git-crypt-delete

git-crypt-delete

#!/bin/bash

set -o pipefail


case "$1" in
  --list|-l)
    list_only=1
    ;;
  --dry-run|-n)
    dry_run=1
    ;;
esac

keys_to_regen=()
to_remove=(${@})

key_should_be_removed() {
  local key="$1"
  gpg --list-key "$key" | grep -E "^uid" | grep -q -F -f <(printf '%s\n' "${to_remove[@]}")
  return $?
}

email_from_key() {
  local key="$1"
  email="$(gpg --list-key "$key" | awk '/^uid/ { $1="";print $0;exit}')"
  echo "${key:(-8)}$email"
}

for keyfile in .git-crypt/keys/default/0/*
do
  key="$(basename "$keyfile" .gpg)"
  if [ -n "$list_only" ]; then
    gpg --list-key "$key"
    if [ "$?" != 0 ]; then
    untrusted=1
    gpg --homedir /tmp --keyserver pgp.mit.edu --batch --recv-keys "$key"
    gpg --homedir /tmp --list-key "$key" || {
    echo "Couldn't find neither trusted nor untrusted info about $key";
    }
  fi
    continue;
  fi

  key_should_be_removed "$key" && keys_to_remove+=("$(email_from_key "$key")") || keys_to_regen+=("$(email_from_key "$key")")
done

[ -z "$list_only" ] || exit 0

message="Regenerate git-crypt keys after removing ${#keys_to_remove[@]} collaborator(s)

Removed collaborators:
$(printf ' %s\n' "${keys_to_remove[@]}")

Current collaborators:
$(printf ' %s\n' "${keys_to_regen[@]}")
"

[ -z "$dry_run" ] || { echo "$message"; exit 0; }


if [ ! -z "$untrusted" ] then
    echo "Cowardly refusing to continue with untrusted info"
    exit 1
fi


#git rm -rf .git-crypt/keys/default/0

#git-crypt add-gpg-user -n --trusted "${keys_to_regen[@]}"

#git ci -m"$message"