Something went wrong. Try again.
Monorepo for Aesthetic.Computer aesthetic.computer
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190#!/bin/bash# ac-vault-unlock — Import GPG keys from USB and unlock the vault# Usage:# ac-vault-unlock Import keys from USB + unlock vault# ac-vault-unlock keys Copy GPG keys TO the USB (for bootstrapping)# ac-vault-unlock status Check if GPG key is imported and vault stateset -eSCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"REPO_DIR="$(cd "${SCRIPT_DIR}/../.." && pwd)"VAULT_DIR="${REPO_DIR}/aesthetic-computer-vault"GPG_RECIPIENT="mail@aesthetic.computer"log() { echo -e "\033[0;36m[ac-vault-unlock]\033[0m $*"; }err() { echo -e "\033[0;31m[ac-vault-unlock]\033[0m $*" >&2; }find_usb_dev() { for dev in sda sdb sdc; do if [ -e "/sys/block/${dev}/removable" ]; then local rem=$(cat "/sys/block/${dev}/removable" 2>/dev/null) if [ "${rem}" = "1" ] && [ -e "/sys/block/${dev}" ]; then echo "/dev/${dev}" return 0 fi fi done if [ -e "/sys/block/sda" ]; then echo "/dev/sda" return 0 fi return 1}docker_usb() { sudo docker run --rm --privileged -v /dev:/dev alpine:latest sh -c "$1" 2>&1}check_gpg_key() { gpg --list-secret-keys "${GPG_RECIPIENT}" &>/dev/null}CMD="${1:-unlock}"case "${CMD}" in unlock) # Check if key is already imported if check_gpg_key; then log "GPG key already imported for ${GPG_RECIPIENT}" else log "GPG key not found — reading from USB..." USB_DEV="$(find_usb_dev)" || { err "No USB device found. Plug in your key USB."; exit 1; } # Extract private key from USB via docker TMPKEY=$(mktemp /tmp/gpg-import-XXXXXX.asc) trap "rm -f '${TMPKEY}'" EXIT CONTAINER=$(sudo docker create --privileged -v /dev:/dev alpine:latest sh -c " apk add --quiet dosfstools mkdir -p /mnt/usb mount ${USB_DEV}1 /mnt/usb if [ -f /mnt/usb/gpg/jeffrey-private.asc ]; then cat /mnt/usb/gpg/jeffrey-private.asc elif [ -f /mnt/usb/jeffrey-private.asc ]; then cat /mnt/usb/jeffrey-private.asc else echo 'KEY_NOT_FOUND' fi umount /mnt/usb ") sudo docker start -a "${CONTAINER}" > "${TMPKEY}" 2>/dev/null sudo docker rm "${CONTAINER}" &>/dev/null || true if grep -q "KEY_NOT_FOUND" "${TMPKEY}" || [ ! -s "${TMPKEY}" ]; then err "No GPG key found on USB." err "Expected: gpg/jeffrey-private.asc or jeffrey-private.asc" err "Run 'ac-vault-unlock keys' to copy keys to USB first." exit 1 fi log "Importing GPG key..." gpg --batch --import "${TMPKEY}" # Trust the key ultimately echo -e "5\ny\n" | gpg --batch --command-fd 0 --expert --edit-key "${GPG_RECIPIENT}" trust quit 2>/dev/null log "GPG key imported and trusted." fi # Unlock the vault if [ ! -d "${VAULT_DIR}" ]; then err "Vault not found at ${VAULT_DIR}" exit 1 fi cd "${VAULT_DIR}" log "Unlocking vault..." fish vault-tool.fish unlock log "Vault unlocked." ;; keys) # Copy GPG keys TO the USB for bootstrapping USB_DEV="$(find_usb_dev)" || { err "No USB device found."; exit 1; } # Get keys from vault (must be decrypted) or from GPG keyring TMPDIR=$(mktemp -d /tmp/gpg-export-XXXXXX) trap "rm -rf '${TMPDIR}'" EXIT if [ -f "${VAULT_DIR}/gpg/jeffrey-private.asc" ]; then log "Using keys from vault..." cp "${VAULT_DIR}/gpg/jeffrey-private.asc" "${TMPDIR}/" cp "${VAULT_DIR}/gpg/jeffrey-public.asc" "${TMPDIR}/" elif check_gpg_key; then log "Exporting keys from GPG keyring..." gpg --armor --export "${GPG_RECIPIENT}" > "${TMPDIR}/jeffrey-public.asc" gpg --armor --export-secret-keys "${GPG_RECIPIENT}" > "${TMPDIR}/jeffrey-private.asc" else err "No keys available. Import keys first or unlock the vault." exit 1 fi log "Writing keys to USB ${USB_DEV}..." CONTAINER=$(sudo docker create --privileged -v /dev:/dev alpine:latest sh -c " apk add --quiet dosfstools mtools mkdir -p /mnt/usb mount ${USB_DEV}1 /mnt/usb mkdir -p /mnt/usb/gpg cp /tmp/jeffrey-private.asc /mnt/usb/gpg/ cp /tmp/jeffrey-public.asc /mnt/usb/gpg/ sync ls -la /mnt/usb/gpg/ umount /mnt/usb ") sudo docker cp "${TMPDIR}/jeffrey-private.asc" "${CONTAINER}:/tmp/jeffrey-private.asc" sudo docker cp "${TMPDIR}/jeffrey-public.asc" "${CONTAINER}:/tmp/jeffrey-public.asc" sudo docker start -a "${CONTAINER}" 2>&1 sudo docker rm "${CONTAINER}" &>/dev/null || true log "GPG keys written to USB at gpg/" ;; status) echo "=== GPG Key ===" if check_gpg_key; then gpg --list-secret-keys "${GPG_RECIPIENT}" 2>/dev/null echo "" echo "Status: IMPORTED" else echo "Status: NOT IMPORTED" fi echo "" echo "=== Vault ===" if [ -d "${VAULT_DIR}" ]; then cd "${VAULT_DIR}" fish vault-tool.fish status 2>/dev/null || echo "vault-tool.fish not found" else echo "Vault directory not found" fi echo "" echo "=== USB ===" USB_DEV="$(find_usb_dev 2>/dev/null)" && { echo "USB device: ${USB_DEV}" docker_usb " apk add --quiet dosfstools mkdir -p /mnt/usb mount ${USB_DEV}1 /mnt/usb 2>/dev/null && { if [ -f /mnt/usb/gpg/jeffrey-private.asc ]; then echo 'GPG keys: FOUND at gpg/' elif [ -f /mnt/usb/jeffrey-private.asc ]; then echo 'GPG keys: FOUND at root' else echo 'GPG keys: NOT FOUND' fi umount /mnt/usb } || echo 'Could not mount partition' " } || echo "No USB detected" ;; *) echo "Usage: ac-vault-unlock {unlock|keys|status}" echo "" echo "Commands:" echo " unlock Import GPG keys from USB + unlock vault (default)" echo " keys Copy GPG keys TO the USB (for bootstrapping)" echo " status Check GPG key, vault, and USB state" exit 1 ;;esac