removable media..."
-      gsettings set org.gnome.desktop.media-handling automount false || true
-      gsettings set org.gnome.desktop.media-handling automount-open false || true
-    else
-      echo "gsettings not found."
-      exit 1
-    fi
-    ;;
-  Darwin)
-    echo "macOS does not expose a simple CLI toggle for USB automount."
-    echo "Use System Settings > General > Login Items > External disks."
-    ;;
-  *)
-    echo "Unsupported OS for USB safety."
-    exit 1
-    ;;
-esac

package/scripts/tests/README.md

@@ -1,241 +0,0 @@
-# Dotfiles Test Suite
-
-A comprehensive shell testing framework for validating dotfiles functionality.
-
-## Directory Structure
-
-```
-scripts/tests/
-├── framework/
-│   ├── test_runner.sh      # Main test runner
-│   ├── assertions.sh       # Assert functions
-│   └── mocks.sh            # Mock utilities
-├── unit/
-│   ├── test_extract.sh     # Tests for extract function
-│   ├── test_backup.sh      # Tests for backup function
-│   ├── test_genpass.sh     # Tests for genpass function
-│   ├── test_rd.sh          # Tests for rd function
-│   └── test_cd_aliases.sh  # Tests for cd aliases
-├── integration/
-│   └── test_install.sh     # Tests for install.sh
-└── README.md               # This file
-```
-
-## Quick Start
-
-### Run All Unit Tests
-
-```bash
-./scripts/tests/framework/test_runner.sh
-```
-
-### Run Specific Test
-
-```bash
-# Run only extract tests
-./scripts/tests/framework/test_runner.sh extract
-
-# Run only backup tests
-./scripts/tests/framework/test_runner.sh backup
-
-# Run only genpass tests
-./scripts/tests/framework/test_runner.sh genpass
-```
-
-### Run with Integration Tests
-
-```bash
-# Using environment variable
-RUN_INTEGRATION=1 ./scripts/tests/framework/test_runner.sh
-
-# Using flag
-./scripts/tests/framework/test_runner.sh -i
-```
-
-### Run Individual Test File
-
-```bash
-# Source assertions and run directly
-source ./scripts/tests/framework/assertions.sh
-source ./scripts/tests/unit/test_extract.sh
-print_summary
-```
-
-## Test Framework
-
-### Assertions
-
-The framework provides these assertion functions:
-
-| Function | Description |
-|----------|-------------|
-| `assert_equals expected actual [msg]` | Assert two values are equal |
-| `assert_not_equals unexpected actual [msg]` | Assert two values differ |
-| `assert_exit_code code command` | Assert command exits with code |
-| `assert_output_contains needle command` | Assert output contains string |
-| `assert_output_not_contains needle command` | Assert output lacks string |
-| `assert_output_matches pattern command` | Assert output matches regex |
-| `assert_file_exists path [msg]` | Assert file exists |
-| `assert_file_not_exists path [msg]` | Assert file doesn't exist |
-| `assert_dir_exists path [msg]` | Assert directory exists |
-| `assert_dir_not_exists path [msg]` | Assert directory doesn't exist |
-| `assert_true condition [msg]` | Assert condition is true |
-| `assert_false condition [msg]` | Assert condition is false |
-| `assert_empty value [msg]` | Assert string is empty |
-| `assert_not_empty value [msg]` | Assert string is not empty |
-| `assert_file_contains file needle [msg]` | Assert file contains text |
-
-### Mocks
-
-The mock library provides utilities for test isolation:
-
-| Function | Description |
-|----------|-------------|
-| `mock_init` | Initialize mock environment |
-| `mock_command name output [exit_code]` | Create mock command |
-| `mock_command_spy name [output] [exit_code]` | Create mock that records calls |
-| `mock_get_calls name` | Get spy call history |
-| `mock_call_count name` | Get number of spy calls |
-| `mock_file content [filename]` | Create temp file with content |
-| `mock_dir [prefix]` | Create temp directory |
-| `mock_archive type [content]` | Create mock archive file |
-| `mock_env var_name value` | Set environment variable |
-| `mock_cleanup` | Clean up all mocks |
-
-## Writing Tests
-
-### Basic Test Structure
-
-```bash
-#!/usr/bin/env bash
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/../framework/assertions.sh"
-source "$SCRIPT_DIR/../framework/mocks.sh"
-
-# Source function being tested
-source "$REPO_ROOT/.chezmoitemplates/functions/myfunction.sh"
-
-# Test case
-test_start "my_function_basic"
-output=$(myfunction "arg" 2>&1)
-assert_equals "expected" "$output" "should return expected"
-
-# Another test
-test_start "my_function_error"
-output=$(myfunction 2>&1)
-exit_code=$?
-assert_equals "1" "$exit_code" "should fail without args"
-```
-
-### Using Mocks
-
-```bash
-test_start "function_with_mock"
-# Create temp directory
-test_dir=$(mock_dir "test")
-test_file="$test_dir/file.txt"
-echo "content" > "$test_file"
-
-# Run test
-result=$(myfunction "$test_file")
-
-# Verify
-assert_equals "expected" "$result"
-
-# Cleanup is automatic via trap
-```
-
-### Test Naming Convention
-
-- Test files: `test_<functionality>.sh`
-- Test functions: Descriptive names with `test_start`
-- Example: `test_start "extract_handles_missing_file"`
-
-## Environment Variables
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `RUN_INTEGRATION` | `0` | Set to `1` to run integration tests |
-| `VERBOSE` | `0` | Set to `1` for verbose output |
-| `REPO_ROOT` | Auto-detected | Repository root directory |
-| `TESTS_DIR` | Auto-detected | Tests directory |
-
-## Test Categories
-
-### Unit Tests
-
-Located in `scripts/tests/unit/`. These test individual functions in isolation:
-
-- **test_extract.sh** - Archive extraction function
-- **test_backup.sh** - Backup creation function
-- **test_genpass.sh** - Password generation function
-- **test_rd.sh** - Directory removal function (with security tests)
-- **test_cd_aliases.sh** - Directory navigation aliases
-
-### Integration Tests
-
-Located in `scripts/tests/integration/`. These test complete workflows:
-
-- **test_install.sh** - Installation script validation
-
-## CI/CD Integration
-
-Add to your CI pipeline:
-
-```yaml
-# GitHub Actions example
-- name: Run Tests
-  run: |
-    chmod +x ./scripts/tests/framework/test_runner.sh
-    ./scripts/tests/framework/test_runner.sh
-
-- name: Run Integration Tests
-  run: |
-    RUN_INTEGRATION=1 ./scripts/tests/framework/test_runner.sh
-```
-
-## Best Practices
-
-1. **Isolation**: Each test should be independent
-2. **Cleanup**: Use mocks that auto-cleanup via traps
-3. **No Sleep**: Avoid `sleep` or hardcoded delays
-4. **Descriptive Names**: Test names should describe what's being tested
-5. **Edge Cases**: Test error conditions, not just happy paths
-6. **Security**: Include tests for dangerous input rejection
-
-## Troubleshooting
-
-### Tests Not Found
-
-Ensure test files match the pattern `test_*.sh` and are executable:
-
-```bash
-chmod +x scripts/tests/unit/test_*.sh
-chmod +x scripts/tests/integration/test_*.sh
-```
-
-### Function Not Available
-
-If a test shows "function not available", the source file may not exist:
-
-```bash
-# Check if function file exists
-ls -la .chezmoitemplates/functions/
-```
-
-### Mock Cleanup Issues
-
-If mocks aren't cleaning up, ensure you're not running with `set -e` before mock operations that might fail.
-
-## Contributing
-
-When adding new functions to the dotfiles:
-
-1. Create corresponding test file in `unit/`
-2. Test happy path and error conditions
-3. Include security-relevant test cases
-4. Run full test suite before committing
-
----
-
-Made with ❤️ by [Sebastien Rousseau](https://github.com/sebastienrousseau)