70 lines
3.3 KiB
Markdown
70 lines
3.3 KiB
Markdown
# IronStorage
|
|
|
|
IronStorage is a native client for
|
|
[`pass`](https://git.zx2c4.com/password-store/about/) and
|
|
[`pass-otp`](https://github.com/tadfisher/pass-otp).
|
|
|
|
`pass` stores entries as GPG-encrypted `.gpg` files in an ordinary directory
|
|
tree (normally `~/.password-store`), selects one or more recipients through
|
|
`.gpg-id` files, and can track changes in Git. IronStorage keeps that format
|
|
and the first-party `pass` command behavior. `pass-otp` compatibility adds
|
|
`otpauth://` secrets, OTP generation, and QR import/export.
|
|
|
|
The compatibility target includes init, list/show, find/grep, insert/edit,
|
|
generate, remove, move/copy, and Git-backed commit and synchronization flows.
|
|
Remote synchronization is HTTPS-only and uses server/application credentials
|
|
kept in the operating system's secure store.
|
|
|
|
The central `ironstorage` Rust crate owns repository access, Git,
|
|
GPG-compatible encryption and key handling, entries, OTP, synchronization,
|
|
and platform-secure credential orchestration. Applications are presentation
|
|
and interaction adapters only. Runtime subprocesses—including `pass`, `git`,
|
|
and `gpg`—are forbidden; compatibility is implemented in Rust.
|
|
|
|
Candidate libraries and the pending project-license decision are tracked in
|
|
[`DEPENDENCIES.md`](DEPENDENCIES.md).
|
|
|
|
The shared TOML schema, path rules, editor precedence, and HTTPS remote format
|
|
are documented in [`docs/configuration.md`](docs/configuration.md).
|
|
Embedded Git, HTTPS synchronization, merge behavior, and commit signing are
|
|
documented in [`docs/git-synchronization.md`](docs/git-synchronization.md).
|
|
Native credential storage, opaque secret references, user-presence policy, and
|
|
bounded caching are documented in
|
|
[`docs/secure-secret-storage.md`](docs/secure-secret-storage.md).
|
|
The capability-scoped password-store layout and atomic mutation guarantees are
|
|
documented in [`docs/repository-core.md`](docs/repository-core.md).
|
|
The embedded OpenPGP backend, exported-key model, secret-provider boundary, and
|
|
GnuPG compatibility evidence are documented in
|
|
[`docs/cryptography.md`](docs/cryptography.md).
|
|
Hierarchical `.gpg-id` resolution, signed policies, selective reencryption, and
|
|
the rollback/commit contract are documented in
|
|
[`docs/recipient-policies.md`](docs/recipient-policies.md).
|
|
Typed list/show/find/decrypted-grep models and secret presentation selection are
|
|
documented in [`docs/read-domains.md`](docs/read-domains.md).
|
|
Insert modes, concurrency-safe edit sessions, and the secure CLI editor-file
|
|
boundary are documented in [`docs/write-domains.md`](docs/write-domains.md).
|
|
Unbiased password generation, character-set validation, in-place replacement,
|
|
and presentation actions are documented in
|
|
[`docs/password-generation.md`](docs/password-generation.md).
|
|
Rollback-safe remove, move, and copy transactions, destination rules, and
|
|
selective subtree reencryption are documented in
|
|
[`docs/tree-mutations.md`](docs/tree-mutations.md).
|
|
|
|
## Project layout
|
|
|
|
```text
|
|
crates/storage password-store domain and storage library
|
|
crates/apple UniFFI boundary for Apple presentation code
|
|
apps/cli pass-compatible command-line frontend
|
|
apps/tui Ratatui frontend
|
|
apps/desktop Iced desktop frontend for macOS, Windows, and Linux
|
|
apple/ iPhone, AutoFill, and watchOS presentation targets
|
|
```
|
|
|
|
The Apple project is generated with XcodeGen:
|
|
|
|
```sh
|
|
cd apple
|
|
xcodegen generate
|
|
```
|