all repos — dot @ master

Shell, editor and terminal configuration, and the tools that go with them

secrets/test/rotate.sh (view raw)

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 
#!/bin/bash
# Tests for rotate command

this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"

setup_key_dir_layout() {
    local keys_dir="${TEST_DIR}/keys"
    mkdir -p "${keys_dir}" "${SZECRET_STORE}"
    rm -f "${SZECRET_STORE}"/*.age
    unset SZECRET_PRIVATE_KEY
    export SZECRET_PRIVATE_KEY_DIR="${keys_dir}"

    local temp_key="${TEST_DIR}/initial-key"
    age-keygen -o "${temp_key}" 2>/dev/null
    local pub
    pub="$(age-keygen -y "${temp_key}")"
    echo "${pub}" > "${SZECRET_PUBLIC_KEY}"
    mv "${temp_key}" "${keys_dir}/${pub}"
    chmod 600 "${keys_dir}/${pub}"
    SETUP_PUB="${pub}"
}

test_rotate_reencrypts_secrets() {
    setup_key_dir_layout
    local old_pub="${SETUP_PUB}"

    echo "rotate-me" | szecret put "rotate-test"
    echo "other" | szecret put "rotate-other"

    szecret rotate --yes

    local new_pub
    new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
    if [[ "${new_pub}" == "${old_pub}" ]]; then
        fail "public key should change after rotate"
    fi

    assert_equals "rotate-me" "$(szecret get "rotate-test")" "rotated secret"
    assert_equals "other" "$(szecret get "rotate-other")" "other rotated secret"
    assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key file"
    pass "rotate re-encrypts secrets and updates keys"
}

test_rotate_empty_store() {
    setup_key_dir_layout >/dev/null

    szecret rotate --yes

    local new_pub
    new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
    assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key with empty store"
    pass "rotate succeeds with empty store"
}

test_rotate_requires_confirmation() {
    setup_key_dir_layout >/dev/null

    assert_failure szecret rotate
    pass "rotate fails without confirmation"
}

run_tests() {
    test_rotate_reencrypts_secrets
    test_rotate_empty_store
    test_rotate_requires_confirmation
}

[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests