Andy Dixon
ec204f0ea2
Filesystem basics: mv now moves folders as well as files, and like mv(1) a NEW ending in / or naming an existing folder means into it. cp copies a file, or a folder with -r, by writing new records that share the original's objects, so it is instant and takes no space; rm already keeps objects another record still uses. New records go first, so an interrupted move leaves both names, never neither. get -r extracts a folder, keeping its structure. vault unlock [--for 5m] checks the passphrase and starts the binary again as a hidden __agent process, handing it the suite ID and seed over a pipe. The agent keeps them in mlocked memory, with core dumps off and (on Linux) PR_SET_DUMPABLE cleared, serves them on a Unix socket in a 0700 per-user directory whose owner is checked on every use, and wipes them and exits at a hard deadline or on vault lock. Commands ask it first unless VAULT_PASSPHRASE is set, and genkey stops any agent left for that path. Guide, man pages (new vault-cp, vault-unlock, vault-lock), README and screenshots updated; the guide's error table is split so it fits.
43 lines
1.1 KiB
Groff
43 lines
1.1 KiB
Groff
.TH VAULT-GET 1 "September 2026" "vault" "User Commands"
|
|
.SH NAME
|
|
vault-get \- decrypt a stored file
|
|
.SH SYNOPSIS
|
|
.B vault get
|
|
.RB [ \-r ]
|
|
.RB [ \-o
|
|
.IR OUTPUT ]
|
|
.RB [ \-\-key
|
|
.IR PATH ]
|
|
.RB [ \-\-vault
|
|
.IR DIR ]
|
|
.I NAME
|
|
.SH DESCRIPTION
|
|
Decrypts \fINAME\fR. Nothing appears at the output path until every object has
|
|
authenticated. The stored mode and modification time are restored. It refuses
|
|
to overwrite an existing file. Takes a shared lock.
|
|
.PP
|
|
With \fB\-r\fR, \fINAME\fR is a folder, and every file under it is
|
|
decrypted into the output directory, keeping the folder structure. Each file
|
|
is checked as above; a clash stops the run, leaving the files already
|
|
written.
|
|
.SH OPTIONS
|
|
.TP
|
|
.BI \-o " OUTPUT"
|
|
Output path, or with \fB\-r\fR output directory. Default: the base name of
|
|
\fINAME\fR in the current directory.
|
|
.TP
|
|
.B \-r
|
|
Decrypt a folder and everything under it.
|
|
.PP
|
|
See also \fB\-\-key\fR and \fB\-\-vault\fR in
|
|
.BR vault (1).
|
|
.SH ENVIRONMENT
|
|
.TP
|
|
.B VAULT_PASSPHRASE
|
|
Passphrase, instead of prompting on the terminal.
|
|
.SH SEE ALSO
|
|
.BR vault (1),
|
|
.BR vault\-list (1)
|
|
.SH AUTHOR
|
|
Andy Dixon <vault@dixon.cx>, https://www.dixon.cx
|