andy/vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

Add unlock --idle, and packaging/repo.sh for repo.dixon.cx

Browse Source 
vault unlock --idle counts the duration from the last command that used
the key rather than from the unlock: the agent resets its timer each
time it hands the key out. The agent loop no longer needs its own
goroutine.

packaging/repo.sh builds the dixon-vault .deb, .rpm and Arch packages
from a release tag (a clean git archive) with nfpm for amd64, arm64,
armv7, 386 and riscv64, then publishes them to the apt, dnf and pacman
repositories at repo.dixon.cx: apt-ftparchive with a signed InRelease,
createrepo_c (in a Fedora container) with signed RPMs and repomd.xml,
and repo-add (in an Arch container) with signed packages and database.
Indexes cover every package in the repository, under a lock, so other
projects publishing with their copy of the script are kept. The package
is dixon-vault because vault is HashiCorp Vault in Arch's [extra] and
HashiCorp's own repositories; it conflicts with vault.

README, guide and CLAUDE.md point at the repository.
This commit is contained in:
Andy Dixon
2026-10-03 09:44:49 +01:00
parent ec204f0ea2
commit 4c1507c463
8 changed files with 334 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/vault-unlock.1
+8 -2
View File
@@ -5,6 +5,7 @@ vault-unlock, vault-lock \- remember the unlocked key for a while, or forget it
.B vault unlock
.RB [ \-\-for
.IR DURATION ]
.RB [ \-\-idle ]
.RB [ \-\-key
.IR PATH ]
.br
@@ -17,8 +18,9 @@ asks for the passphrase, checks it, and starts a helper process, much like
.BR ssh\-agent (1),
that holds the unlocked key in memory until \fIDURATION\fR has passed
(default 5m). Until then every command using the same key file skips the
passphrase prompt. The deadline is fixed when you unlock; using the key does
not extend it. Running
passphrase prompt. By default the deadline is fixed when you unlock and
using the key does not extend it; with \fB\-\-idle\fR it is \fIDURATION\fR
after the last command that used the key. Running
.B unlock
again replaces the helper with a fresh one.
.PP
@@ -38,6 +40,10 @@ handing the machine to anyone.
.TP
.BI \-\-for " DURATION"
How long to remember the key, such as 90s, 5m or 2h. Default 5m.
.TP
.B \-\-idle
Count \fIDURATION\fR from the last time a command used the key, rather than
from the unlock, so the key stays while you keep working.
.PP
See also \fB\-\-key\fR in
.BR vault (1).