git.delta.rocks / fleet / refs/commits / d91d16dbe1e7

1use std::{2	collections::{BTreeMap, BTreeSet, HashSet},3	io::{self, Read, Write, stdin, stdout},4	path::PathBuf,5	slice,6};78use age::Recipient;9use anyhow::{Context, Result, anyhow, bail, ensure};10use chrono::{DateTime, Utc};11use clap::Parser;12use fleet_base::{13	fleetdata::{FleetSecret, FleetSecretPart, FleetSharedSecret, encrypt_secret_data},14	host::Config,15	opts::FleetOpts,16};17use fleet_shared::SecretData;18use nix_eval::{NixType, Value, nix_go, nix_go_json};19use owo_colors::OwoColorize;20use serde::Deserialize;21use tabled::{Table, Tabled};22use tokio::fs::read;23use tracing::{Instrument, error, info, info_span, warn};2425#[derive(Parser)]26pub enum Secret {27	AddManager,28	/// Force load host keys for all defined hosts29	ForceKeys,30	/// Add secret, data should be provided in stdin31	AddShared {32		/// Secret name33		name: String,34		/// Secret owners35		#[clap(long, short)]36		machines: Vec<String>,37		/// Override secret if already present38		#[clap(long)]39		force: bool,40		/// Secret public part41		#[clap(long)]42		public: Option<String>,43		/// Load public part from specified file44		#[clap(long)]45		public_file: Option<PathBuf>,4647		/// Create a notification on secret expiration48		#[clap(long)]49		expires_at: Option<DateTime<Utc>>,5051		/// Secret with this name already exists, override its value while keeping the same owners.52		#[clap(long)]53		re_add: bool,5455		/// How to name public secret part56		#[clap(long, short = 'p', default_value = "public")]57		public_part: String,58		/// How to name private secret part59		#[clap(short = 's', long, default_value = "secret")]60		part: String,61	},62	/// Add secret, data should be provided in stdin63	Add {64		/// Secret name65		name: String,66		/// Secret owner67		#[clap(short = 'm', long)]68		machine: String,69		/// Replace secret if already present70		#[clap(long)]71		replace: bool,72		/// Add new parts to existing secret73		#[clap(long)]74		merge: bool,75		/// Secret public part76		#[clap(long)]77		public: Option<String>,78		/// Load public part from specified file79		#[clap(long)]80		public_file: Option<PathBuf>,8182		/// How to name public secret part83		#[clap(short = 'p', long, default_value = "public")]84		public_part: String,85		/// How to name private secret part86		#[clap(short = 's', long, default_value = "secret")]87		part: String,88	},89	/// Read secret from remote host, requires sudo on said host90	Read {91		name: String,92		#[clap(short = 'm', long)]93		machine: String,9495		/// Which private secret part to read96		#[clap(short = 'p', long, default_value = "secret")]97		part: String,98	},99	/// Read secret from remote host, requires sudo on said host100	ReadShared {101		name: String,102		/// Which private secret part to read103		#[clap(short = 'p', long, default_value = "secret")]104		part: String,105		/// Which host should we use to decrypt, in case if reencryption is required, without106		/// regeneration107		#[clap(long)]108		prefer_identities: Vec<String>,109	},110	UpdateShared {111		name: String,112113		#[clap(short = 'm', long)]114		machine: Option<Vec<String>>,115116		#[clap(long)]117		add_machine: Vec<String>,118		#[clap(long)]119		remove_machine: Vec<String>,120121		/// Which host should we use to decrypt122		#[clap(long)]123		prefer_identities: Vec<String>,124	},125	Regenerate {126		/// Which host should we use to decrypt, in case if reencryption is required, without127		/// regeneration128		#[clap(long)]129		prefer_identities: Vec<String>,130		/// Only regenerate shared secrets131		#[clap(long)]132		skip_hosts: bool,133	},134	List {},135	Edit {136		name: String,137		#[clap(short = 'm', long)]138		machine: String,139140		#[clap(long)]141		add: bool,142143		/// Which private secret part to read144		#[clap(short = 'p', long, default_value = "secret")]145		part: String,146	},147}148149fn secret_needs_regeneration(150	secret: &FleetSecret,151	expected_generation_data: &serde_json::Value,152) -> bool {153	let data_is_expected = secret.generation_data == *expected_generation_data;154	// TODO: Leeway?155	let expired = secret156		.expires_at157		.map(|expiration| expiration < Utc::now())158		.unwrap_or(false);159	expired || !data_is_expected160}161162#[allow(clippy::too_many_arguments)]163#[tracing::instrument(skip(config, secret, field, prefer_identities))]164async fn maybe_regenerate_shared_secret(165	secret_name: &str,166	config: &Config,167	mut secret: FleetSharedSecret,168	field: Value,169	expected_owners: &[String],170	expected_generation_data: serde_json::Value,171	prefer_identities: &[String],172	// batch: Option<NixBuildBatch>,173) -> Result<FleetSharedSecret> {174	let original_set = secret.owners.clone();175176	let set = original_set.iter().collect::<BTreeSet<_>>();177	let expected_set = expected_owners.iter().collect::<BTreeSet<_>>();178179	let regeneration_required =180		secret_needs_regeneration(&secret.secret, &expected_generation_data);181182	if set == expected_set && !regeneration_required {183		info!("no need to update owner list, it is already correct");184		return Ok(secret);185	}186187	let should_regenerate = if regeneration_required {188		info!("secret has its generation data changed, regeneration is required");189		true190	} else if set.difference(&expected_set).next().is_some() {191		// TODO: Remove this warning for revokable secrets.192		warn!(193			"host was removed from secret owners, but until this host rebuild, the secret will still be stored on it."194		);195		nix_go_json!(field.regenerateOnOwnerRemoved)196	} else if expected_set.difference(&set).next().is_some() {197		nix_go_json!(field.regenerateOnOwnerAdded)198	} else {199		false200	};201202	if should_regenerate {203		info!("secret needs to be regenerated");204		let generated = generate_shared(205			config,206			secret_name,207			field,208			expected_owners.to_vec(),209			expected_generation_data,210			// batch,211		)212		.await?;213		Ok(generated)214	} else {215		// drop(batch);216		let identity_holder = if !prefer_identities.is_empty() {217			prefer_identities218				.iter()219				.find(|i| original_set.iter().any(|s| s == *i))220		} else {221			secret.owners.first()222		};223		let Some(identity_holder) = identity_holder else {224			bail!("no available holder found");225		};226227		for (part_name, part) in secret.secret.parts.iter_mut() {228			let _span = info_span!("part reencryption", part_name);229			if !part.raw.encrypted {230				continue;231			}232			let host = config.host(identity_holder).await?;233			let encrypted = host234				.reencrypt(part.raw.clone(), expected_owners.to_vec())235				.await?;236			part.raw = encrypted;237		}238239		secret.owners = expected_owners.to_vec();240		Ok(secret)241	}242}243244#[derive(Deserialize)]245#[serde(rename_all = "camelCase")]246enum GeneratorKind {247	Impure,248	Pure,249}250251async fn generate_pure(252	_config: &Config,253	_display_name: &str,254	_secret: Value,255	_default_generator: Value,256	_owners: &[String],257) -> Result<FleetSecret> {258	bail!("pure generators are broken for now")259}260async fn generate_impure(261	config: &Config,262	_display_name: &str,263	secret: Value,264	default_generator: Value,265	expected_owners: &[String],266	expected_generation_data: serde_json::Value,267	// batch: Option<NixBuildBatch>,268) -> Result<FleetSecret> {269	let generator = nix_go!(secret.generator);270	let on: Option<String> = nix_go_json!(default_generator.impureOn);271272	let nixpkgs = &config.nixpkgs;273274	let host = if let Some(on) = &on {275		config.host(on).await?276	} else {277		config.local_host()278	};279	let on_pkgs = host.pkgs().await?;280	let mk_secret_generators = nix_go!(on_pkgs.mkSecretGenerators);281282	let mut recipients = Vec::new();283	for owner in expected_owners {284		let key = config.key(owner).await?;285		recipients.push(key);286	}287	let generators = nix_go!(mk_secret_generators(Obj { recipients }));288	// FIXME: Apparently, // operator is slow in nix289	let pkgs_and_generators = on_pkgs.attrs_update(generators)?;290291	let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));292293	let generator = nix_go!(call_package(generator)(Obj {}));294295	// let generator = generator.build_maybe_batch(batch).await?;296	let generator = generator.build("out").await?;297	let generator = host.remote_derivation(&generator).await?;298299	let out_parent = host.mktemp_dir().await?;300	let out = format!("{out_parent}/out");301302	let mut r#gen = host.cmd(generator).await?;303	r#gen.env("out", &out);304	if on.is_none() {305		// This path is local, thus we can feed `OsString` directly to env var... But I don't think that's necessary to handle.306		let project_path: String = config307			.directory308			.clone()309			.into_os_string()310			.into_string()311			.map_err(|s| anyhow!("fleet project path is not utf-8: {s:?}"))?;312		r#gen.env("FLEET_PROJECT", project_path);313	}314	r#gen.run().await.context("impure generator")?;315316	{317		let marker = host.read_file_text(format!("{out}/marker")).await?;318		ensure!(marker == "SUCCESS", "generation not succeeded");319	}320321	let mut parts = BTreeMap::new();322	for part in host.read_dir(&out).await? {323		if part == "created_at" || part == "expires_at" || part == "marker" {324			continue;325		}326		let contents: SecretData = host327			.read_file_text(format!("{out}/{part}"))328			.await?329			.parse()330			.map_err(|e| anyhow!("failed to decode secret {out:?} part {part:?}: {e}"))?;331		parts.insert(part.to_owned(), FleetSecretPart { raw: contents });332	}333334	let created_at = host.read_file_value(format!("{out}/created_at")).await?;335	let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();336337	Ok(FleetSecret {338		created_at,339		expires_at,340		parts,341		generation_data: expected_generation_data,342	})343}344async fn generate(345	config: &Config,346	display_name: &str,347	secret: Value,348	expected_owners: &[String],349	expected_generation_data: serde_json::Value,350	// batch: Option<NixBuildBatch>,351) -> Result<FleetSecret> {352	let generator = nix_go!(secret.generator);353	// Can't properly check on nix module system level354	{355		let gen_ty = generator.type_of()?;356		if matches!(gen_ty, NixType::Null) {357			bail!("secret has no generator defined, can't automatically generate it.");358		}359		if matches!(gen_ty, NixType::Attrs) {360			if !generator.has_field("__functor")? {361				bail!("generator should be functor, got {gen_ty:?}");362			}363		} else if matches!(gen_ty, NixType::Function) {364			bail!("generator should be functor, got {gen_ty:?}");365		}366	}367	let nixpkgs = &config.nixpkgs;368	let default_pkgs = &config.default_pkgs;369	let default_mk_secret_generators = nix_go!(default_pkgs.mkSecretGenerators);370	// Generators provide additional information in passthru, to access371	// passthru we should call generator, but information about where this generator is supposed to build372	// is located in passthru... Thus evaluating generator on host.373	//374	// Maybe it is also possible to do some magic with __functor?375	//376	// I don't want to make modules always responsible for additional secret data anyway,377	// so it should be in derivation, and not in the secret data itself.378	let generators = nix_go!(default_mk_secret_generators(Obj {379		recipients: <Vec<String>>::new(),380	}));381	let pkgs_and_generators = default_pkgs.clone().attrs_update(generators)?;382383	let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));384	let default_generator = nix_go!(call_package(generator)(Obj {}));385386	let kind: GeneratorKind = nix_go_json!(default_generator.generatorKind);387388	match kind {389		GeneratorKind::Impure => {390			generate_impure(391				config,392				display_name,393				secret,394				default_generator,395				expected_owners,396				expected_generation_data,397				// batch,398			)399			.await400		}401		GeneratorKind::Pure => {402			generate_pure(403				config,404				display_name,405				secret,406				default_generator,407				expected_owners,408			)409			.await410		}411	}412}413async fn generate_shared(414	config: &Config,415	display_name: &str,416	secret: Value,417	expected_owners: Vec<String>,418	expected_generation_data: serde_json::Value,419	// batch: Option<NixBuildBatch>,420) -> Result<FleetSharedSecret> {421	// let owners: Vec<String> = nix_go_json!(secret.expectedOwners);422	Ok(FleetSharedSecret {423		secret: generate(424			config,425			display_name,426			secret,427			&expected_owners,428			expected_generation_data,429			// batch,430		)431		.await?,432		owners: expected_owners,433	})434}435436async fn parse_public(437	public: Option<String>,438	public_file: Option<PathBuf>,439) -> Result<Option<SecretData>> {440	Ok(match (public, public_file) {441		(Some(v), None) => Some(SecretData {442			data: v.into(),443			encrypted: false,444		}),445		(None, Some(v)) => Some(SecretData {446			data: read(v).await?,447			encrypted: false,448		}),449		(Some(_), Some(_)) => {450			bail!("only public or public_file should be set")451		}452		(None, None) => None,453	})454}455456async fn parse_secret() -> Result<Option<Vec<u8>>> {457	let mut input = vec![];458	stdin().read_to_end(&mut input)?;459	if input.is_empty() {460		Ok(None)461	} else {462		Ok(Some(input))463	}464}465466fn parse_machines(467	initial: Vec<String>,468	machines: Option<Vec<String>>,469	mut add_machines: Vec<String>,470	mut remove_machines: Vec<String>,471) -> Result<Vec<String>> {472	if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {473		bail!("no operation");474	}475476	let initial_machines = initial.clone();477	let mut target_machines = initial;478	info!("Currently encrypted for {initial_machines:?}");479480	// ensure!(machines.is_some() || !add_machines.is_empty() || )481	if let Some(machines) = machines {482		ensure!(483			add_machines.is_empty() && remove_machines.is_empty(),484			"can't combine --machines and --add-machines/--remove-machines"485		);486		let target = initial_machines.iter().collect::<HashSet<_>>();487		let source = machines.iter().collect::<HashSet<_>>();488		for removed in target.difference(&source) {489			remove_machines.push((*removed).clone());490		}491		for added in source.difference(&target) {492			add_machines.push((*added).clone());493		}494	}495496	for machine in &remove_machines {497		let mut removed = false;498		while let Some(pos) = target_machines.iter().position(|m| m == machine) {499			target_machines.swap_remove(pos);500			removed = true;501		}502		if !removed {503			warn!("secret is not enabled for {machine}");504		}505	}506	for machine in &add_machines {507		if target_machines.iter().any(|m| m == machine) {508			warn!("secret is already added to {machine}");509		} else {510			target_machines.push(machine.to_owned());511		}512	}513	if !remove_machines.is_empty() {514		// TODO: maybe force secret regeneration?515		// Not that useful without revokation.516		warn!(517			"secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret"518		);519	}520	Ok(target_machines)521}522impl Secret {523	pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> {524		match self {525			Secret::AddManager => {526				todo!("part of fleet-pusher")527			}528			Secret::ForceKeys => {529				for host in config.list_hosts().await? {530					if opts.should_skip(&host).await? {531						continue;532					}533					config.key(&host.name).await?;534				}535			}536			Secret::AddShared {537				mut machines,538				name,539				force,540				public,541				public_part: public_name,542				public_file,543				expires_at,544				re_add,545				part: part_name,546			} => {547				// TODO: Forbid updating secrets with set expectedOwners (= not user-managed).548549				let exists = config.has_shared(&name);550				if exists && !force && !re_add {551					bail!("secret already defined");552				}553				if re_add {554					// Fixme: use clap to limit this usage555					ensure!(!force, "--force and --readd are not compatible");556					ensure!(exists, "secret doesn't exists");557					ensure!(558						machines.is_empty(),559						"you can't use machines argument for --readd"560					);561					let shared = config.shared_secret(&name)?;562					machines = shared.owners;563				}564565				let recipients = config.recipients(machines.clone()).await?;566567				let mut parts = BTreeMap::new();568569				let mut input = vec![];570				io::stdin().read_to_end(&mut input)?;571572				if !input.is_empty() {573					let encrypted =574						encrypt_secret_data(recipients.iter().map(|r| r as &dyn Recipient), input)575							.ok_or_else(|| anyhow!("no recipients provided"))?;576					parts.insert(part_name, FleetSecretPart { raw: encrypted });577				}578579				if let Some(public) = parse_public(public, public_file).await? {580					parts.insert(public_name, FleetSecretPart { raw: public });581				}582583				config.replace_shared(584					name,585					FleetSharedSecret {586						owners: machines,587						secret: FleetSecret {588							created_at: Utc::now(),589							expires_at,590							parts,591							generation_data: serde_json::Value::Null,592						},593					},594				);595			}596			Secret::Add {597				machine,598				name,599				replace,600				merge,601				public,602				public_part: public_name,603				public_file,604				part: part_name,605			} => {606				if config.has_secret(&machine, &name) && !replace && !merge {607					bail!(608						"secret already defined.\nUse --replace to override, or --merge to add new parts to existing secret"609					);610				}611612				let mut out = if merge && !replace {613					config614						.host_secret(&machine, &name)615						.context("failed to read existing secret for --merge")?616				} else {617					FleetSecret {618						created_at: Utc::now(),619						expires_at: None,620						parts: BTreeMap::new(),621						generation_data: serde_json::Value::Null,622					}623				};624625				if let Some(secret) = parse_secret().await? {626					let recipient = config.recipient(&machine).await?;627					let encrypted = encrypt_secret_data([&recipient as &dyn Recipient], secret)628						.expect("recipient provided");629					if out630						.parts631						.insert(part_name.clone(), FleetSecretPart { raw: encrypted })632						.is_some() && !replace633					{634						bail!("part {part_name:?} is already defined");635					}636				}637638				if let Some(public) = parse_public(public, public_file).await? {639					if out640						.parts641						.insert(public_name.clone(), FleetSecretPart { raw: public })642						.is_some() && !replace643					{644						bail!("part {public_name:?} is already defined");645					}646				};647648				config.insert_secret(&machine, name, out);649			}650			#[allow(clippy::await_holding_refcell_ref)]651			Secret::Read {652				name,653				machine,654				part: part_name,655			} => {656				let secret = config.host_secret(&machine, &name)?;657				let Some(secret) = secret.parts.get(&part_name) else {658					bail!("no part {part_name} in secret {name}");659				};660				let data = if secret.raw.encrypted {661					let host = config.host(&machine).await?;662					host.decrypt(secret.raw.clone()).await?663				} else {664					secret.raw.data.clone()665				};666667				stdout().write_all(&data)?;668			}669			Secret::ReadShared {670				name,671				part: part_name,672				prefer_identities,673			} => {674				let secret = config.shared_secret(&name)?;675				let Some(part) = secret.secret.parts.get(&part_name) else {676					bail!("no part {part_name} in secret {name}");677				};678				let data = if part.raw.encrypted {679					let identity_holder = if !prefer_identities.is_empty() {680						prefer_identities681							.iter()682							.find(|i| secret.owners.iter().any(|s| s == *i))683					} else {684						secret.owners.first()685					};686					let Some(identity_holder) = identity_holder else {687						bail!("no available holder found");688					};689					let host = config.host(identity_holder).await?;690					host.decrypt(part.raw.clone()).await?691				} else {692					part.raw.data.clone()693				};694				stdout().write_all(&data)?;695			}696			Secret::UpdateShared {697				name,698				machine,699				add_machine,700				remove_machine,701				prefer_identities,702			} => {703				// TODO: Forbid updating secrets with set expectedOwners (= not user-managed).704705				let secret = config.shared_secret(&name)?;706				if secret.secret.parts.values().all(|v| !v.raw.encrypted) {707					bail!("no secret");708				}709710				let initial_machines = secret.owners.clone();711				let target_machines = parse_machines(712					initial_machines.clone(),713					machine,714					add_machine,715					remove_machine,716				)?;717718				if target_machines.is_empty() {719					info!("no machines left for secret, removing it");720					config.remove_shared(&name);721					return Ok(());722				}723724				let config_field = &config.config_field;725				let name_clone = name.clone();726				let field = nix_go!(config_field.sharedSecrets[name_clone]);727				let expected_generation_data = nix_go_json!(field.expectedGenerationData);728729				let updated = maybe_regenerate_shared_secret(730					&name,731					config,732					secret,733					field,734					&target_machines,735					expected_generation_data,736					&prefer_identities,737					// None,738				)739				.await?;740				config.replace_shared(name, updated);741			}742			Secret::Regenerate {743				prefer_identities,744				skip_hosts,745			} => {746				info!("checking for secrets to regenerate");747				let stored_shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();748				{749					// Generate missing shared750					// let shared_batch = None;751					let _span = info_span!("shared").entered();752					let expected_shared_set = config753						.list_configured_shared()754						.await?755						.into_iter()756						.collect::<HashSet<_>>();757					for missing in expected_shared_set.difference(&stored_shared_set) {758						let config_field = &config.config_field;759						let secret = nix_go!(config_field.sharedSecrets[{ missing }]);760						let expected_generation_data: serde_json::Value =761							nix_go_json!(secret.expectedGenerationData);762						let expected_owners: Option<Vec<String>> =763							nix_go_json!(secret.expectedOwners);764						let Some(expected_owners) = expected_owners else {765							// Can't generate this missing secret, as it has no defined owners.766							continue;767						};768						info!("generating secret: {missing}");769						let shared = generate_shared(770							config,771							missing,772							secret,773							expected_owners,774							expected_generation_data,775							// shared_batch.clone(),776						)777						.in_current_span()778						.await?;779						config.replace_shared(missing.to_string(), shared)780					}781				}782				if !skip_hosts {783					// let hosts_batch = None;784					for host in config.list_hosts().await? {785						if opts.should_skip(&host).await? {786							continue;787						}788789						let _span = info_span!("host", host = host.name).entered();790						let expected_set = host791							.list_configured_secrets()792							.in_current_span()793							.await?794							.into_iter()795							.collect::<HashSet<_>>();796						let stored_set = config797							.list_secrets(&host.name)798							.into_iter()799							.collect::<HashSet<_>>();800						for missing in expected_set.difference(&stored_set) {801							info!("generating secret: {missing}");802							let secret = host.secret_field(missing).in_current_span().await?;803							let expected_generation_data =804								nix_go_json!(secret.expectedGenerationData);805							let generated = match generate(806								config,807								missing,808								secret,809								slice::from_ref(&host.name),810								expected_generation_data,811								// hosts_batch.clone(),812							)813							.in_current_span()814							.await815							{816								Ok(v) => v,817								Err(e) => {818									error!("{e:?}");819									continue;820								}821							};822							config.insert_secret(&host.name, missing.to_string(), generated)823						}824						for name in stored_set {825							info!("updating secret: {name}");826							let data = config.host_secret(&host.name, &name)?;827							let secret = host.secret_field(&name).in_current_span().await?;828							let expected_generation_data =829								nix_go_json!(secret.expectedGenerationData);830							if secret_needs_regeneration(&data, &expected_generation_data) {831								let generated = match generate(832									config,833									&name,834									secret,835									slice::from_ref(&host.name),836									expected_generation_data,837									// hosts_batch.clone(),838								)839								.in_current_span()840								.await841								{842									Ok(v) => v,843									Err(e) => {844										error!("{e:?}");845										continue;846									}847								};848								config.insert_secret(&host.name, name.to_string(), generated)849							}850						}851					}852				}853				let mut to_remove = Vec::new();854				for name in &stored_shared_set {855					info!("updating secret: {name}");856					let data = config.shared_secret(name)?;857					let config_field = &config.config_field;858					let expected_owners: Option<Vec<String>> =859						nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);860					let Some(expected_owners) = expected_owners else {861						warn!("secret was removed from fleet config: {name}, removing from data");862						to_remove.push(name.to_string());863						continue;864					};865866					let secret = nix_go!(config_field.sharedSecrets[{ name }]);867					let expected_generation_data = nix_go_json!(secret.expectedGenerationData);868					config.replace_shared(869						name.to_owned(),870						maybe_regenerate_shared_secret(871							name,872							config,873							data,874							secret,875							&expected_owners,876							expected_generation_data,877							&prefer_identities,878							// None,879						)880						.await?,881					);882				}883				for k in to_remove {884					config.remove_shared(&k);885				}886			}887			Secret::List {} => {888				let _span = info_span!("loading secrets").entered();889				let configured = config.list_configured_shared().await?;890				#[derive(Tabled)]891				struct SecretDisplay {892					#[tabled(rename = "Name")]893					name: String,894					#[tabled(rename = "Owners")]895					owners: String,896				}897				let mut table = vec![];898				for name in configured.iter().cloned() {899					let config = config.clone();900					let expected_owners = config.shared_secret_expected_owners(&name).await?;901					let data = config.shared_secret(&name)?;902					let owners = data903						.owners904						.iter()905						.map(|o| {906							if expected_owners.contains(o) {907								o.green().to_string()908							} else {909								o.red().to_string()910							}911						})912						.collect::<Vec<_>>();913					table.push(SecretDisplay {914						owners: owners.join(", "),915						name,916					})917				}918				info!("loaded\n{}", Table::new(table).to_string())919			}920			Secret::Edit {921				name,922				machine,923				part,924				add,925			} => {926				let secret = config.host_secret(&machine, &name)?;927				if let Some(data) = secret.parts.get(&part) {928					let host = config.host(&machine).await?;929					let secret = host.decrypt(data.raw.clone()).await?;930					String::from_utf8(secret).context("secret is not utf8")?931				} else if add {932					String::new()933				} else {934					bail!("part {part} not found in secret {name}. Did you mean to `--add` it?");935				};936			}937		}938		Ok(())939	}940}941942/*943async fn edit_temp_file(944	builder: tempfile::Builder<'_, '_>,945	r: Vec<u8>,946	header: &str,947	comment: &str,948) -> Result<(Vec<u8>, Option<String>), anyhow::Error> {949	if !stdin().is_tty() {950		// TODO: Also try to open /dev/tty directly?951		bail!("stdin is not tty, can't open editor");952	}953954	use std::fmt::Write;955	let mut file = builder.tempfile()?;956957	let mut full_header = String::new();958	let mut had = false;959	for line in header.trim_end().lines() {960		had = true;961		writeln!(&mut full_header, "{comment}{line}")?;962	}963	if had {964		writeln!(&mut full_header, "{}", comment.trim_end())?;965	}966	writeln!(967		&mut full_header,968		"{comment}Do not touch this header! It will be removed automatically"969	)?;970971	file.write_all(full_header.as_bytes())?;972	file.write_all(&r)?;973974	let abs_path = file.into_temp_path();975	let editor = std::env::var_os("VISUAL")976		.or_else(|| std::env::var_os("EDITOR"))977		.unwrap_or_else(|| "vi".into());978	let editor_args = shlex::bytes::split(editor.as_encoded_bytes())979		.ok_or_else(|| anyhow!("EDITOR env var has wrong syntax"))?;980	let editor_args = editor_args981		.into_iter()982		.map(|v| {983			// Only ASCII subsequences are replaced984			unsafe { OsString::from_encoded_bytes_unchecked(v) }985		})986		.collect_vec();987	let Some((editor, args)) = editor_args.split_first() else {988		bail!("EDITOR env var has no command");989	};990	let mut command = Command::new(editor);991	command.args(args);992993	let path_arg = abs_path.canonicalize()?;994995	// TODO: Save full state, using tcget/_getmode/_setmode996	let was_raw = terminal::is_raw_mode_enabled()?;997	terminal::enable_raw_mode()?;998999	let status = command.arg(path_arg).status().await;10001001	if !was_raw {1002		terminal::disable_raw_mode()?;1003	}10041005	let success = match status {1006		Ok(s) => s.success(),1007		Err(e) if e.kind() == io::ErrorKind::NotFound => {1008			bail!("editor not found")1009		}1010		Err(e) => bail!("editor spawn error: {e}"),1011	};10121013	let mut file = std::fs::read(&abs_path).context("read editor output")?;1014	let Some(v) = file.strip_prefix(full_header.as_bytes()) else {1015		todo!();1016	};1017	todo!();10181019	// Ok((success, abs_path))1020}1021*/