Support upstream pass Git diff configuration and avoid Git for read-only TOTP #62

New Issue

hugo · 2026-08-10T09:11:06Z

hugo commented

2026-08-10 09:11:06 +00:00

Goal

Make OTP access compatible with real upstream pass repositories, including current Homebrew pass installations on macOS.

Reproduction

An otherwise valid pass repository contains the common Git configuration:

[diff "gpg"]
    textconv = gpg -d ...

Upstream pass show and IronStorage show can decrypt the entry, but ironstorage otp code ENTRY fails before OTP parsing because the CLI eagerly opens embedded Git. crates/storage/src/git.rs rejects every diff section as a possible executable helper. The no-Git OTP fixture does not exercise this case.

Required implementation

Do not initialize or open a Git committer for read-only TOTP code generation. Git is required only for HOTP, where consuming a code increments and commits the counter.
Support the normal upstream diff.gpg.textconv repository configuration safely and without launching external processes. IronStorage must continue to prohibit execution of textconv or other helpers; compatibility means safely ignoring and preserving configuration that embedded operations do not execute, rather than rejecting the repository.
Keep the behavior and compatibility decisions in crates/storage; the CLI may only invoke the typed storage API and present results.
Add a compatibility fixture containing the real pass-style Git configuration and tests covering TOTP read-only access, HOTP counter persistence and commit, and rejection of genuinely unsafe runtime behavior.
Confirm show and otp code work against the same encrypted TOTP entry in that fixture.

Acceptance criteria

A TOTP entry in a pass repository with diff.gpg.textconv produces a code without opening Git or mutating repository state.
HOTP continues to increment atomically and commit through embedded Rust Git when appropriate.
No external command, gpg, shell, textconv, filter, credential helper, or executable Git hook is launched.
Failures leave ciphertext, HOTP counters, index, worktree, and Git history unchanged.
Required workspace formatting, check, clippy, and test gates pass.

## Goal Make OTP access compatible with real upstream pass repositories, including current Homebrew pass installations on macOS. ## Reproduction An otherwise valid pass repository contains the common Git configuration: [diff "gpg"] textconv = gpg -d ... Upstream pass show and IronStorage show can decrypt the entry, but ironstorage otp code ENTRY fails before OTP parsing because the CLI eagerly opens embedded Git. crates/storage/src/git.rs rejects every diff section as a possible executable helper. The no-Git OTP fixture does not exercise this case. ## Required implementation - Do not initialize or open a Git committer for read-only TOTP code generation. Git is required only for HOTP, where consuming a code increments and commits the counter. - Support the normal upstream diff.gpg.textconv repository configuration safely and without launching external processes. IronStorage must continue to prohibit execution of textconv or other helpers; compatibility means safely ignoring and preserving configuration that embedded operations do not execute, rather than rejecting the repository. - Keep the behavior and compatibility decisions in crates/storage; the CLI may only invoke the typed storage API and present results. - Add a compatibility fixture containing the real pass-style Git configuration and tests covering TOTP read-only access, HOTP counter persistence and commit, and rejection of genuinely unsafe runtime behavior. - Confirm show and otp code work against the same encrypted TOTP entry in that fixture. ## Acceptance criteria - A TOTP entry in a pass repository with diff.gpg.textconv produces a code without opening Git or mutating repository state. - HOTP continues to increment atomically and commit through embedded Rust Git when appropriate. - No external command, gpg, shell, textconv, filter, credential helper, or executable Git hook is launched. - Failures leave ciphertext, HOTP counters, index, worktree, and Git history unchanged. - Required workspace formatting, check, clippy, and test gates pass.

hugo added this to the 02 - Mutt-style terminal UI milestone 2026-08-10 09:11:06 +00:00

hugo added the bug label 2026-08-10 09:11:06 +00:00

hugo commented

2026-08-10 09:43:29 +00:00

Implemented and pushed in c86ea9e.

The storage OTP API now decrypts and parses the entry before deciding whether Git is needed. Read-only TOTP generation does not open a repository; HOTP still creates the storage-owned automatic committer, advances the counter, re-encrypts, and commits atomically.

Embedded Git validation now accepts and preserves the passive diff.gpg configuration written by upstream pass, including binary and textconv, while IronStorage never executes that helper. The public config mutation API still rejects diff drivers, and executable filter, merge, include, credential, protocol, URL rewrite, hook, SSH, proxy, and fsmonitor configuration remains rejected.

Compatibility coverage uses an upstream-style pass Git config fixture. Tests prove TOTP leaves ciphertext, config, and history byte-identical; HOTP increments and commits; forbidden helper config is ignored by TOTP but still blocks mutation; and CLI show plus otp code work in the same Git-backed fixture store.

Upstream behavior was audited against the current password-store source: https://git.zx2c4.com/password-store/tree/src/password-store.sh

Verification passed:

cargo fmt --all -- --check
RUSTFLAGS=-D warnings cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
git diff --check

Implemented and pushed in c86ea9e. The storage OTP API now decrypts and parses the entry before deciding whether Git is needed. Read-only TOTP generation does not open a repository; HOTP still creates the storage-owned automatic committer, advances the counter, re-encrypts, and commits atomically. Embedded Git validation now accepts and preserves the passive diff.gpg configuration written by upstream pass, including binary and textconv, while IronStorage never executes that helper. The public config mutation API still rejects diff drivers, and executable filter, merge, include, credential, protocol, URL rewrite, hook, SSH, proxy, and fsmonitor configuration remains rejected. Compatibility coverage uses an upstream-style pass Git config fixture. Tests prove TOTP leaves ciphertext, config, and history byte-identical; HOTP increments and commits; forbidden helper config is ignored by TOTP but still blocks mutation; and CLI show plus otp code work in the same Git-backed fixture store. Upstream behavior was audited against the current password-store source: https://git.zx2c4.com/password-store/tree/src/password-store.sh Verification passed: - cargo fmt --all -- --check - RUSTFLAGS=-D warnings cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace - git diff --check

hugo closed this issue

2026-08-10 09:43:29 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#62