1
0
Fork 0
gnu-plus-dotfiles/dot_omp/agent/encrypted_private_.env.age
rain d61ffacc22 omp secrets: use encrypted_private_ prefix (decrypts + 0600)
chezmoi parses attribute prefixes left-to-right and 'encrypted_' must
precede 'private_'. The 'private_encrypted_' order silently breaks
decryption: chezmoi consumes 'private_', then treats 'encrypted_foo.age'
as a literal filename and copies the ciphertext verbatim instead of
decrypting it.

models.yml was named 'private_encrypted_models.yml.age' since commit
3c3fab7 and was never decrypting — a stale 'encrypted_models.yml.age'
blob was sitting in ~/.omp/agent/ and the plaintext models.yml was an
unmanaged leftover. .env and zai.key used the plain 'encrypted_'
prefix and were decrypting at umask 0644 (world-readable in isolation;
the 700 ~/.omp/agent/ dir was the only thing shielding them).

This commit:

  * renames all three to encrypted_private_{zai.key,.env,models.yml}.age
    so chezmoi decrypts AND lands them at 0600 natively
  * rewrites run_onchange_35 as 'ensure-omp-secret-perms.sh' covering
    all three, as belt-and-suspenders for any box where a secret still
    sits at 0644 from a prior apply
  * removes the stale encrypted_models.yml.age verbatim blob and its
    orphan state entry
  * corrects the README perms section to document the prefix-order
    gotcha (was misleadingly claiming 'private_' alone gave 0600)

Verified end-to-end on this box: chezmoi managed lists all three as
decrypted targets, scoped apply writes them at 600, chmod script is
idempotent. Other boxes need a 'chezmoi apply' to pick up the rename
and the onchange chmod.
2026-06-25 18:33:58 -04:00

23 lines
No EOL
1.9 KiB
Text
Raw Permalink Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

age-encryption.org/v1
-> X25519 KzXhOw3iY0Q6KLcznDZZicbn9VWaSDYr7IjEzAxA6Fw
yHT/cY6Bqzt34tUZMpBPV6rusMooQmsyZTtKdLnE7Jw
-> X25519 iRTxwwxq98Sm1YhRxvU/dK+b38YuVOYb6SEaKAfinAA
YDTiTwWrdiM9+sjyRJcIyxgLK2Ewqp5os9N0lfo7oy8
-> X25519 IGTSzIIw4VLJNaHv7IsRKcJlQbHPvFdjeQNMgf2ze3A
gUEkX+PUQmFaDjcKlC+cnC66k6CMxYv6bEkIvPcCSQs
-> X25519 LY0nf6XDW0bk/TWL9OLjO/8b4Ixf5dNJQDmDu1g9amQ
q+BTQDKvw4zhoQotbDPlobDPeq7DE9axnPkiPZP85LQ
-> X25519 eNwiHEFacnxXCFdgsifdHgyP0S+YWfFgTdpgQWBHTE0
zP7LjnyO5znUtnQiXAtqpK0ZzJdqd/Mz4Eyg44XVLV0
-> X25519 9E5zTEvHNgLwIFgibj74HFBBdmrUqmq6TbF7pJyzHXQ
XbqRaZZlXSzBylVnDxyiNQ1vLeI44OJH8hnGHbNLdtQ
-> X25519 pAZi5ClxRt0Bch2ARnyCLrLYhU5fNf2VKEEt/yWc+0Q
b+l5sOU+G3ZGgPzR2oq4IAAZzyWjwTu5cdRg/aTBhPg
-> X25519 9Gm74SgOAuoxJN+4z7smNBl+rwOJej3e3+XMDWbUJF8
WrQ13/0S876oBMsRykudZY+GDzasaT6crI9ToFsipK4
--- fWANl9x9fhYazZUwLeZUW4+AOLbU9JXs/er+Ttk+POE
´ïÕ‰¦Ý7…ÞWmÚiÞ²ÿ$L4žpÊ(,:$VÏ•E'o®û`Á•– %3¬ØKÜ·ÕžþìíÐk<>êùó&\ëd7GxÊ©.ðíÂT6>ÊU˜Îï<C38E>?ÇÅÐ*T¦Ï<C2A6>HK=$÷wr»'¦ìT5rµvï<76>ÑjòÙUý¡|ÂYG`Q2¹ÖÌH²¾íù±$3±(|8Z¾Ðò=¹ÔZ˜l¨åÚ¶Šxü&
ÏO&geÿù}>ùÀ€(Ä/|%xåx5VŒ]Ó`OÐ<4F>Ãîå%9:m¿×Et}ãIøDܶãÒ ™4w}‰°MbÂæšÍÜ$™l8¸/Ûaw9zRžåNp<4E>?ˆCwXf²Þ?¦³ÂAˆé“PâÅù>‰§í+ÐGè£êT
Wõ7êѬ•ÓêØ*¨`ä-<2D>ˆŸø¨ÄªÕ#!œfV0g„]}Rãki:'ˆŠâÁ¿½IྨW ³ÖìF—!©<>s0¹^yù¹”cãWí¿ò./E·Â<C2B7>¡1´ú8»)í.Ùîè."÷òm<ïsFžS>²ì8‚Ô/'tOÕn¾hr…”X "_}~Îî¼N"m¶UxŽý(úŠŠ¸Gæ0r6Ãx°y£Œ©†RuÒ¯Â<C382>Ž’©`<60><&ŽŽeãˆ4PÒá7šþðÉí
ÚÞ‚ŒnpþÐmü8r¿6”M
˜<EFBFBD>óm°=óËÊ(\³jVS‡©ˆ
K KØHN8Ô<38>ŽGÌs>{y`7Í•döŠ
’³×ñ_¼ð™·ǘ«,Š˜¡<CB9C>ålü ˬ¨…<C2A8>į€owhg¨óË!ÕFa7Lwy¸
þ7û¯n„_çm³4c—€h&9øRˆþj?â$ÕK9üôÔŽYÖ÷b}Mæ*iB"ÑÐ(Žx\ÝR¿¦ÿ3é+ÙnaµˆJä_.{#¼¿þ 'ÇÍÖ<$¬tó*±Ú¯*¤†ABI·³±Ê(Ñôß £ÕÏÙYq¢Ë®ü|ãÑÝUœ'×>ÃÌÐßµ„Æí1ãìÐÙÕù-èfÄyÅ:¿·Ø«·­.<u×±q‡^ƒk•0Þž'èc  Õ€Ë_°Ã7gH«”(xG‘’™)ÕlÑxDeµrøQjIÅõOG<E28099>ZÝöjgZÍÍ<C38D>%ëÀq^$gòÞ4%±)q+ýBMhV[bØۆ„LÒEõFÔ·'<27>éP‡†kU—CcìÒCëøn„aùô¯HPY0°¦‰çÚdúÀ‚Î2 zÛf8M£pR€ K]n<>ÉŽ´°¤Es7ÛûSî…[<5B>¼*ð4Rƒ+FGkt¬rsï2À¤º´<10>Rc\y 3¬NéMŠ7ÇÓ%€»>A÷g6é)Ï÷&Áïmÿ¸/Žš: ÿÒ›