@sebastienrousseau/dotfiles 0.2.520 → 0.2.521

package/scripts/secrets/age-init.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SECRETS_DIR="$HOME/.config/chezmoi"
-KEY_FILE="$SECRETS_DIR/key.txt"
-CONFIG_FILE="$SECRETS_DIR/chezmoi.toml"
-
-mkdir -p "$SECRETS_DIR"
-
-if ! command -v age-keygen >/dev/null; then
-  echo "age-keygen not found. Install 'age' first." >&2
-  exit 1
-fi
-
-if [[ ! -f "$KEY_FILE" ]]; then
-  age-keygen -o "$KEY_FILE"
-  chmod 600 "$KEY_FILE"
-  echo "Age key created at $KEY_FILE"
-else
-  echo "Age key already exists: $KEY_FILE"
-fi
-
-recipient=$(age-keygen -y "$KEY_FILE")
-
-python3 - "$CONFIG_FILE" "$KEY_FILE" "$recipient" <<'PY'
-import sys
-import json
-from pathlib import Path
-
-config_path = Path(sys.argv[1])
-key_file = sys.argv[2]
-recipient = sys.argv[3]
-
-content = ""
-if config_path.exists():
-    content = config_path.read_text(encoding="utf-8")
-
-lines = content.splitlines()
-
-# Remove existing encryption keys and age blocks regardless of where a previous
-# run placed them.
-out = []
-in_age = False
-for line in lines:
-    if line.strip().startswith("[age]"):
-        in_age = True
-        continue
-    if in_age:
-        if line.strip().startswith("["):
-            in_age = False
-            out.append(line)
-        else:
-            continue
-    else:
-        if line.strip().startswith("encryption ="):
-            continue
-        out.append(line)
-
-# Keep encryption at top level; chezmoi warns when it is nested under [data].
-insert_at = 0
-for i, line in enumerate(out):
-    if line.strip().startswith("["):
-        insert_at = i
-        break
-else:
-    insert_at = len(out)
-
-top_level = ["encryption = \"age\"", ""]
-out[insert_at:insert_at] = top_level
-
-# Append updated age config (use json.dumps for safe string escaping)
-out.append("")
-out.append("[age]")
-out.append(f"identity = {json.dumps(key_file)}")
-out.append(f"recipient = {json.dumps(recipient)}")
-
-config_path.write_text("\n".join(out).rstrip() + "\n", encoding="utf-8")
-PY
-
-echo "Updated $CONFIG_FILE with age encryption settings."

package/scripts/secrets/create-secrets-file.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-OUT_FILE="${1:-$HOME/.config/chezmoi/encrypted_secrets.env.age}"
-KEYRING_DIR="$HOME/.config/chezmoi"
-AGE_KEY="$KEYRING_DIR/key.txt"
-
-if [ ! -f "$AGE_KEY" ]; then
-  echo "Age identity not found: $AGE_KEY"
-  echo "Run: dot secrets-init"
-  exit 1
-fi
-
-if ! command -v age >/dev/null; then
-  echo "age not found. Install it first."
-  exit 1
-fi
-
-if [ -f "$OUT_FILE" ]; then
-  echo "Secrets file already exists: $OUT_FILE"
-  exit 0
-fi
-
-recipient="$(age-keygen -y "$AGE_KEY")"
-mkdir -p "$(dirname "$OUT_FILE")"
-
-tmp_secrets="$(umask 077 && mktemp)" || exit 1
-tmp_recipient="$(umask 077 && mktemp)" || exit 1
-trap 'rm -f "$tmp_secrets" "$tmp_recipient"' EXIT
-
-printf "%s\n" "# Add secrets as KEY=VALUE" "EXAMPLE_TOKEN=change_me" >"$tmp_secrets"
-printf "%s" "$recipient" >"$tmp_recipient"
-
-age -R "$tmp_recipient" -o "$OUT_FILE" "$tmp_secrets"
-
-chmod 600 "$OUT_FILE"
-
-cat <<MSG
-Created encrypted secrets file:
-  $OUT_FILE
-
-Edit it with:
-  dot secrets
-MSG

package/scripts/secrets/encrypt-ssh-key.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-KEY_PATH="${1:-$HOME/.ssh/id_ed25519}"
-OUT_FILE="${2:-$HOME/.config/chezmoi/encrypted_id_ed25519.age}"
-KEYRING_DIR="$HOME/.config/chezmoi"
-AGE_KEY="$KEYRING_DIR/key.txt"
-
-if [ ! -f "$KEY_PATH" ]; then
-  echo "SSH key not found: $KEY_PATH"
-  exit 1
-fi
-
-if [ ! -f "$AGE_KEY" ]; then
-  echo "Age identity not found: $AGE_KEY"
-  echo "Run: dot secrets-init"
-  exit 1
-fi
-
-if ! command -v age >/dev/null; then
-  echo "age not found. Install it first."
-  exit 1
-fi
-
-recipient="$(age-keygen -y "$AGE_KEY")"
-mkdir -p "$(dirname "$OUT_FILE")"
-
-if [ -f "$OUT_FILE" ]; then
-  echo "Encrypted file already exists: $OUT_FILE"
-  exit 0
-fi
-
-age -R <(printf "%s" "$recipient") -o "$OUT_FILE" "$KEY_PATH"
-chmod 600 "$OUT_FILE"
-
-cat <<MSG
-Encrypted SSH key written to:
-  $OUT_FILE
-
-This file is local only. If you want to track it in dotfiles, run:
-  chezmoi add --encrypt $OUT_FILE
-MSG

package/scripts/security/backup.sh

@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-## Create compressed backup of home directory.
-##
-## Archives the home directory (excluding cache and trash) to a timestamped
-# shellcheck disable=SC1091
-## .tgz file. Supports custom source and destination directories via
-## environment variables.
-##
-## # Usage
-## dot backup
-## DOTFILES_BACKUP_DIR=/mnt/backup dot backup
-##
-## # Dependencies
-## - tar: Archive creation
-##
-## # Environment Variables
-## | Variable | Default | Description |
-## |----------|---------|-------------|
-## | DOTFILES_BACKUP_DIR | ~/.backups | Backup destination |
-## | DOTFILES_BACKUP_SRC | ~/ | Source directory |
-##
-## # Platform Notes
-## - macOS: Uses BSD tar
-## - Linux: Uses GNU tar
-## - WSL: Backup stored in Linux filesystem for performance
-##
-## # Security
-## Does not encrypt backups. Use age/gpg for sensitive data.
-##
-## # Idempotency
-## Creates new timestamped backup on each run.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-
-ui_init
-ui_header "Backup"
-
-BACKUP_DIR="${DOTFILES_BACKUP_DIR:-$HOME/.backups}"
-SRC_DIR="${DOTFILES_BACKUP_SRC:-$HOME}"
-STAMP=$(date +%Y%m%d-%H%M%S)
-OUT="$BACKUP_DIR/dotfiles-backup-$STAMP.tgz"
-
-mkdir -p "$BACKUP_DIR"
-
-if ! tar --exclude="$HOME/.cache" --exclude="$HOME/.local/share/Trash" -czf "$OUT" "$SRC_DIR"; then
-  ui_err "Backup failed"
-  rm -f "$OUT"
-  exit 1
-fi
-
-ui_ok "Backup written" "$OUT"

package/scripts/security/check-disclosure-key-expiry.sh

@@ -1,111 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-#
-# scripts/security/check-disclosure-key-expiry.sh
-#
-# Reads the disclosure public key from `docs/security/security-pubkey.asc`,
-# parses its expiry, and exits non-zero when the remaining lifetime is
-# below threshold. Closes the R3 audit N2 finding (no automated alert
-# for the 2029-05-15 expiry).
-#
-# Two thresholds:
-#   --warn-days N    Emit a `::warning::` if expiry is < N days away.
-#                    Default 90.
-#   --fail-days N    Exit 1 (CI failure) if expiry is < N days away.
-#                    Default 30.
-#
-# Usage:
-#   bash scripts/security/check-disclosure-key-expiry.sh
-#   bash scripts/security/check-disclosure-key-expiry.sh --warn-days 180 --fail-days 60
-#
-# Designed to run from `.github/workflows/verify-gpg-wkd.yml` on the
-# weekly schedule, and from a maintainer's local pre-release sanity
-# check. Does NOT require network — reads the in-repo .asc only.
-
-set -euo pipefail
-
-WARN_DAYS=90
-FAIL_DAYS=30
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --warn-days)
-      WARN_DAYS="$2"
-      shift 2
-      ;;
-    --fail-days)
-      FAIL_DAYS="$2"
-      shift 2
-      ;;
-    -h | --help)
-      sed -n '5,25p' "${BASH_SOURCE[0]}"
-      exit 0
-      ;;
-    *)
-      echo "Unknown arg: $1" >&2
-      exit 2
-      ;;
-  esac
-done
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-ASC="$REPO_ROOT/docs/security/security-pubkey.asc"
-
-if [[ ! -f "$ASC" ]]; then
-  echo "::error::no public key at $ASC" >&2
-  exit 2
-fi
-
-if ! command -v gpg >/dev/null 2>&1; then
-  echo "::warning::gpg not installed — cannot verify key expiry" >&2
-  exit 0
-fi
-
-# Import into a throwaway keyring so we don't pollute the user's real one.
-GNUPGHOME="$(mktemp -d -t dot-disclosure-key.XXXXXX)"
-export GNUPGHOME
-chmod 700 "$GNUPGHOME"
-trap 'rm -rf "$GNUPGHOME"' EXIT
-
-# gpg can emit harmless warnings ("keyboxd older than us", "gpg-agent
-# IPC failed" in fresh GNUPGHOME, etc.) and exit non-zero under
-# `set -e` even when the import itself succeeded. Verify success by
-# checking the err log for the literal `imported: N` (N >= 1) line
-# rather than trusting gpg's exit code.
-gpg --batch --import "$ASC" >/dev/null 2>"$GNUPGHOME/import.err" || true
-if ! grep -qE '^gpg:[[:space:]]*imported: [1-9]' "$GNUPGHOME/import.err"; then
-  echo "::error::gpg import failed for $ASC" >&2
-  cat "$GNUPGHOME/import.err" >&2
-  exit 2
-fi
-
-# `--with-colons` field 7 of the `pub:` line is the expiry in Unix
-# seconds; 0 means no expiry.
-expires=$(gpg --with-colons --fingerprint 2>/dev/null | awk -F: '/^pub:/{print $7; exit}')
-
-if [[ -z "$expires" || "$expires" == "0" ]]; then
-  echo "::warning::disclosure key has no expiry — set one per docs/security/KEY_ROTATION.md" >&2
-  exit 0
-fi
-
-now=$(date -u +%s)
-remaining_days=$(((expires - now) / 86400))
-
-expires_date=$(date -u -r "$expires" '+%Y-%m-%d' 2>/dev/null || date -u -d "@$expires" '+%Y-%m-%d' 2>/dev/null || echo "(date format unknown)")
-
-echo "Disclosure key expires: $expires_date ($remaining_days days from now)"
-echo "  warn threshold: $WARN_DAYS days"
-echo "  fail threshold: $FAIL_DAYS days"
-
-if ((remaining_days < FAIL_DAYS)); then
-  echo "::error::Disclosure key expires in $remaining_days days. Rotate now per docs/security/KEY_ROTATION.md." >&2
-  exit 1
-fi
-
-if ((remaining_days < WARN_DAYS)); then
-  echo "::warning::Disclosure key expires in $remaining_days days. Schedule rotation per docs/security/KEY_ROTATION.md." >&2
-fi
-
-exit 0

package/scripts/security/dns-doh.sh

@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-# shellcheck source=../../lib/dot/platform.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/platform.sh"
-
-DRY_RUN=0
-for arg in "$@"; do
-  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
-done
-_run_cmd() {
-  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
-}
-
-ui_init
-ui_header "DNS-over-HTTPS"
-
-if [[ "$DRY_RUN" -eq 1 ]]; then
-  ui_info "Mode" "dry-run (no changes will be made)"
-elif [ "${DOTFILES_DOH:-}" != "1" ]; then
-  ui_warn "DoH" "disabled by default"
-  ui_info "Re-run" "DOTFILES_DOH=1"
-  exit 1
-fi
-
-case "$(dot_platform_id)" in
-  linux | wsl)
-    if command -v resolvectl >/dev/null; then
-      ui_info "Enabling" "systemd-resolved DoH (Cloudflare)"
-      _run_cmd sudo resolvectl dns-over-https on
-      _run_cmd sudo resolvectl dns 1.1.1.1 1.0.0.1
-    else
-      ui_err "systemd-resolved" "not detected"
-      exit 1
-    fi
-    ;;
-  macos)
-    ui_info "Configure" "DoH in your browser"
-    exit 0
-    ;;
-  *)
-    ui_err "Unsupported OS" "DoH config"
-    exit 1
-    ;;
-esac

package/scripts/security/encryption-check.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-# shellcheck source=../../lib/dot/platform.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/platform.sh"
-
-ui_init
-ui_header "Encryption Check"
-
-case "$(dot_platform_id)" in
-  macos)
-    if command -v fdesetup >/dev/null; then
-      status=$(fdesetup status || true)
-      echo "$status"
-      echo "$status" | grep -qi "FileVault is On" && {
-        ui_ok "FileVault" "On"
-        exit 0
-      }
-      ui_warn "FileVault" "appears to be off"
-      exit 1
-    else
-      ui_err "fdesetup" "not found"
-      exit 1
-    fi
-    ;;
-  linux | wsl)
-    if command -v lsblk >/dev/null; then
-      lsblk_output=$(lsblk -f)
-      if command -v rg >/dev/null; then
-        if echo "$lsblk_output" | rg -i "crypto|luks" >/dev/null; then
-          ui_ok "LUKS" "encrypted block device detected"
-          exit 0
-        fi
-      else
-        if echo "$lsblk_output" | grep -Ei "crypto|luks" >/dev/null; then
-          ui_ok "LUKS" "encrypted block device detected"
-          exit 0
-        fi
-      fi
-      ui_warn "LUKS" "no crypto volume detected"
-      exit 1
-    fi
-    ;;
-  *)
-    ui_err "Unsupported OS" "encryption check"
-    exit 1
-    ;;
-esac