difftreelog
fix expectedOwners is nullable
in: trunk
1 file changed
cmds/fleet/src/cmds/secrets/mod.rsdiffbeforeafterboth1use std::{2 collections::{BTreeMap, BTreeSet, HashSet},3 io::{self, stdin, stdout, Read, Write},4 path::PathBuf,5};67use age::Recipient;8use anyhow::{anyhow, bail, ensure, Context, Result};9use chrono::{DateTime, Utc};10use clap::Parser;11use fleet_base::{12 fleetdata::{encrypt_secret_data, FleetSecret, FleetSecretPart, FleetSharedSecret},13 host::Config,14 opts::FleetOpts,15};16use fleet_shared::SecretData;17use nix_eval::{nix_go, nix_go_json, NixBuildBatch, Value};18use owo_colors::OwoColorize;19use serde::Deserialize;20use tabled::{Table, Tabled};21use tokio::fs::read;22use tracing::{error, info, info_span, warn, Instrument};2324#[derive(Parser)]25pub enum Secret {26 /// Force load host keys for all defined hosts27 ForceKeys,28 /// Add secret, data should be provided in stdin29 AddShared {30 /// Secret name31 name: String,32 /// Secret owners33 #[clap(long, short)]34 machines: Vec<String>,35 /// Override secret if already present36 #[clap(long)]37 force: bool,38 /// Secret public part39 #[clap(long)]40 public: Option<String>,41 /// Load public part from specified file42 #[clap(long)]43 public_file: Option<PathBuf>,4445 /// Create a notification on secret expiration46 #[clap(long)]47 expires_at: Option<DateTime<Utc>>,4849 /// Secret with this name already exists, override its value while keeping the same owners.50 #[clap(long)]51 re_add: bool,5253 /// How to name public secret part54 #[clap(long, short = 'p', default_value = "public")]55 public_part: String,56 /// How to name private secret part57 #[clap(short = 's', long, default_value = "secret")]58 part: String,59 },60 /// Add secret, data should be provided in stdin61 Add {62 /// Secret name63 name: String,64 /// Secret owner65 #[clap(short = 'm', long)]66 machine: String,67 /// Replace secret if already present68 #[clap(long)]69 replace: bool,70 /// Add new parts to existing secret71 #[clap(long)]72 merge: bool,73 /// Secret public part74 #[clap(long)]75 public: Option<String>,76 /// Load public part from specified file77 #[clap(long)]78 public_file: Option<PathBuf>,7980 /// How to name public secret part81 #[clap(short = 'p', long, default_value = "public")]82 public_part: String,83 /// How to name private secret part84 #[clap(short = 's', long, default_value = "secret")]85 part: String,86 },87 /// Read secret from remote host, requires sudo on said host88 Read {89 name: String,90 #[clap(short = 'm', long)]91 machine: String,9293 /// Which private secret part to read94 #[clap(short = 'p', long, default_value = "secret")]95 part: String,96 },97 /// Read secret from remote host, requires sudo on said host98 ReadShared {99 name: String,100 /// Which private secret part to read101 #[clap(short = 'p', long, default_value = "secret")]102 part: String,103 /// Which host should we use to decrypt, in case if reencryption is required, without104 /// regeneration105 #[clap(long)]106 prefer_identities: Vec<String>,107 },108 UpdateShared {109 name: String,110111 #[clap(short = 'm', long)]112 machine: Option<Vec<String>>,113114 #[clap(long)]115 add_machine: Vec<String>,116 #[clap(long)]117 remove_machine: Vec<String>,118119 /// Which host should we use to decrypt120 #[clap(long)]121 prefer_identities: Vec<String>,122 },123 Regenerate {124 /// Which host should we use to decrypt, in case if reencryption is required, without125 /// regeneration126 #[clap(long)]127 prefer_identities: Vec<String>,128 /// Only regenerate shared secrets129 #[clap(long)]130 skip_hosts: bool,131 },132 List {},133 Edit {134 name: String,135 #[clap(short = 'm', long)]136 machine: String,137138 #[clap(long)]139 add: bool,140141 /// Which private secret part to read142 #[clap(short = 'p', long, default_value = "secret")]143 part: String,144 },145}146147fn secret_needs_regeneration(148 secret: &FleetSecret,149 expected_generation_data: &serde_json::Value,150) -> bool {151 let data_is_expected = secret.generation_data == *expected_generation_data;152 // TODO: Leeway?153 let expired = secret154 .expires_at155 .map(|expiration| expiration < Utc::now())156 .unwrap_or(false);157 expired || !data_is_expected158}159160#[allow(clippy::too_many_arguments)]161#[tracing::instrument(skip(config, secret, field, prefer_identities, batch))]162async fn maybe_regenerate_shared_secret(163 secret_name: &str,164 config: &Config,165 mut secret: FleetSharedSecret,166 field: Value,167 expected_owners: &[String],168 expected_generation_data: serde_json::Value,169 prefer_identities: &[String],170 batch: Option<NixBuildBatch>,171) -> Result<FleetSharedSecret> {172 let original_set = secret.owners.clone();173174 let set = original_set.iter().collect::<BTreeSet<_>>();175 let expected_set = expected_owners.iter().collect::<BTreeSet<_>>();176177 let regeneration_required =178 secret_needs_regeneration(&secret.secret, &expected_generation_data);179180 if set == expected_set && !regeneration_required {181 info!("no need to update owner list, it is already correct");182 return Ok(secret);183 }184185 let should_regenerate = if regeneration_required {186 info!("secret has its generation data changed, regeneration is required");187 true188 } else if set.difference(&expected_set).next().is_some() {189 // TODO: Remove this warning for revokable secrets.190 warn!("host was removed from secret owners, but until this host rebuild, the secret will still be stored on it.");191 nix_go_json!(field.regenerateOnOwnerRemoved)192 } else if expected_set.difference(&set).next().is_some() {193 nix_go_json!(field.regenerateOnOwnerAdded)194 } else {195 false196 };197198 if should_regenerate {199 info!("secret needs to be regenerated");200 let generated = generate_shared(201 config,202 secret_name,203 field,204 expected_owners.to_vec(),205 expected_generation_data,206 batch,207 )208 .await?;209 Ok(generated)210 } else {211 drop(batch);212 let identity_holder = if !prefer_identities.is_empty() {213 prefer_identities214 .iter()215 .find(|i| original_set.iter().any(|s| s == *i))216 } else {217 secret.owners.first()218 };219 let Some(identity_holder) = identity_holder else {220 bail!("no available holder found");221 };222223 for (part_name, part) in secret.secret.parts.iter_mut() {224 let _span = info_span!("part reencryption", part_name);225 if !part.raw.encrypted {226 continue;227 }228 let host = config.host(identity_holder).await?;229 let encrypted = host230 .reencrypt(part.raw.clone(), expected_owners.to_vec())231 .await?;232 part.raw = encrypted;233 }234235 secret.owners = expected_owners.to_vec();236 Ok(secret)237 }238}239240#[derive(Deserialize)]241#[serde(rename_all = "camelCase")]242enum GeneratorKind {243 Impure,244 Pure,245}246247async fn generate_pure(248 _config: &Config,249 _display_name: &str,250 _secret: Value,251 _default_generator: Value,252 _owners: &[String],253) -> Result<FleetSecret> {254 bail!("pure generators are broken for now")255}256async fn generate_impure(257 config: &Config,258 _display_name: &str,259 secret: Value,260 default_generator: Value,261 expected_owners: &[String],262 expected_generation_data: serde_json::Value,263 batch: Option<NixBuildBatch>,264) -> Result<FleetSecret> {265 let generator = nix_go!(secret.generator);266 let on: Option<String> = nix_go_json!(default_generator.impureOn);267268 let nixpkgs = &config.nixpkgs;269270 let host = if let Some(on) = &on {271 config.host(on).await?272 } else {273 config.local_host()274 };275 let on_pkgs = host.pkgs().await?;276 let mk_secret_generators = nix_go!(on_pkgs.mkSecretGenerators);277278 let mut recipients = Vec::new();279 for owner in expected_owners {280 let key = config.key(owner).await?;281 recipients.push(key);282 }283 let generators = nix_go!(mk_secret_generators(Obj { recipients }));284 let pkgs_and_generators = nix_go!(on_pkgs + generators);285286 let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));287288 let generator = nix_go!(call_package(generator)(Obj {}));289290 let generator = generator.build_maybe_batch(batch).await?;291 let generator = generator292 .get("out")293 .ok_or_else(|| anyhow!("missing generateImpure out"))?;294 let generator = host.remote_derivation(generator).await?;295296 let out_parent = host.mktemp_dir().await?;297 let out = format!("{out_parent}/out");298299 let mut gen = host.cmd(generator).await?;300 gen.env("out", &out);301 if on.is_none() {302 // This path is local, thus we can feed `OsString` directly to env var... But I don't think that's necessary to handle.303 let project_path: String = config304 .directory305 .clone()306 .into_os_string()307 .into_string()308 .map_err(|s| anyhow!("fleet project path is not utf-8: {s:?}"))?;309 gen.env("FLEET_PROJECT", project_path);310 }311 gen.run().await.context("impure generator")?;312313 {314 let marker = host.read_file_text(format!("{out}/marker")).await?;315 ensure!(marker == "SUCCESS", "generation not succeeded");316 }317318 let mut parts = BTreeMap::new();319 for part in host.read_dir(&out).await? {320 if part == "created_at" || part == "expires_at" || part == "marker" {321 continue;322 }323 let contents: SecretData = host324 .read_file_text(format!("{out}/{part}"))325 .await?326 .parse()327 .map_err(|e| anyhow!("failed to decode secret {out:?} part {part:?}: {e}"))?;328 parts.insert(part.to_owned(), FleetSecretPart { raw: contents });329 }330331 let created_at = host.read_file_value(format!("{out}/created_at")).await?;332 let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();333334 Ok(FleetSecret {335 created_at,336 expires_at,337 parts,338 generation_data: expected_generation_data,339 })340}341async fn generate(342 config: &Config,343 display_name: &str,344 secret: Value,345 expected_owners: &[String],346 expected_generation_data: serde_json::Value,347 batch: Option<NixBuildBatch>,348) -> Result<FleetSecret> {349 let generator = nix_go!(secret.generator);350 // Can't properly check on nix module system level351 {352 let gen_ty = generator.type_of().await?;353 if gen_ty == "null" {354 bail!("secret has no generator defined, can't automatically generate it.");355 }356 if gen_ty == "set" {357 if !generator.has_field("__functor").await? {358 bail!("generator should be functor, got {gen_ty}");359 }360 } else if gen_ty != "lambda" {361 bail!("generator should be functor, got {gen_ty}");362 }363 }364 let nixpkgs = &config.nixpkgs;365 let default_pkgs = &config.default_pkgs;366 let default_mk_secret_generators = nix_go!(default_pkgs.mkSecretGenerators);367 // Generators provide additional information in passthru, to access368 // passthru we should call generator, but information about where this generator is supposed to build369 // is located in passthru... Thus evaluating generator on host.370 //371 // Maybe it is also possible to do some magic with __functor?372 //373 // I don't want to make modules always responsible for additional secret data anyway,374 // so it should be in derivation, and not in the secret data itself.375 let generators = nix_go!(default_mk_secret_generators(Obj {376 recipients: <Vec<String>>::new(),377 }));378 let pkgs_and_generators = nix_go!(default_pkgs + generators);379380 let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));381 let default_generator = nix_go!(call_package(generator)(Obj {}));382383 let kind: GeneratorKind = nix_go_json!(default_generator.generatorKind);384385 match kind {386 GeneratorKind::Impure => {387 generate_impure(388 config,389 display_name,390 secret,391 default_generator,392 expected_owners,393 expected_generation_data,394 batch,395 )396 .await397 }398 GeneratorKind::Pure => {399 generate_pure(400 config,401 display_name,402 secret,403 default_generator,404 expected_owners,405 )406 .await407 }408 }409}410async fn generate_shared(411 config: &Config,412 display_name: &str,413 secret: Value,414 expected_owners: Vec<String>,415 expected_generation_data: serde_json::Value,416 batch: Option<NixBuildBatch>,417) -> Result<FleetSharedSecret> {418 // let owners: Vec<String> = nix_go_json!(secret.expectedOwners);419 Ok(FleetSharedSecret {420 secret: generate(421 config,422 display_name,423 secret,424 &expected_owners,425 expected_generation_data,426 batch,427 )428 .await?,429 owners: expected_owners,430 })431}432433async fn parse_public(434 public: Option<String>,435 public_file: Option<PathBuf>,436) -> Result<Option<SecretData>> {437 Ok(match (public, public_file) {438 (Some(v), None) => Some(SecretData {439 data: v.into(),440 encrypted: false,441 }),442 (None, Some(v)) => Some(SecretData {443 data: read(v).await?,444 encrypted: false,445 }),446 (Some(_), Some(_)) => {447 bail!("only public or public_file should be set")448 }449 (None, None) => None,450 })451}452453async fn parse_secret() -> Result<Option<Vec<u8>>> {454 let mut input = vec![];455 stdin().read_to_end(&mut input)?;456 if input.is_empty() {457 Ok(None)458 } else {459 Ok(Some(input))460 }461}462463fn parse_machines(464 initial: Vec<String>,465 machines: Option<Vec<String>>,466 mut add_machines: Vec<String>,467 mut remove_machines: Vec<String>,468) -> Result<Vec<String>> {469 if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {470 bail!("no operation");471 }472473 let initial_machines = initial.clone();474 let mut target_machines = initial;475 info!("Currently encrypted for {initial_machines:?}");476477 // ensure!(machines.is_some() || !add_machines.is_empty() || )478 if let Some(machines) = machines {479 ensure!(480 add_machines.is_empty() && remove_machines.is_empty(),481 "can't combine --machines and --add-machines/--remove-machines"482 );483 let target = initial_machines.iter().collect::<HashSet<_>>();484 let source = machines.iter().collect::<HashSet<_>>();485 for removed in target.difference(&source) {486 remove_machines.push((*removed).clone());487 }488 for added in source.difference(&target) {489 add_machines.push((*added).clone());490 }491 }492493 for machine in &remove_machines {494 let mut removed = false;495 while let Some(pos) = target_machines.iter().position(|m| m == machine) {496 target_machines.swap_remove(pos);497 removed = true;498 }499 if !removed {500 warn!("secret is not enabled for {machine}");501 }502 }503 for machine in &add_machines {504 if target_machines.iter().any(|m| m == machine) {505 warn!("secret is already added to {machine}");506 } else {507 target_machines.push(machine.to_owned());508 }509 }510 if !remove_machines.is_empty() {511 // TODO: maybe force secret regeneration?512 // Not that useful without revokation.513 warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");514 }515 Ok(target_machines)516}517impl Secret {518 pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> {519 match self {520 Secret::ForceKeys => {521 for host in config.list_hosts().await? {522 if opts.should_skip(&host).await? {523 continue;524 }525 config.key(&host.name).await?;526 }527 }528 Secret::AddShared {529 mut machines,530 name,531 force,532 public,533 public_part: public_name,534 public_file,535 expires_at,536 re_add,537 part: part_name,538 } => {539 // TODO: Forbid updating secrets with set expectedOwners (= not user-managed).540541 let exists = config.has_shared(&name);542 if exists && !force && !re_add {543 bail!("secret already defined");544 }545 if re_add {546 // Fixme: use clap to limit this usage547 ensure!(!force, "--force and --readd are not compatible");548 ensure!(exists, "secret doesn't exists");549 ensure!(550 machines.is_empty(),551 "you can't use machines argument for --readd"552 );553 let shared = config.shared_secret(&name)?;554 machines = shared.owners;555 }556557 let recipients = config.recipients(machines.clone()).await?;558559 let mut parts = BTreeMap::new();560561 let mut input = vec![];562 io::stdin().read_to_end(&mut input)?;563564 if !input.is_empty() {565 let encrypted =566 encrypt_secret_data(recipients.iter().map(|r| r as &dyn Recipient), input)567 .ok_or_else(|| anyhow!("no recipients provided"))?;568 parts.insert(part_name, FleetSecretPart { raw: encrypted });569 }570571 if let Some(public) = parse_public(public, public_file).await? {572 parts.insert(public_name, FleetSecretPart { raw: public });573 }574575 config.replace_shared(576 name,577 FleetSharedSecret {578 owners: machines,579 secret: FleetSecret {580 created_at: Utc::now(),581 expires_at,582 parts,583 generation_data: serde_json::Value::Null,584 },585 },586 );587 }588 Secret::Add {589 machine,590 name,591 replace,592 merge,593 public,594 public_part: public_name,595 public_file,596 part: part_name,597 } => {598 if config.has_secret(&machine, &name) && !replace && !merge {599 bail!("secret already defined.\nUse --replace to override, or --merge to add new parts to existing secret");600 }601602 let mut out = if merge && !replace {603 config604 .host_secret(&machine, &name)605 .context("failed to read existing secret for --merge")?606 } else {607 FleetSecret {608 created_at: Utc::now(),609 expires_at: None,610 parts: BTreeMap::new(),611 generation_data: serde_json::Value::Null,612 }613 };614615 if let Some(secret) = parse_secret().await? {616 let recipient = config.recipient(&machine).await?;617 let encrypted = encrypt_secret_data([&recipient as &dyn Recipient], secret)618 .expect("recipient provided");619 if out620 .parts621 .insert(part_name.clone(), FleetSecretPart { raw: encrypted })622 .is_some() && !replace623 {624 bail!("part {part_name:?} is already defined");625 }626 }627628 if let Some(public) = parse_public(public, public_file).await? {629 if out630 .parts631 .insert(public_name.clone(), FleetSecretPart { raw: public })632 .is_some() && !replace633 {634 bail!("part {public_name:?} is already defined");635 }636 };637638 config.insert_secret(&machine, name, out);639 }640 #[allow(clippy::await_holding_refcell_ref)]641 Secret::Read {642 name,643 machine,644 part: part_name,645 } => {646 let secret = config.host_secret(&machine, &name)?;647 let Some(secret) = secret.parts.get(&part_name) else {648 bail!("no part {part_name} in secret {name}");649 };650 let data = if secret.raw.encrypted {651 let host = config.host(&machine).await?;652 host.decrypt(secret.raw.clone()).await?653 } else {654 secret.raw.data.clone()655 };656657 stdout().write_all(&data)?;658 }659 Secret::ReadShared {660 name,661 part: part_name,662 prefer_identities,663 } => {664 let secret = config.shared_secret(&name)?;665 let Some(part) = secret.secret.parts.get(&part_name) else {666 bail!("no part {part_name} in secret {name}");667 };668 let data = if part.raw.encrypted {669 let identity_holder = if !prefer_identities.is_empty() {670 prefer_identities671 .iter()672 .find(|i| secret.owners.iter().any(|s| s == *i))673 } else {674 secret.owners.first()675 };676 let Some(identity_holder) = identity_holder else {677 bail!("no available holder found");678 };679 let host = config.host(identity_holder).await?;680 host.decrypt(part.raw.clone()).await?681 } else {682 part.raw.data.clone()683 };684 stdout().write_all(&data)?;685 }686 Secret::UpdateShared {687 name,688 machine,689 add_machine,690 remove_machine,691 prefer_identities,692 } => {693 // TODO: Forbid updating secrets with set expectedOwners (= not user-managed).694695 let secret = config.shared_secret(&name)?;696 if secret.secret.parts.values().all(|v| !v.raw.encrypted) {697 bail!("no secret");698 }699700 let initial_machines = secret.owners.clone();701 let target_machines = parse_machines(702 initial_machines.clone(),703 machine,704 add_machine,705 remove_machine,706 )?;707708 if target_machines.is_empty() {709 info!("no machines left for secret, removing it");710 config.remove_shared(&name);711 return Ok(());712 }713714 let config_field = &config.config_field;715 let field = nix_go!(config_field.sharedSecrets[{ name }]);716 let expected_generation_data = nix_go_json!(field.expectedGenerationData);717718 let updated = maybe_regenerate_shared_secret(719 &name,720 config,721 secret,722 field,723 &target_machines,724 expected_generation_data,725 &prefer_identities,726 None,727 )728 .await?;729 config.replace_shared(name, updated);730 }731 Secret::Regenerate {732 prefer_identities,733 skip_hosts,734 } => {735 info!("checking for secrets to regenerate");736 let stored_shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();737 {738 // Generate missing shared739 let shared_batch = None;740 let _span = info_span!("shared").entered();741 let expected_shared_set = config742 .list_configured_shared()743 .await?744 .into_iter()745 .collect::<HashSet<_>>();746 for missing in expected_shared_set.difference(&stored_shared_set) {747 let config_field = &config.config_field;748 let secret = nix_go!(config_field.sharedSecrets[{ missing }]);749 let expected_generation_data: serde_json::Value =750 nix_go_json!(secret.expectedGenerationData);751 let expected_owners: Option<Vec<String>> =752 nix_go_json!(secret.expectedOwners);753 let Some(expected_owners) = expected_owners else {754 // Can't generate this missing secret, as it has no defined owners.755 continue;756 };757 info!("generating secret: {missing}");758 let shared = generate_shared(759 config,760 missing,761 secret,762 expected_owners,763 expected_generation_data,764 shared_batch.clone(),765 )766 .in_current_span()767 .await?;768 config.replace_shared(missing.to_string(), shared)769 }770 }771 if !skip_hosts {772 let hosts_batch = None;773 for host in config.list_hosts().await? {774 if opts.should_skip(&host).await? {775 continue;776 }777778 let _span = info_span!("host", host = host.name).entered();779 let expected_set = host780 .list_configured_secrets()781 .in_current_span()782 .await?783 .into_iter()784 .collect::<HashSet<_>>();785 let stored_set = config786 .list_secrets(&host.name)787 .into_iter()788 .collect::<HashSet<_>>();789 for missing in expected_set.difference(&stored_set) {790 info!("generating secret: {missing}");791 let secret = host.secret_field(missing).in_current_span().await?;792 let expected_generation_data =793 nix_go_json!(secret.expectedGenerationData);794 let generated = match generate(795 config,796 missing,797 secret,798 &[host.name.clone()],799 expected_generation_data,800 hosts_batch.clone(),801 )802 .in_current_span()803 .await804 {805 Ok(v) => v,806 Err(e) => {807 error!("{e:?}");808 continue;809 }810 };811 config.insert_secret(&host.name, missing.to_string(), generated)812 }813 for name in stored_set {814 info!("updating secret: {name}");815 let data = config.host_secret(&host.name, &name)?;816 let secret = host.secret_field(&name).in_current_span().await?;817 let expected_generation_data =818 nix_go_json!(secret.expectedGenerationData);819 if secret_needs_regeneration(&data, &expected_generation_data) {820 let generated = match generate(821 config,822 &name,823 secret,824 &[host.name.clone()],825 expected_generation_data,826 hosts_batch.clone(),827 )828 .in_current_span()829 .await830 {831 Ok(v) => v,832 Err(e) => {833 error!("{e:?}");834 continue;835 }836 };837 config.insert_secret(&host.name, name.to_string(), generated)838 }839 }840 }841 }842 let mut to_remove = Vec::new();843 for name in &stored_shared_set {844 info!("updating secret: {name}");845 let data = config.shared_secret(name)?;846 let config_field = &config.config_field;847 let expected_owners: Option<Vec<String>> =848 nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);849 let Some(expected_owners) = expected_owners else {850 warn!("secret was removed from fleet config: {name}, removing from data");851 to_remove.push(name.to_string());852 continue;853 };854855 let secret = nix_go!(config_field.sharedSecrets[{ name }]);856 let expected_generation_data = nix_go_json!(secret.expectedGenerationData);857 config.replace_shared(858 name.to_owned(),859 maybe_regenerate_shared_secret(860 name,861 config,862 data,863 secret,864 &expected_owners,865 expected_generation_data,866 &prefer_identities,867 None,868 )869 .await?,870 );871 }872 for k in to_remove {873 config.remove_shared(&k);874 }875 }876 Secret::List {} => {877 let _span = info_span!("loading secrets").entered();878 let configured = config.list_configured_shared().await?;879 #[derive(Tabled)]880 struct SecretDisplay {881 #[tabled(rename = "Name")]882 name: String,883 #[tabled(rename = "Owners")]884 owners: String,885 }886 let mut table = vec![];887 for name in configured.iter().cloned() {888 let config = config.clone();889 let expected_owners = config.shared_secret_expected_owners(&name).await?;890 let data = config.shared_secret(&name)?;891 let owners = data892 .owners893 .iter()894 .map(|o| {895 if expected_owners.contains(o) {896 o.green().to_string()897 } else {898 o.red().to_string()899 }900 })901 .collect::<Vec<_>>();902 table.push(SecretDisplay {903 owners: owners.join(", "),904 name,905 })906 }907 info!("loaded\n{}", Table::new(table).to_string())908 }909 Secret::Edit {910 name,911 machine,912 part,913 add,914 } => {915 let secret = config.host_secret(&machine, &name)?;916 if let Some(data) = secret.parts.get(&part) {917 let host = config.host(&machine).await?;918 let secret = host.decrypt(data.raw.clone()).await?;919 String::from_utf8(secret).context("secret is not utf8")?920 } else if add {921 String::new()922 } else {923 bail!("part {part} not found in secret {name}. Did you mean to `--add` it?");924 };925 }926 }927 Ok(())928 }929}930931/*932async fn edit_temp_file(933 builder: tempfile::Builder<'_, '_>,934 r: Vec<u8>,935 header: &str,936 comment: &str,937) -> Result<(Vec<u8>, Option<String>), anyhow::Error> {938 if !stdin().is_tty() {939 // TODO: Also try to open /dev/tty directly?940 bail!("stdin is not tty, can't open editor");941 }942943 use std::fmt::Write;944 let mut file = builder.tempfile()?;945946 let mut full_header = String::new();947 let mut had = false;948 for line in header.trim_end().lines() {949 had = true;950 writeln!(&mut full_header, "{comment}{line}")?;951 }952 if had {953 writeln!(&mut full_header, "{}", comment.trim_end())?;954 }955 writeln!(956 &mut full_header,957 "{comment}Do not touch this header! It will be removed automatically"958 )?;959960 file.write_all(full_header.as_bytes())?;961 file.write_all(&r)?;962963 let abs_path = file.into_temp_path();964 let editor = std::env::var_os("VISUAL")965 .or_else(|| std::env::var_os("EDITOR"))966 .unwrap_or_else(|| "vi".into());967 let editor_args = shlex::bytes::split(editor.as_encoded_bytes())968 .ok_or_else(|| anyhow!("EDITOR env var has wrong syntax"))?;969 let editor_args = editor_args970 .into_iter()971 .map(|v| {972 // Only ASCII subsequences are replaced973 unsafe { OsString::from_encoded_bytes_unchecked(v) }974 })975 .collect_vec();976 let Some((editor, args)) = editor_args.split_first() else {977 bail!("EDITOR env var has no command");978 };979 let mut command = Command::new(editor);980 command.args(args);981982 let path_arg = abs_path.canonicalize()?;983984 // TODO: Save full state, using tcget/_getmode/_setmode985 let was_raw = terminal::is_raw_mode_enabled()?;986 terminal::enable_raw_mode()?;987988 let status = command.arg(path_arg).status().await;989990 if !was_raw {991 terminal::disable_raw_mode()?;992 }993994 let success = match status {995 Ok(s) => s.success(),996 Err(e) if e.kind() == io::ErrorKind::NotFound => {997 bail!("editor not found")998 }999 Err(e) => bail!("editor spawn error: {e}"),1000 };10011002 let mut file = std::fs::read(&abs_path).context("read editor output")?;1003 let Some(v) = file.strip_prefix(full_header.as_bytes()) else {1004 todo!();1005 };1006 todo!();10071008 // Ok((success, abs_path))1009}1010*/