decrypt (701B)
1 #!/usr/bin/env bash 2 3 # Helper script to decrypt a file in 4 # the repository. 5 # Makes sure that the output file is ignored in git. 6 7 set -eu 8 9 if [[ -z ${1:-} ]]; then 10 echo "Usage: $0 FILE" >&2 11 exit 1 12 fi 13 14 case $1 in 15 *.gpg) 16 ;; 17 *) 18 echo "Must be a .gpg file" >&2 19 exit 1 20 ;; 21 esac 22 23 outfile="${1%.gpg}" 24 25 if ! git check-ignore "$outfile" >/dev/null; then 26 echo "Output file must be gitignored" >&2 27 exit 1 28 fi 29 30 # Write straight to the gitignored path, so that a plaintext secret 31 # never exists under a name git would offer to commit. Remove the 32 # truncated output again if gpg fails. 33 if ! gpg -d "$1" > "$outfile"; then 34 rm -f "$outfile" 35 echo "Decryption of $1 failed" >&2 36 exit 1 37 fi