Implement init, recipient hierarchy and selective reencryption #5

New Issue

2026-08-09T18:54:57Z

hugo commented

2026-08-09 18:54:57 +00:00

Objective

Implement pass init and hierarchical .gpg-id recipient policy, including selective reencryption.

Scope

Support root and --path/-p initialization, multiple GPG IDs, and removal through a single empty ID.
Resolve the nearest ancestor .gpg-id for every entry.
Reencrypt only affected entries when recipient policy changes, including nested overrides.
Create or verify .gpg-id.sig when signing-key policy is configured.
Commit successful changes through the storage Git integration while leaving the tree unchanged on failure.

Acceptance criteria

Resulting .gpg-id files and ciphertext recipients match upstream-compatible fixtures.
Reencryption preserves plaintext exactly and is atomic across the affected subtree.
Tests cover root and nested initialization, multiple recipients, removed overrides, invalid recipients, signature failure, and rollback.

Prerequisites

Safe password-store core; embedded GPG-compatible cryptography.

## Objective Implement `pass init` and hierarchical `.gpg-id` recipient policy, including selective reencryption. ## Scope - Support root and `--path/-p` initialization, multiple GPG IDs, and removal through a single empty ID. - Resolve the nearest ancestor `.gpg-id` for every entry. - Reencrypt only affected entries when recipient policy changes, including nested overrides. - Create or verify `.gpg-id.sig` when signing-key policy is configured. - Commit successful changes through the storage Git integration while leaving the tree unchanged on failure. ## Acceptance criteria - Resulting `.gpg-id` files and ciphertext recipients match upstream-compatible fixtures. - Reencryption preserves plaintext exactly and is atomic across the affected subtree. - Tests cover root and nested initialization, multiple recipients, removed overrides, invalid recipients, signature failure, and rollback. ## Prerequisites Safe password-store core; embedded GPG-compatible cryptography.

hugo added this to the 01 - Full Rust pass CLI parity milestone 2026-08-09 18:54:57 +00:00

hugo added the enhancement label 2026-08-09 18:54:57 +00:00

hugo referenced this issue from a commit

2026-08-09 22:12:51 +00:00

Implement hierarchical recipient policies (#5)

hugo commented

2026-08-09 22:13:05 +00:00

Implemented and pushed in 34ce731 (Implement hierarchical recipient policies (#5)).

Implementation:

Added storage-owned root and --path/-p initialization with one-line-per-identity .gpg-id output, multiple recipients, and upstream-compatible removal through one empty identity.
Added nearest-ancestor recipient resolution and exact selective reencryption: deeper .gpg-id overrides shield their subtrees, existing recipient packets avoid needless rewrites, and removing an override inherits the nearest parent.
Added signed-policy creation and immediate trusted-fingerprint verification, plus required verification of inherited .gpg-id.sig files when signing policy is active.
Added a rollback-safe mutation plan: all resolution, verification, decryption, and encryption finish before writes; original ciphertext and policy bytes are restored on write or storage commit failure; new empty directories are cleaned up.
Added the PolicyCommitter integration boundary for the embedded storage Git engine, with exact changed paths, compatible commit intent, one callback per real change, no callback for no-ops, and byte restoration on commit error.
Documented hierarchy, signature behavior, transaction guarantees, and the Git integration contract in docs/recipient-policies.md.

Issue-isolated verification:

cargo test -p ironstorage --test recipient_policy: 7 passed
Covers root/nested initialization, multiple recipients, nearest policies, nested override shielding, removed overrides, exact plaintext preservation, invalid recipients, signing trust failure, no-op suppression, byte-exact rollback, and new-directory rollback.
Related crypto compatibility suite: 8 passed.

Required repository gates all passed:

cargo fmt --all -- --check
RUSTFLAGS=-D warnings cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace

Implemented and pushed in 34ce731 (Implement hierarchical recipient policies (#5)). Implementation: - Added storage-owned root and --path/-p initialization with one-line-per-identity .gpg-id output, multiple recipients, and upstream-compatible removal through one empty identity. - Added nearest-ancestor recipient resolution and exact selective reencryption: deeper .gpg-id overrides shield their subtrees, existing recipient packets avoid needless rewrites, and removing an override inherits the nearest parent. - Added signed-policy creation and immediate trusted-fingerprint verification, plus required verification of inherited .gpg-id.sig files when signing policy is active. - Added a rollback-safe mutation plan: all resolution, verification, decryption, and encryption finish before writes; original ciphertext and policy bytes are restored on write or storage commit failure; new empty directories are cleaned up. - Added the PolicyCommitter integration boundary for the embedded storage Git engine, with exact changed paths, compatible commit intent, one callback per real change, no callback for no-ops, and byte restoration on commit error. - Documented hierarchy, signature behavior, transaction guarantees, and the Git integration contract in docs/recipient-policies.md. Issue-isolated verification: - cargo test -p ironstorage --test recipient_policy: 7 passed - Covers root/nested initialization, multiple recipients, nearest policies, nested override shielding, removed overrides, exact plaintext preservation, invalid recipients, signing trust failure, no-op suppression, byte-exact rollback, and new-directory rollback. - Related crypto compatibility suite: 8 passed. Required repository gates all passed: - cargo fmt --all -- --check - RUSTFLAGS=-D warnings cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace

hugo closed this issue

2026-08-09 22:13:13 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#5