google / google/fscrypt

Poor scriptability due to --name not being easily checkable

Open
#376 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
1k
Forks
111
Avg merge
2d 19h
Merged PRs (30d)
3

Description

I'm scripting the creation of some encrypted ext4 folders by calling the `fscrypt` CLI.

While most of the CLI seems designed for scriptability (prompts can be overridden by passing the information with CLI arguments), an unresolved pain point seems to be key names:

* Using `fscrypt metadata create protector` as described [here](https://github.com/google/fscrypt/tree/f91f8e4fcb59d6db80e5150530a65fe39a836eb2#using-a-raw-key-protector), or using `fscrypt encrypt`, requires passing `--name`.
* Passing an existing name give error `there is already a protector named "myname"`.
* But there is no way to programmatically query existing key names.

The only workaround seems to be parsing the output of `fscrypt status /`, which does not look very stable at all.

The bash completion currently does that in this ugly parsing hack:

https://github.com/google/fscrypt/blob/97700817e737eabf45033cdb4a42fa5c6e74f877/cmd/fscrypt/fscrypt_bash_completion#L86-L94

---

Other parts of `fscrypt` provide programmatic queries of whether something already exists, e.g. to check whether a dir is already encrypted one can check the status code of `fscrypt status`, which as per `--help`

> will fail if PATH is not setup for encryption with fscrypt

---

Some ideas to improve scriptability:

* Add a way to check if a key name is already taken.
* Or add e.g. a `--json` flag that turns all output into JSON, similar to how Hashicorp tools like `consul` provide it.
There's the request for #175 but things as simple as key creation should be possible also from the command line.
* Make `fscrypt metadata create protector` succeed instead of fail if the key name already exists AND the given `--source raw_key --key` is the same as the one already stored (that is, make it idempotent), or add a flag to get that behaviour.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.