Git-secret: git secret only looks in the default (outter) keyring

[tonyskapunk]

I have a particular scenario where I make use of different keyrings, personal (default) and professional (secondary) use.

Seems like there is no setting to allow git-secret to look for a different outer keyring.

What are the steps to reproduce this issue?

1. Have a git repo with git secret in place with at least one file encrypted
2. Generate another pair of keys in a non-default keyring, share the pub key and have that added to the list of identities added to the git secret inner keyring, re-encrypt the file(s).

gpg --no-default-keyring  --keyring secondary.gpg --full-generate-key
...
gpg --no-default-keyring  --keyring secondary.gpg --armor  --export [email protected]

1. Once the pub key has been added and the files re-encrypted, list the identities that are able to decrypt the file or list the list of encrypted files e.g.

$ git secret whoknows
[email protected]
[email protected]

$ git secret list
hidden.txt

1. Attempt to cat/view/reveal the encrypted file(s)

$ git secret cat hidden.txt
gpg: decryption failed: No secret key
git-secret: abort: problem decrypting file with gpg: exit code 2: /home/example/git-secret-test/hidden.txt

What happens?

The command fails as is unable decrypt the file by using the private key in the secondary keyring.

What were you expecting to happen?

Been able to decrypt the file

Any logs, error output, etc?

(If it’s long, please paste to https://ghostbin.com/ and insert the link here.)

Any other comments?

I was able to workaround it by using a wrapper to gpg as there is a way to override the command with:
SECRETS_GPG_COMMAND=~/.local/bin/gpg-wrap

The wrapper script is:

#!/bin/bash

# When --homedir is passed, it is to override the system default (~/.gnupg)
# And to use the inner one located in ${SECRETS_DIR} (default: ./.gitsecret/keys/)
if grep -q -- '--homedir'<<<"$@"; then
    /usr/bin/gpg "$@"
else
    /usr/bin/gpg --no-default-keyring  --keyring secondary.gpg "$@"
fi

What versions of software are you using?

Operating system: (uname -a) …
Linux example 5.4.13-201.fc31.x86_64 #1 SMP Tue Jan 21 17:21:47 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

git-secret path: (which git-secret) …
/usr/bin/git-secret

git-secret version: (git secret --version) …
0.2.6

git version: (git --version) …
2.24.1

Shell type and version: ($SHELL --version) …
GNU bash, version 5.0.11

gpg version: (gpg --version) …
2.2.18

[sobolevn]

Interesting feature! Thanks, @tonyskapunk!

[joshrabinowitz]

I think the right solution here is to allow for a SECRETS_GPG_KEYRING variable (edit: or maybe SECRETS_GPG_USER_KEYRING to make it clear that it won't change the name of the keyring used in the repo's $SECRETS_DIR), that when used causes git-secret to use the -no-default-keyring --keyring $SECRETS_GPG_KEYRING gnupg options when handling the user's keyring.

What do you thnk, @sobolevn and @tonyskapunk ?

[sobolevn]

Seems like a good idea!

[joshrabinowitz]

Hm this sort of interacts with git-secret-tell / hide / init / killperson's -d option, i have to think this through:

From man git-secret-tell:
-d - specifies `--homedir` option for the `gpg`, basically use this option if your store your keys in a custom location.

Input welcome

[tonyskapunk]

Sorry for the lack of response here, I appreciate you're taking a look to this and have suggestions already. :smile_cat:

I like the idea of SECRETS_GPG_USER_KEYRING.

Regarding -d in secret tell it will only allow to use a different outer directory, still defaulting to the default keyring. Although this is a good alternative for sure. I'd think I could use a different directory instead of a secondary keyring. Lemme try and I'll update how it goes.

Thanks again!