SaltStack strips leading/trailing whitespaces from the password [1], because pass adds a newline when entering passwords interactively.
Pass is capable of storing multiline passwords which are stored as provided. That includes storing binary data as well. If such password has leading/traling whitespaces, they get stripped in SaltStack and the password becomes invalid. This change fixes the inconsistency by always storing the passwords as provided, with no extra characters added. To retain good user experience, a newline is printed to stderr after printing a password. [1] https://github.com/saltstack/salt/commit/2584df93e074155062bd934f23bb244613e20dd3 --- src/password-store.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/password-store.sh b/src/password-store.sh index 22e818f..48b3a79 100755 --- a/src/password-store.sh +++ b/src/password-store.sh @@ -385,7 +385,8 @@ cmd_show() { if [[ -f $passfile ]]; then if [[ $clip -eq 0 && $qrcode -eq 0 ]]; then pass="$($GPG -d "${GPG_OPTS[@]}" "$passfile" | $BASE64)" || exit $? - echo "$pass" | $BASE64 -d + echo -n "$pass" | $BASE64 -d + echo >&2 else [[ $selected_line =~ ^[0-9]+$ ]] || die "Clip location '$selected_line' is not a number." pass="$($GPG -d "${GPG_OPTS[@]}" "$passfile" | tail -n +${selected_line} | head -n 1)" || exit $? @@ -468,7 +469,7 @@ cmd_insert() { read -r -p "Retype password for $path: " -s password_again || exit 1 echo if [[ $password == "$password_again" ]]; then - echo "$password" | $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" || die "Password encryption aborted." + echo -n "$password" | $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" || die "Password encryption aborted." break else die "Error: the entered passwords do not match." @@ -477,7 +478,7 @@ cmd_insert() { else local password read -r -p "Enter password for $path: " -e password - echo "$password" | $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" || die "Password encryption aborted." + echo -n "$password" | $GPG -e "${GPG_RECIPIENT_ARGS[@]}" -o "$passfile" "${GPG_OPTS[@]}" || die "Password encryption aborted." fi git_add_file "$passfile" "Add given password for $path to store." } -- 2.35.1
