git-crypt-bundle

#!/bin/bash
set -euo pipefail

VERSION="0.2"

. "$(dirname "$0")/bash-backtrace.sh"

# TODOs
# - move config out of git and into file
#   - config should be in outer bundle dir to enable restoration
#   - write better docs / usage on creation, restoration, push/pull

usage() {
    basename="$(basename "$0")"
    cat >&2 <<EOM
usage: $basename create <bundle-directory> <GPG-recipient>
   or: $basename info
   or: $basename pull
   or: $basename push
   or: $basename pull-local
   or: $basename push-local
   or: $basename version
EOM
}

run() {
    echo >&2 "+ $*"
    "$@"
}

default_git_ignore() {
    cat <<EOM
/${GCB_FILE}
/${GCB_FILE}.gpg
/${GCB_PASS_FILE}
EOM
}

read_config() {
    repo_root="$(run git rev-parse --show-toplevel)"
    cd "$repo_root"
    SEE_OTHER="$(run git config cryptbundle.see-other-dir || true)"

    if [ -n "$SEE_OTHER" ]; then
        echo >&2 "config redirects to $SEE_OTHER"
        echo >&2 "+ cd $SEE_OTHER"
        cd "$SEE_OTHER"
    fi

    BUNDLE_DIRECTORY="$(run git config cryptbundle.directory)"
    GPG_RECIPIENT="$(run git config cryptbundle.gpg-recipient)"
    GIT_AMEND="$(run git config cryptbundle.git-amend || true)"
}

cmd_info() {
    cat <<EOM

info -- git-crypt-bundle config read from \`git config\`:
PWD: $PWD

    BUNDLE_DIRECTORY=$BUNDLE_DIRECTORY
    GPG_RECIPIENT=$GPG_RECIPIENT
    GCB_REMOTE=$GCB_REMOTE"
    GCB_BRANCH=$GCB_BRANCH
    GCB_LOCAL_BRANCH=$GCB_LOCAL_BRANCH
    GCB_BASENAME=$GCB_BASENAME
    GCB_FILE=$GCB_FILE
    GCB_PASS_FILE=$GCB_PASS_FILE
    GIT_AMEND=$GIT_AMEND
EOM
}

cmd_create() {
    bundle_directory="$1"
    gpg_recip="$2"

    mkdir "$bundle_directory"

    run git config cryptbundle.directory "$bundle_directory"
    run git config cryptbundle.gpg-recipient "$gpg_recip"

    run git remote add "$GCB_REMOTE" "$bundle_directory/$GCB_FILE"

    cd "$bundle_directory"
    random_passphrase > "$GCB_PASS_FILE"
    run git init
    default_git_ignore > .gitignore
    run touch "${GCB_FILE}.gpg.gpg"
    run git add .
    run git commit -m 'Initial import'
}

random_passphrase() {
    run head -c 32 /dev/urandom | openssl base64
}

decrypt_bundle() {
    pushd "$BUNDLE_DIRECTORY"

    rm -fv "$GCB_FILE" "${GCB_FILE}.gpg"
    run gpg -d --batch -o - "${GCB_FILE}.gpg.gpg" \
        | run gpg -d --batch --passphrase-fd 3 -o "$GCB_FILE" 3< "$GCB_PASS_FILE"

    popd
}

encrypt_bundle() {
    pushd "$BUNDLE_DIRECTORY"

    rm -fv "${GCB_FILE}.gpg"
    rm -fv "${GCB_FILE}.gpg.gpg"

    run gpg -c -z 0 --batch --passphrase-fd 0 -o - "$GCB_FILE" < "$GCB_PASS_FILE" \
        | run gpg -e -z 0 -r "$GPG_RECIPIENT" --batch -o "$GCB_FILE.gpg.gpg"

    popd
}

bundle_git_commit() {
    pushd "$BUNDLE_DIRECTORY"

    local message prev
    message='Update crypt bundle.'

    prev=$(git log -1 --pretty=format:%s)

    if [ -n "$GIT_AMEND" ] && [ "$prev" = "$message" ]; then
        run git commit -a --amend --reset-author -m "$message"
    else
        run git commit -a -m "$message"
    fi

    popd
}

cmd_pull_local() {
    decrypt_bundle
    run git pull --ff-only "$GCB_REMOTE" "$GCB_BRANCH"
}

create_bundle() {
    bundle_path="$BUNDLE_DIRECTORY/${GCB_FILE}"
    run git bundle create "$bundle_path" "$GCB_LOCAL_BRANCH"
}

cmd_push_local() {
    create_bundle
    encrypt_bundle
    bundle_git_commit
}

cmd_pull() {
    pushd "$BUNDLE_DIRECTORY"
    run git pull --ff-only
    popd

    cmd_pull_local
}

cmd_push() {
    cmd_push_local

    pushd "$BUNDLE_DIRECTORY"

    if [ -n "$GIT_AMEND" ]; then
        run git push --force
    else
        run git push
    fi
    popd
}

if [ $# -lt 1 ]; then
    usage
    exit 1
fi

GCB_REMOTE="${GCB_REMOTE-bundle}"
GCB_BRANCH="${GCB_BRANCH-master}"
GCB_LOCAL_BRANCH="${GCB_LOCAL_BRANCH-master}"
GCB_BASENAME="crypt"
GCB_FILE="${GCB_BASENAME}.bundle"
GCB_PASS_FILE="passphrase"

case "$1" in
    create)
        if [ $# -lt 3 ]; then
            usage
            exit 1
        fi
        shift
        cmd_create "$@"
        ;;
    info) read_config; cmd_info ;;
    pull) read_config; cmd_pull ;;
    push) read_config; cmd_push ;;
    pull-local) read_config; cmd_pull_local ;;
    push-local) read_config; cmd_push_local ;;
    push-local-bundle) read_config; cmd_push_local ;;
    version)
        echo "$(basename "$0") version $VERSION"
        ;;
    *)
        usage
        exit 1
        ;;
esac