skarbiec hook

Invocation#

skarbiec hook install <repo> --fields <field,...> [--min-length <N>] [--replace]
skarbiec hook status <repo>
skarbiec hook uninstall <repo>

Purpose#

Stop a commit that would put a password, token or key the vault keeps into a repository's history, where deleting it later no longer helps.

Required inputs and options#

• The repository's directory; a relative path is taken in the working directory. install takes --fields and the optional --min-length that scan takes, and --replace to write over a pre-commit hook already there.

Output and state effects#

• install asks git where the repository's hooks are (git rev-parse --git-path hooks, so core.hooksPath is honoured) and writes its pre-commit hook, executable, which runs this binary by its absolute path as scan <the files the commit adds or changes> --fields <fields> --refuse; git then refuses the commit naming each copy by file, line, item and field. It journals git-hook-installed and prints ok, hook, installed, fields and runs. The hook compares the files as they are in the working tree. status prints hook, present (a hook is there) and installed (this command wrote it). uninstall removes the hook, journals git-hook-removed and prints installed false. The operator API answers the same at POST /v1/operator/git-hook/install, /status and /uninstall with repo as an absolute path, on the machine it runs on only.

Refusals#

• Anything but a verb and a repository exits 2 with `usage: hook install <repo> --fields <field,...> [--min-length <N>] [--replace] | hook status <repo> | hook uninstall <repo>`, as do install without --fields or with --fields that are not field names separated by commas; --min-length that is not a whole number is refused naming it. A directory git does not take for a repository is refused with git's sentence. install refuses an existing hook without --replace, and a binary path holding a quote. uninstall refuses when there is no hook, and leaves a hook it did not write as it is, with `<hook> was not written by skarbiec hook install; it is left as it is`.

Examples#

skarbiec hook install . --fields password,token,api_key git commit -am 'config' # refused, naming the file, line and item of each copy skarbiec hook status . skarbiec hook uninstall .