Differences

This shows you the differences between two versions of the page.

--- infra:hackerpass [2024/03/23 17:45] – created kfh
+++ infra:hackerpass [2024/03/23 18:00] (current) – kfh
@@ Line 1: / Line 1: @@
-How to hackerpass
+====== How to hackerpass ======
+pass is the secret sharing infra we use at hackeriet. It's low effort, and every write becomes a commit. Since hackerpass is on a private repo, the README.md file from that repo is pasted below so others can benefit from the docs.
+The name hackerpass is something someone chose at one time to separate from pass. Feel free to name your own non-hackeriet shared pass repo pinkfluffyunicornpass or something to avoid confusion. 🦄
+----
+===== Getting started =====
+You'll need a GPG key for this. Send your public key to someone who already has access to follow "Adding a new user" below. You also need to be a member of hackeriet org in github for this next part to succeed.
+First install pass, then clone this repository into ~/.hackeriet_pass:
+<code>
+git clone git@github.com:hackeriet/pass.git ~/.hackeriet_pass
+</code>
+Then add the following alias to your .bashrc:
+<code>
+alias hackerpass='PASSWORD_STORE_DIR="$HOME/.hackeriet_pass" pass'
+</code>
+And import the gpg keys:
+<code>
+for i in $(<.hackeriet_pass/.gpg-id) ; do gpg --recv $i ; done
+</code>
+To update the password database from this repo type:
+<code>
+hackerpass git pull
+</code>
+===== Addding a password =====
+Beware this repository leaks file name information to everyone with access to the repo. Generally use the FQDN as a file name unless it reveals something it should not.
+<code>
+hackerpass generate that-place-i-put-that-thing-one-time.com 28
+</code>
+Then remember to push the new password:
+<code>
+hackerpass git push
+</code>
+===== Adding a new user =====
+After you have the new users' PGP key in your keyring, reencrypt the whole repository adding the new key:
+<code>
+hackerpass init $(<~/.hackeriet_pass/.gpg-id) <PGP key signature>
+</code>
+And then push it:
+<code>
+hackerpass git push
+</code>
+If you get the error message
+<code>
+gpg: <PGP key signature>: There is no assurance this key belongs to the named user
+gpg: [stdin]: encryption failed: Unusable public key
+</code>
+then do:
+<code>
+gpg --lsign-key <PGP key signature>
+</code>
+or if you don't have your certification key available, you can set the tofu policy for the keys:
+<code>
+gpg --tofu-policy good $(cat .hackeriet_pass/.gpg_id)
+</code>