roddhjav / pass-update Goto Github PK

View Code? Open in Web Editor NEW

275.0 11.0 22.0 298 KB

A pass extension that provides an easy flow for updating passwords.

Home Page: https://www.passwordstore.org

License: GNU General Public License v3.0

Makefile 8.71% Shell 85.43% Python 5.86%

pass password password-manager pass-extension password-store

pass-update's Introduction

pass update

A pass extension that provides an easy flow for updating passwords.

Description

pass update extends the pass utility with an update command providing an easy flow for updating passwords. It supports path, directory and wildcard update. Moreover, you can select how to update your passwords by automatically generating new passwords or manually setting your own.

pass update assumes that the first line of the password file is the password and so only ever updates the first line unless the --multiline option is specified.

By default, pass update prints the old password and waits for the user before generating a new one. This behaviour can be changed using the provided options.

Usage

pass update 2.2.1 - A pass extension that provides an easy flow for updating passwords.

Usage:
    pass update [-h] [-n] [-l <s>] [-c | -p] [-p | -m]
                [-e <r>] [-i <r>] [-E] [-f] pass-names...
         Provide an interactive solution to update a set of passwords.
         pass-names can refer either to password store path(s) or to
         directory.

         It prints the old password and waits for the user before generating
         a new one. This behaviour can be changed using the provided options.

         Only the first line of a password file is updated unless the
         --multiline option is specified.

     Options:
         -c, --clip        Write the password to the clipboard.
         -n, --no-symbols  Do not use any non-alphanumeric characters.
         -l, --length <s>  Provide a password length.
         -a, --auto-length Match the previous password's length.
         -p, --provide     Let the user specify a password by hand.
         -m, --multiline   Update a multiline password.
         -i, --include <r> Only update the passwords that match a regex.
         -e, --exclude <r> Do not update the passwords that macth a regex.
         -E, --edit        Edit the password using the default editor.
         -f, --force       Force update.
         -V, --version     Show version information.
         -h, --help        Print this help message and exit.

More information may be found in the pass-update(1) man page.

See man pass-update for more information.

Examples

Update Social/twitter.com

pass update Social/twitter.com
Changing password for Social/twitter.com
[}p&62"#"x'aF/_ix}6X3a)zq
Are you ready to generate a new password? [y/N] y
The generated password for Social/twitter.com is:
~*>afZsB+G\,c#+g$-,{OqJ{w

Update all the Emails

pass update Email
Changing password for Email/donenfeld.com
b9b"k(u#m7|ST-400B5gM%[Kq
Are you ready to generate a new password? [y/N] y
The generated password for Email/donenfeld.com is:
m6~!b5U`OhloT~R,4-OCa:h$Q
Changing password for Email/zx2c4.com
HWl7u\Aqdk]AY$y!='@>]8"@`
Are you ready to generate a new password? [y/N] y
The generated password for Email/zx2c4.com is:
@uLYW_X9a",?wDQN=hp/^Z!$J

Set password length

pass update -l 50 France/bank
Changing password for France/bank
9b'I;]b)>06xug!3.ME1*E+M3
login: zx2c4
Are you ready to generate a new password? [y/N] y
The generated password for France/bank is:
|3=&{ko:#I|A,P4*=[|hk^/V4jIcRN.uBBd-~RB0_L<sS[%k%-

Provide a password by hand

pass update -p Business/site.com
Changing password for Business/site.com
Zk=u]HqjUAKPZ$gM_,LuZV8J2
login: zx2c4
Are you ready to provide a new password? [y/N] y
Enter the new password for Business/site.com:
Retype the new password for Business/site.com:

Do not update PIN code

pass update --exclude '^[0-9]+$' /

Update only PIN code

pass update --include '^[0-9]+$' /

Installation

Requirements

pass 1.7.0 or greater.

ArchLinux

pass-update is available in the Arch User Repository.

yay -S pass-update  # or your preferred AUR install method

Debian/Ubuntu

pass-update is available my own debian repository with the package name pass-extension-update. Both the repository and the package are signed with my GPG key: 06A26D531D56C42D66805049C5469996F0DF68EC.

wget -qO - https://pkg.pujol.io/debian/gpgkey | gpg --dearmor | sudo tee /usr/share/keyrings/pujol.io.gpg >/dev/null
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/pujol.io.gpg] https://pkg.pujol.io/debian/repo all main' | sudo tee /etc/apt/sources.list.d/pkg.pujol.io.list
sudo apt-get update
sudo apt-get install pass-extension-update

NixOS

nix-env -iA nixos.passExtensions.pass-update

OSX

pass-update is available with Homebrew using a third-party repository

brew tap simplydanny/pass-extensions
brew install pass-update

From git

git clone https://github.com/roddhjav/pass-update/
cd pass-update
sudo make install  # For OSX: make install PREFIX=/usr/local

Stable version

wget https://github.com/roddhjav/pass-update/releases/download/v2.2.1/pass-update-2.2.1.tar.gz
tar xzf pass-update-2.2.1.tar.gz
cd pass-update-2.2.1
sudo make install  # For OSX: make install PREFIX=/usr/local

Releases and commits are signed using 06A26D531D56C42D66805049C5469996F0DF68EC. You should check the key's fingerprint and verify the signature:

wget https://github.com/roddhjav/pass-update/releases/download/v2.2.1/pass-update-2.2.1.tar.gz.asc
gpg --recv-keys 06A26D531D56C42D66805049C5469996F0DF68EC
gpg --verify pass-update-2.2.1.tar.gz.sig

Contribution

Feedback, contributors, pull requests are all very welcome.

pass-update's People

Contributors

Stargazers

Watchers

pass-update's Issues

Update multiline pass?

It would be cool if users could change a multilaned pass point. Also, if users could specify password by hand without generation. Can you do it in the next releases?

Can't create install dir on osX

→ sudo make install
Password:
install: mkdir /usr/lib/password-store: Operation not permitted
make: *** [install] Error 71

Add fish completion

zsh and bash have completion since #9, but fish is missing out. I'm working on fish completion for pass-otp here. Once I've got that fully working I'll port that to pass-update

new release?

hello!

i see the last release of this project is from 2018, yet there are new commits up to 2022, including some improvements to tests and the makefile. To make a cleaner debian package (#31), it would be great to have a new upstream release.

Thanks!

install: mkdir /usr/lib/password-store: Operation not permitted

Ran with sudo make install as instructed, but it fails. Installed pass via homebrew.

Change passwords that match a regular expression

Before using pass some users may have been using a formula for their passwords. It would be great if we could have the extension search for passwords that match a regular expression, so we can find and replace those with non-generated passwords.

Tab completion?

Is there any chance this supports tab completion? Tab completion works in my normal pass stuff, but not after I've typed pass update ....

Thanks!

Homebrew formula?

Please :)

NO_PUBKEY C5469996F0DF68EC

Unable to install on my Debian machine following the README instructions. Warning states public key is not available.

Distributor ID:	Debian
Description:	Debian GNU/Linux 11 (bullseye)
Release:	11
Codename:	bullseye

Can confirm the /usr/share/keyrings/pujol.io.gpg keyring file is installed and the sources list updated.

official debian package?

Hi!

Thanks for this interesting package. Have you considered submitting it to Debian directly?

I'm working on auditing the code and packaging it myself, but i'm happy to have you as a maintainer and just sponsor your uploads, or have you as a co-maintainer, as you wish!

Mention that only the first line is updated in documentation

I was reading though the documentation and I found that it was only implicitly mentioned in the man page that only the first line of a password is updated. I had to read the code to confirm this was the case.

I believe that having the first line of the password file be the password is only a convention so it might not be implied that your plugin would work this way (at least I didn't assume it, but I'm new :D).

It might be worth adding to the README and man page to let people know this is what you're doing :)

Farnetic on the syntax to set the length of updated passwords

Should'nt the syntax for setting the length of the new password follow the one used with the command generate?

So like: pass generate Email/jasondonenfeld.com 15

I know it's a bit a useless, but i think it's more intuitive!

Support no symbols and length

It would be nice if pass-update could accept the same password options as pass generate -- specifically -n/--no-symbols and the length.

Looking for -n and passing it on to cmd_generate seems simple enough. Taking length as the final argument the way pass generate does may be tricky since pass-update accepts multiple entries. Maybe just accept -l/--length?

$ pass update -n -l 128 social/facebook social/github

[Feature request] Automatically match password length

I let pass generate passwords of the default length, which at the moment is 25 characters.
Some websites (example: poste.it) enforce a maximum length (16 characters) for the password, and it's hard to remember what it is for each one.
It would be useful for this extension to match the previous password's length if no explicit -l is provided.
This would allow users to satisfy the site requirements when creating the account, and then have the extension automatically create valid passwords while updating.

Specify subset of special characters

Hi,

I just started using this tool and I really like it! One issue I'm having though is that some of the special characters included when generating passwords are not accepted by a lot of websites. I think <>\{} are some of the typical offenders. Right now my solution is to just generate an alphanumeric password, but then I miss out on the password strength associated with including special characters. Would there be a way to include an option like -s / --special-subset (or whatever you want to call it) that includes more generally accepted special characters like !@#$%^&*?

Merge upstream

Just a random question if you think it'd make sense to merge this into pass proper (instead of an extension)? It seems to me that this should be a core feature of pass.

Bash completion Ubuntu 20.04

After installing from the apt repository on Ubuntu 20.04, completion for bash was not working.

pass update 2.1
pass v1.7.3
GNU bash, version 5.0.17(1)-release

If I:

source /usr/share/bash-completion/completions/pass-update sourced manually the file (or in .bashrc),
or moved that to: sudo mv /usr/share/bash-completion/completions/pass-update /etc/bash_completion.d/
then it was working.

In my understanding, completion scripts are loaded by /usr/share/bash-completion/bash_completion only if the completion script has the same name as the invoked command, which is pass in our case. The completion script for pass (/usr/share/bash-completion/completions/pass) will not source the pass-update script. If the completion function (__password_store_extension_complete_update) isn't defined yet it won't be called.
However completion scripts in /etc/bash_completion.d/ are sourced by /usr/share/bash-completion/bash_completion automatically.

So it seems on Ubuntu 20.04 /etc/bash_completion.d/ is the good place for this script:
8721eb0#diff-76ed074a9305c04054cdebb9e9aad2d818052b07091de1f20cad0bbac34ffb52

xcrun: error on OS X during install

I following the installation instructions:

git clone https://github.com/roddhjav/pass-update/
cd pass-update
sudo make install PREFIX=/usr/local

but I get the following error:

xcrun: error: invalid active developer path (/Library/Developer/CommandLineTools), missing xcrun at: /Library/Developer/CommandLineTools/usr/bin/xcrun

Not sure what is causing this. Thanks for any help.

Add ability to skip certain password modification?

For my use case it would be nice to have a possibility to decide whether to edit a password or skip it and continue with others. However, current behaviour is that if you answer 'No' to the question Are you ready to provide/generate a new password? [y/N], the script exits with status 1.

Update the Queryed passwords

I don't know if this functionality it's implemented but it will be great if you can grep for old-current passwords (not pass-names) and update it ,all with the same new pass or differents passwords.
I know we have pass grep but you would have to script it.

Password update with wildcard for certain username

Hello,

i have my domain password used to access various web interfaces.
The domain account has always the same password and it changes every 90 days.
My pass uses the structure as /web/www.example.com/username, and I would like to perform a "bulk update" of a certain username. I'm using git so I can't just update the first and copy the .gpg file overwriting the others, I'm expecting this to be possible:

pass update /web/*/username

Can this be implemented?

mapfile: command not found

when I try to update several passwords with:
~ pass update -m test
says:
/usr/local/lib/password-store/extensions/update.bash: line 115: mapfile: command not found
find: -printf: unknown primary or operator

My computer is a MacOS, can anyone help?

apt-key deprecated

On your README file, about Debian/*Buntu (like), you wroted about:
wget URL | sudo apt-key…" instruction

Since Debian 11, using apt-key is deprecated; on Ubuntu, it's more oldier… since 2020.
Officially, this tool will be deleted on Debian 12, and Ubuntu 22.04.
(see man 8 apt-key)

Please, wrote more:
For Debian 11:

curl -fsSL https://pkg.pujol.io/debian/gpgkey | gpg --dearmor | sudo tee "/etc/apt/trusted.gpg.d/roddhjav.gpg" > /dev/null

More simple with wget:

wget -qO- https://pkg.pujol.io/debian/gpgkey | sudo tee /etc/apt/trusted.gpg.d/roddhjav.gpg

(or roddhjav.asc if the key is armored)

On Debian > 11, and Ubuntu ≥ 22.04 Jammy, /etc/apt/keyrings is provided as the recommended location for keys not managed by packages.
This will be:

wget -qO- https://pkg.pujol.io/debian/gpgkey | sudo tee /etc/apt/keyrings/roddhjav.gpg

Egual, share a file sources, as roddhjav.sources, segun the deb822-style format:

Types: deb
URIs: https://pkg.pujol.io/debian/repo
Suites: all
Architectures: amd64
Components: main
Signed-By: /etc/apt/trusted.gpg.d/roddhjav.gpg

(or /etc/apt/keyrings/roddhjav.gpg for Ubuntu ≥ 22.04, Debian > 11)

And share-it too. ;)

wget -qO- https://pkg.pujol.io/debian/roaddhjav.sources | sudo tee /etc/apt/sources.list.d/roddhjav.sources

To finish: sudo apt update && sudo apt install pass-extension-update