Todo

• convert secman cli from typescript to go
• move it to production
• update all commands interfaces
• integrate secman core with secman cli.
• use @charmbracelet libraries
• secman auth command
• secman auth logout command
• secman auth refresh command
• secman delete command
• secman docs command
• secman generate command
• secman info command
• secman insert command
• secman edit command
• build secman lister TUI interface
• add secman lister sidebar viewport
• secman list command
• secman read command, and build it with bubble-table
• secman whoami command
• upgrade secman web extension to v1.1.0
• fix secman desktop issues
• secman doctor command.
• #68
• @david-tomson create SMUI repo for secman ui command
• build secman ui command
• update Secman Core to v0.4.0 and add new features
• finish from secman core cli (sc)
• publish secman cli version v6.2.0
• integrate secman with tran (in the next version 📦)
• create new flags to secman auth login command (in the next version 📦)
• add --user flag to secman whoami command (in the next version 📦)
• add --tree-view flag to secman list command (in the next version 📦)
• create secman encrypt command (in the next version 📦)
• secman-archive/desktop#51
• create w.secman.dev and u.secman.dev urls to install secman cli
• scmn-dev/install#11

MacOS 12.1

Can't create new account

❯ secman init
✖ 💿 ~/.secman already exists
❯ rm -rf .secman
❯ secman init
✔ 💿 Initialization complete
run secman auth to authenticate
❯ secman auth
✔ Enter your email: … [email protected]
✔ Enter your master password: … ***********

Invalid email or master password. if you don't have an account, please create one using the command secman auth --create-account.
❯ secman auth --create-account
› Error: Unexpected argument: --create-account
› See more help with --help

I want you to create secam homebrew tap

Describe the bug
secman cannot be installed with HomeBrew using the command in https://secman.dev/download

brew tap scmn-dev/secman && brew install secman

To Reproduce
Simply to install in macOS using command in official docs:

brew tap scmn-dev/secman && brew install secman

Expected behavior
The command in your official installation instructions for HomeBrew should install secman in macOS. It seems to me that you ned to implement correctly secman.rb formula in scmn-dev/homebrew-tap repo and update the installation instructions to simply use:

brew install scmn-dev/tap/secman

Desktop (please complete the following information):

• OS: macOS Big Sur v11.6
• HomeBrew: v3.4.1

Additional context
Following official installation instructions for HomeBrew, this is the command to install it:

brew tap scmn-dev/secman && brew install secman

but the first command brew tap scmn-dev/secman fails with error:

❯ brew tap scmn-dev/secman && brew install secman
Running `brew update --preinstall`...
==> Tapping scmn-dev/secman
Cloning into '/usr/local/Homebrew/Library/Taps/scmn-dev/homebrew-secman'...
remote: Enumerating objects: 193, done.
remote: Counting objects: 100% (193/193), done.
remote: Compressing objects: 100% (136/136), done.
remote: Total 193 (delta 44), reused 164 (delta 36), pack-reused 0
Receiving objects: 100% (193/193), 23.33 KiB | 1.06 MiB/s, done.
Resolving deltas: 100% (44/44), done.
Error: Invalid formula: /usr/local/Homebrew/Library/Taps/scmn-dev/homebrew-secman/secman.rb
No available formula with the name "secman".
In formula file: /usr/local/Homebrew/Library/Taps/scmn-dev/homebrew-secman/secman.rb
Expected to find class Secman, but found no classes.
Error: Cannot tap scmn-dev/secman: invalid syntax in tap!

since it's looking for a repo scmn-dev/homebrew-secman that's not in your repos. There is this other repo scmn-dev/homebrew-tap with a secman.rb formula that could be installed with:

brew install scmn-dev/tap/secman

as this repo's README states, but it also fails with error:

❯ brew install scmn-dev/tap/secman
==> Tapping scmn-dev/tap
Cloning into '/usr/local/Homebrew/Library/Taps/scmn-dev/homebrew-tap'...
remote: Enumerating objects: 193, done.
remote: Counting objects: 100% (193/193), done.
remote: Compressing objects: 100% (136/136), done.
remote: Total 193 (delta 44), reused 164 (delta 36), pack-reused 0
Receiving objects: 100% (193/193), 23.33 KiB | 426.00 KiB/s, done.
Resolving deltas: 100% (44/44), done.
Error: Invalid formula: /usr/local/Homebrew/Library/Taps/scmn-dev/homebrew-tap/secman.rb
No available formula with the name "secman".
In formula file: /usr/local/Homebrew/Library/Taps/scmn-dev/homebrew-tap/secman.rb
Expected to find class Secman, but found no classes.
Error: Cannot tap scmn-dev/tap: invalid syntax in tap!

since the secman.rb file is empty.

to make building is automatic

Ok, now secman cli doesn't use api.secman.dev

and secman cli should login to secman api not github

to be honest, I don't like this cli, we have to make secman cli use our api and database

so, I created a small website to see the next secman

secman-v2.secman.dev

Secman V2

List Passwords

Authorize

$ secman auth

E-Mail: [email protected]
MasterPassword: **********

Insert

$ secman insert -t/--type login

Type: Login
Title: Expo
URL: expo.dev
Username: SecmanX
Password: ********
Extra:

Read

$ secman read Expo

Title: Expo
URL: expo.dev
Username: SecmanX
Password: ********
Extra:

# show password

$ secman read Expo --show-password

Title: Expo
URL: expo.io
Username: SecmanX
Password: secman_expo_31137
Extra:

Edit

$ secman edit Expo

What Do You Want To Change ?

1. Title
> 2. URL
3. Username
4. Password
5. Extra

Enter The New URL: expo.dev

# choose

$ secman edit Expo -e/--extra

Enter The New Extra: expo is a powerfull tool

Generate

$ secman generate
thlnchhmzdwzura

# with options

$ secman generate -l 10 -n -s -c
~-zEQpYXaK

# -l: Length of the generated password
# -n: Include numbers
# -s: Include symbols
# -c: Include capital-letters

# full

$ secman generate --length 16 --numbers --symbols --capital-letters
+Bu-L^uv-/*gQmN

Commands

• auth
• insert | new
• read | show
• edit
• generate | gen
• delete | remove | rm
• upgrade | upg
• uninstall | un
• version

Maybe Added

• change-master-password | cms
• find | search

I know this maybe hard, but if we did it, we will be better

Tasks:

• build beautiful help design
• create auth command
• add read command
• build generate command
• add insert cmd
• build the lister
• create edit command
• create & build secman cli API
• build secman configure.
• make the spinner.
• settings cmd.
• finish from the email sender.
• remove cmd.
• #102
• create init command.
• design email.
• #110
• update secman.dev docs
• build crypto command.
• whoami cmd.
• build v1 dir.
• logout cmd.
• info command.
• init cmd.
• update command.
• docs command.
• #106

when I insert or edit or remove a password, it's shows this message

bash: ~/sm/sync.sh: Permission denied

and in install.sh we've chmod command

...
sudo chmod 755 ~/sm
...

I think the command should be like this

sudo chmod 755 ~/sm/sync.sh

I think it's better to move secman path from %APPDATALOCAL% to C:\Program Files

Why I want to build .devcontainer fot secman

this is the answer

Storing cryptographic hashes of passwords is standard security practice, but it is equally important to select the right hashing scheme. If an attacker obtains the hashed passwords of an application, the password hashing scheme should still prevent the attacker from easily obtaining the original cleartext passwords.

so we have to use bcrypt algorithm as hasher

const crypto = require("crypto");
function hashPassword(password) {
    var hasher = crypto.createHash('md5');
    var hashed = hasher.update(password).digest("hex"); // BAD
    return hashed;
}

to

const bcrypt = require("bcrypt");
function hashPassword(password, salt) {
  var hashed = bcrypt.hashSync(password, salt); // GOOD
  return hashed;
}

when install .deb file, it's always appears this message

with sudo apt install ./secman_v5.3.62_amd64.deb

Reading package lists... Done
Building dependency tree
Reading state information... Done
Note, selecting 'secman' instead of './secman_v5.3.62_amd64.deb'
The following packages will be upgraded:
  secman
1 upgraded, 0 newly installed, 0 to remove and 125 not upgraded.
Need to get 0 B/10.7 MB of archives.
After this operation, 24.1 MB of additional disk space will be used.
Get:1 ~/secman-workflow/secman_v5.3.62_amd64.deb secman amd64 5.3.62 [10.7 MB]
(Reading database ... 106010 files and directories currently installed.)
Preparing to unpack .../secman_v5.3.62_amd64.deb ...
Unpacking secman (5.3.62) over (5.2.1) ...
dpkg: error processing archive ~/secman-workflow/secman_v5.3.62_amd64.deb (--unpack):
 trying to overwrite directory '/usr/share/man/man1' in package login 1:4.8.1-1ubuntu5.20.04 with nondirectory
Errors were encountered while processing:
 ~/secman-workflow/secman_v5.3.62_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

with sudo dpkg -i ./secman_v5.3.62_amd64.deb

(Reading database ... 106010 files and directories currently installed.)
Preparing to unpack secman_v5.3.62_amd64.deb ...
Unpacking secman (5.3.62) over (5.2.1) ...
dpkg: error processing archive secman_v5.3.62_amd64.deb (--install):
 trying to overwrite directory '/usr/share/man/man1' in package login 1:4.8.1-1ubuntu5.20.04 with nondirectory
Processing triggers for man-db (2.9.1-1) ...
Errors were encountered while processing:
 secman_v5.3.62_amd64.deb

the common error is trying to overwrite directory '/usr/share/man/man1' in package login 1:4.8.1-1ubuntu5.20.04 with nondirectory

I don't know what is this

login command is like this

secman login

# now it's ask
# do you want to login by gh cli or git
❯ gh cli
❯ git

let's do this bro, it's a great addition for secman

I think we should add secman snap package.
to add more installation options.

secman sync start is very nice at macOS/linux

open        Open Your Private Repo (non-200 OK status code: 401 Unauthorized body: "{\"message\":\"This endpoint requires you to be authenticated.\",\"documentation_url\":\"https://docs.github.com/graphql/guides/forming-calls-with-graphql#authenticating-with-graphql\"}"/.secman).

it's should be

open        Open Your Private Repo (:username/.secman).

I think we should create our own API website.

for secman-desktop & secman signup website

what do you think @iMRxM7mD @Timothee-Cardoso @david-tomson

• improve secman blog.

• publish the new release v5.3.8.

• update gh-api.

• build v1.0.3 version of secman desktop.

• update changelog.

• add two docs pages at docker.secman.dev .

• build & publish secman desktop.

• publish auth.secman.dev

• add new docs.

• create support page.

• finish from dsk.secman.dev website.

• upgrade secman website.

• build extension page

• add SME firefox extension

secman

You're not authenticated, to authenticate run secman auth login

it should only appear in sync and repo commands

add upgrade spinner loader

I like upgrade in linux, can we configure it for windows

when I run secman init in windows

node:internal/process/promises:227
          triggerUncaughtException(err, true /* fromPromise */);
          ^

[Error: ENOENT: no such file or directory, open 'C:\undefined\.secman\settings.json'] {
  errno: -4058,
  code: 'ENOENT',
  syscall: 'open',
  path: 'C:\\undefined\\.secman\\settings.json'
}

we have to change /constants/index.ts in DOT_SECMAN_PATH

export const HOMEDIR: any =
  process.platform === "win32" ? "USERPROFILE" : "HOME";

export const DOT_SECMAN_PATH = `${HOMEDIR}/.secman`;

like this

We've to create a website app, and it's URL is app.secman.dev

and we'll create it after secman desktop

makefile of secman is not very powerfull

to use helm to install secman

also create https://helm.secman.dev

helm repo add secman https://helm..secman.dev
helm install secman/secman  --version $LATEST_VERSION

it's just an idea

when I finish from inserting a new password, update checker it's takes a long time, I think it a bug

@iMRxM7mD @Timothee-Cardoso, we must make secman self-reliant, that's means we don't need sm folder

so first

1. create ruby commander in shell package like powershell and bash.
2. all version checks it's on secman.

Tracking issue for:

• https://github.com/scmn-dev/secman/security/code-scanning/20

when I fetching my new password in windows, it's always asking my github username and my password

secman fetch

[================>   ] 🔗 Fetching... Username for 'https://github.com':
[========>           ] 🔗 Fetching... om':

so I think we have to change fetch method of windows

from

$lastDir = pwd
cd $HOME/.secman
git pull
cd $lastDir

to

Remove-Item $HOME/.secman -Recurse -Force
secman repo clone $username/.secman

secman works with github, so why we don't add gitlab support to secman, I think it's a good idea ?