rain
d61ffacc22
chezmoi parses attribute prefixes left-to-right and 'encrypted_' must
precede 'private_'. The 'private_encrypted_' order silently breaks
decryption: chezmoi consumes 'private_', then treats 'encrypted_foo.age'
as a literal filename and copies the ciphertext verbatim instead of
decrypting it.
models.yml was named 'private_encrypted_models.yml.age' since commit
3c3fab7 and was never decrypting — a stale 'encrypted_models.yml.age'
blob was sitting in ~/.omp/agent/ and the plaintext models.yml was an
unmanaged leftover. .env and zai.key used the plain 'encrypted_'
prefix and were decrypting at umask 0644 (world-readable in isolation;
the 700 ~/.omp/agent/ dir was the only thing shielding them).
This commit:
* renames all three to encrypted_private_{zai.key,.env,models.yml}.age
so chezmoi decrypts AND lands them at 0600 natively
* rewrites run_onchange_35 as 'ensure-omp-secret-perms.sh' covering
all three, as belt-and-suspenders for any box where a secret still
sits at 0644 from a prior apply
* removes the stale encrypted_models.yml.age verbatim blob and its
orphan state entry
* corrects the README perms section to document the prefix-order
gotcha (was misleadingly claiming 'private_' alone gave 0600)
Verified end-to-end on this box: chezmoi managed lists all three as
decrypted targets, scoped apply writes them at 600, chmod script is
idempotent. Other boxes need a 'chezmoi apply' to pick up the rename
and the onchange chmod.
19 lines
No EOL
936 B
Text
19 lines
No EOL
936 B
Text
age-encryption.org/v1
|
||
-> X25519 tcz29DdAymGVjqhTg2/WTlLBGhlHigpQSIUl9xhNwU0
|
||
DqKlUstmVARG5CnLI7U/2916m3gy+NbgOoGab7F9FGg
|
||
-> X25519 GZabKFY3meZhqH9CJ0SNZ8DBcZkQMw2Hhp+LD2XYGQ4
|
||
lQ1xFG+T7Q/D5bauTCZtIkMfZ04suc6Td8Jqgx/LPGg
|
||
-> X25519 xUssu6VvOpy6zqoi86NSdiHmW1evz/M7s6o3ztNenXM
|
||
PPW7cC1sVHoINdUamI4JUiW6QnLhoN60w7V6PUOYH9M
|
||
-> X25519 JshnZltB062q1vAz1/1VhNkh9jMp/AcjQ+iI3v9pc14
|
||
Km82p2DINXmLw8zht2q3cPj7eNqziHQWQui7Rmc5yw8
|
||
-> X25519 rz5F9SIQbvLUOsj+Ums5x4ymYsGuGK9UH4VhMaUPYCk
|
||
SdI7yzU1KBHexTIYElL7r1AWyWRAckh0llYT77NFS/k
|
||
-> X25519 T53iyj6FEjniHgXAkiRGWoNE3yNKf1xlafQaF/XeTAg
|
||
yvtw3Wg0fGpGMagRWI/Z+bomfw9pOO70cWG24OoUMys
|
||
-> X25519 Zb59GiA3QqYan73mCx8HGcJzCUhwkBN3KpfZNmkvAzw
|
||
IDEBf7floOlu/z9TLquj8R0YndKHMOk1MxY5OM+GbsQ
|
||
-> X25519 KcznqJpf64dobjV+J+s9t+B2oawebkTNFE2UXuPeJnI
|
||
/oXQACQZu+Osxcc5Az6TrFOcDbzaNJWLFc0z0I0nH6U
|
||
--- yaK1GBA2dIDieZHfJ0M3DKkP2jfCwGbwyVpMp7aIcNQ
|
||
[å å¤XßËÔÄ‘—=ëz, ?Š –zõö©-UéŽÁT9mF˜6˜Úx$j]¨¨'4àY[\Wü]ÉWŤMâ:à’š»<C5A1>3:ö¼½—&1ån |