chezmoi parses attribute prefixes left-to-right and 'encrypted_' must
precede 'private_'. The 'private_encrypted_' order silently breaks
decryption: chezmoi consumes 'private_', then treats 'encrypted_foo.age'
as a literal filename and copies the ciphertext verbatim instead of
decrypting it.
models.yml was named 'private_encrypted_models.yml.age' since commit
3c3fab7 and was never decrypting — a stale 'encrypted_models.yml.age'
blob was sitting in ~/.omp/agent/ and the plaintext models.yml was an
unmanaged leftover. .env and zai.key used the plain 'encrypted_'
prefix and were decrypting at umask 0644 (world-readable in isolation;
the 700 ~/.omp/agent/ dir was the only thing shielding them).
This commit:
* renames all three to encrypted_private_{zai.key,.env,models.yml}.age
so chezmoi decrypts AND lands them at 0600 natively
* rewrites run_onchange_35 as 'ensure-omp-secret-perms.sh' covering
all three, as belt-and-suspenders for any box where a secret still
sits at 0644 from a prior apply
* removes the stale encrypted_models.yml.age verbatim blob and its
orphan state entry
* corrects the README perms section to document the prefix-order
gotcha (was misleadingly claiming 'private_' alone gave 0600)
Verified end-to-end on this box: chezmoi managed lists all three as
decrypted targets, scoped apply writes them at 600, chmod script is
idempotent. Other boxes need a 'chezmoi apply' to pick up the rename
and the onchange chmod.
23 lines
No EOL
1.9 KiB
Text
23 lines
No EOL
1.9 KiB
Text
age-encryption.org/v1
|
||
-> X25519 KzXhOw3iY0Q6KLcznDZZicbn9VWaSDYr7IjEzAxA6Fw
|
||
yHT/cY6Bqzt34tUZMpBPV6rusMooQmsyZTtKdLnE7Jw
|
||
-> X25519 iRTxwwxq98Sm1YhRxvU/dK+b38YuVOYb6SEaKAfinAA
|
||
YDTiTwWrdiM9+sjyRJcIyxgLK2Ewqp5os9N0lfo7oy8
|
||
-> X25519 IGTSzIIw4VLJNaHv7IsRKcJlQbHPvFdjeQNMgf2ze3A
|
||
gUEkX+PUQmFaDjcKlC+cnC66k6CMxYv6bEkIvPcCSQs
|
||
-> X25519 LY0nf6XDW0bk/TWL9OLjO/8b4Ixf5dNJQDmDu1g9amQ
|
||
q+BTQDKvw4zhoQotbDPlobDPeq7DE9axnPkiPZP85LQ
|
||
-> X25519 eNwiHEFacnxXCFdgsifdHgyP0S+YWfFgTdpgQWBHTE0
|
||
zP7LjnyO5znUtnQiXAtqpK0ZzJdqd/Mz4Eyg44XVLV0
|
||
-> X25519 9E5zTEvHNgLwIFgibj74HFBBdmrUqmq6TbF7pJyzHXQ
|
||
XbqRaZZlXSzBylVnDxyiNQ1vLeI44OJH8hnGHbNLdtQ
|
||
-> X25519 pAZi5ClxRt0Bch2ARnyCLrLYhU5fNf2VKEEt/yWc+0Q
|
||
b+l5sOU+G3ZGgPzR2oq4IAAZzyWjwTu5cdRg/aTBhPg
|
||
-> X25519 9Gm74SgOAuoxJN+4z7smNBl+rwOJej3e3+XMDWbUJF8
|
||
WrQ13/0S876oBMsRykudZY+GDzasaT6crI9ToFsipK4
|
||
--- fWANl9x9fhYazZUwLeZUW4+AOLbU9JXs/er+Ttk+POE
|
||
´ïÕ‰¦Ý7…ÞWmÚ›iÞ²ÿ$L4žpÊ(,:$VÏ•E'o®û`Á•–%3¬ØKÜ·ÕžþìíÐk<>êùó&\ëd7GxÊ©.ðíÂT6>ÊU˜Îï<C38E>?ÇÅÐ*T¦Ï<C2A6>HK=$÷wr»'¦ìT5r‚µvï<76>ÑjòÙUý¡|ÂYG`Q2¹ÖÌH²¾íù±$3±(|8Z¾Ðò‚=¹ÔZ˜l¨åÚ¶Šxü&
|
||
ÏO&geÿùKû}>ùÀ€(Ä/|%xåx5VŒ]Ó`OÐ<4F>Ãîå%9:m¿×Et}ãIøDܶãÒ ™4w}‰°MbÂæšÍÜ$™l8¸/Ûaw9zRžåNp<4E>‹?ˆCwXf²Þ?¦³ÂAˆé“PâÅù>‰§í+ÐGè£êT
|
||
Wõ7êѬ•ÓêØ*¨`ä-<2D>ˆ‚Ÿø¨Äª–Õ#!œfV0g„]}Rãki:'ˆŠâÁ¿½IྨW³ÖìF—!©<>s0¹^yù¹”cãWí¿ò./E·Â<C2B7>¡1´–ú8»)í.Ùîè."÷òm<ïsFžS>bß²ì8‚Ô/'tOÕn¾hr…”X "_}~Îî¼N"‹m¶UxŽý(úŠŠ¸Gæ0r6Ãx°y£Œ©†Ruү‚<C382>Ž’©`<60><&ŽŽeãˆ4PÒá7šþðÉí
|
||
ÚÞ‚Œnp’þÐmü8r¿6”M |