Move to gnupg2

wincent · wincent · commit fd4c78aeb9d1 · 2017-04-04T19:01:27.000-07:00
No need for `preset` or `forget` any more as gnupg2 mostly handles
launching the agent, connecting to it, and storing passphrases.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 - Recursively explore dot directories when searching for matching files.
 - Include original filename in `log` output.
+- Assume `gnupg2`: relatedly, drop support for the `preset` and `forget` subcommands, as they are no longer really needed.
 
 # 0.2 (8 February 2016)
 
diff --git a/README.md b/README.md
@@ -14,15 +14,6 @@ git cipher log [FILES...]     # shows log with (plaintext) diffs
 git cipher help
 ```
 
-Additionally, to avoid repeated password prompts when decrypting, `git-cipher`
-provides some convenience subcommands for storing credentials in and clearing
-them from a running `gpg-agent` process:
-
-```sh
-git cipher preset # stores password in running gpg-agent
-git cipher forget # clears previously stored password
-```
-
 ## Installation
 
 `git-cipher` is a single Ruby script with no major dependencies beyond
@@ -53,26 +44,6 @@ brew install git gnupg gpg-agent
 
 ## Configuration
 
-### Allowing `gpg-agent` to use preset passphrases
-
-The use of preset passphrases allows `git-cipher` to decrypt multiple files
-in multiple invocations without triggering repeated passphrase prompts. In order
-to permit this, `gpg-agent` can be started as follows:
-
-```sh
-eval $(gpg-agent --daemon --allow-preset-passphrase)
-```
-
-Alternatively:
-
-```sh
-# Permanently allow use of preset passphrases with the agent:
-echo allow-preset-passphrase >> ~/.gnupg/gpg-agent.conf
-
-# Run the agent:
-eval $(gpg-agent --daemon)
-```
-
 ### Selecting a key for encryption and decryption
 
 There are three ways to override the default signing key (which is
@@ -99,34 +70,6 @@ git config --global cipher.gpguser jane@example.com # globally
 
 This last may be appropriate if you've installed by cloning the Git repo.
 
-### Selecting a `gpg-preset-passphrase` executable
-
-Again, there are three ways to override the default (which is
-`/usr/local/opt/gpg-agent/libexec/gpg-preset-passphrase`). The exact location of
-this executable will depend on the installation method you used to install
-`gpg-agent`.
-
-#### 1. Set the `GPG_PRESET_COMMAND` environment variable
-
-```sh
-GPG_PRESET_COMMAND=~/bin/gpg-preset-passphrase git cipher preset
-
-# or alternatively:
-export GPG_PRESET_COMMAND=~/bin/gpg-preset-passphrase
-git cipher preset
-```
-
-#### 2. Use `git-config` to set `cipher.presetcommand`
-
-```sh
-git config cipher.presetcommand ~/bin/gpg-preset-passphrase # per-repo
-git config --global cipher.presetcommand ~/bin/gpg-preset-passphrase # globally
-```
-
-#### 3. Edit `DEFAULT_GPG_PRESET_COMMAND` in the `git-cipher` source
-
-Again, this last may be appropriate if you've installed by cloning the Git repo.
-
 ## Architecture
 
 This section describes the background and rationale for the design of
diff --git a/bin/git-cipher b/bin/git-cipher
@@ -9,9 +9,8 @@ require 'tempfile'
 class Cipher
   EXTENSION = 'encrypted'
   DEFAULT_GPG_USER  = 'greg@hurrell.net'
-  DEFAULT_GPG_PRESET_COMMAND = '/usr/local/opt/gpg-agent/libexec/gpg-preset-passphrase'
   VALID_OPTIONS = %w[force help]
-  VALID_SUBCOMMANDS = %w[decrypt encrypt help log preset forget]
+  VALID_SUBCOMMANDS = %w[decrypt encrypt help log]
 
   def run
     send @subcommand
@@ -70,8 +69,6 @@ private
   end
 
   def decrypt!(file)
-    require_agent
-
     pathname = Pathname.new(file)
     basename = pathname.basename.to_s
     unless basename.start_with?('.')
@@ -183,11 +180,6 @@ private
     %x{#{string.gsub("\n", ' ')}}
   end
 
-  def forget
-    `#{escape command_path(gpg_preset_command)} --forget #{keygrip}`
-    die 'gpg-preset-passphrase failed' unless $?.success?
-  end
-
   def get_config(key)
     value = `#{escape command_path('git')} config cipher.#{key}`.chomp
     return if value.empty?
@@ -217,10 +209,6 @@ private
     })
   end
 
-  def gpg_preset_command
-    ENV['GPG_PRESET_COMMAND'] || get_config('presetcommand') || DEFAULT_GPG_PRESET_COMMAND
-  end
-
   def gpg_user
     ENV['GPG_USER'] || get_config('gpguser') || DEFAULT_GPG_USER
   end
@@ -229,17 +217,6 @@ private
     colorize(string, 32)
   end
 
-  def keygrip
-    # get the subkey fingerprint and convert it into a 40-char hex code
-    @keygrip ||= execute(%{
-      #{escape command_path('gpg')} --fingerprint #{escape gpg_user} |
-      grep fingerprint |
-      tail -1 |
-      cut -d= -f2 |
-      sed -e 's/ //g'
-    })
-  end
-
   def kill_line
     # 2K deletes the line, 0G moves to column 0
     # see: https://en.wikipedia.org/wiki/ANSI_escape_code
@@ -257,8 +234,6 @@ private
   end
 
   def log!(file)
-    require_agent
-
     commits = execute(%{
       #{escape command_path('git')} log
       --pretty=format:%H -- #{escape file}
@@ -324,17 +299,6 @@ private
     found
   end
 
-  def preset
-    passphrase = get_passphrase
-    command = "#{escape command_path(gpg_preset_command)} --preset #{keygrip}"
-    IO.popen(command, 'w+') do |io|
-      io.puts passphrase
-      io.close_write
-      puts io.read # usually silent
-    end
-    die 'gpg-preset-passphrase failed' unless $?.success?
-  end
-
   def process_args
     options, files = ARGV.partition { |arg| arg.start_with?('-') }
     subcommand = files.shift
@@ -357,17 +321,6 @@ private
     colorize(string, 31)
   end
 
-  def require_agent
-    unless ENV['GPG_AGENT_INFO']
-      die <<-MSG
-        GPG_AGENT_INFO not present in the environment.
-        Try running this before retrying `#{command_name} #{@subcommand}`:
-          eval $(gpg-agent --daemon)
-          #{command_name} preset
-      MSG
-    end
-  end
-
   def show(file, commit)
     # Redirect stderr to /dev/null because the file might not have existed prior
     # to this commit.
@@ -435,14 +388,6 @@ private
                 #{command_name} encrypt -f
                 #{command_name} encrypt --force # (alternative syntax)
       USAGE
-    when 'forget'
-      puts strip_heredoc(<<-USAGE)
-        #{command_name} forget
-
-          Forget passphrase previously stored using `#{command_name} preset`:
-
-              #{command_name} forget
-      USAGE
     when 'log'
       puts strip_heredoc(<<-USAGE)
         #{command_name} log FILE
@@ -452,23 +397,13 @@ private
 
               #{command_name} log foo
       USAGE
-    when 'preset'
-      puts strip_heredoc(<<-USAGE)
-        #{command_name} preset
-
-          Store a passphrase in a running `gpg-agent` agent:
-
-              #{command_name} preset
-      USAGE
     else
       puts strip_heredoc(<<-USAGE)
         Available commands (invoke any with -h or --help for more info):
 
             #{command_name} decrypt
             #{command_name} encrypt
-            #{command_name} forget
             #{command_name} log
-            #{command_name} preset
       USAGE
     end
 
