gopasspw--gopass
wehub-resource-sync
99 行
3.6 KiB
Markdown
99 行
3.6 KiB
Markdown
# Secrets
|
|
|
|
`gopass` supports different secret formats. This page documents the different formats.
|
|
You can read more about how secrets are shown and parsed in the documentation for the [`show` commands](commands/show.md#parsing-and-secrets).
|
|
|
|
## Key-Value
|
|
|
|
The new [Key-Value implementation](../pkg/gopass/secrets/akv.go) fully maintains the secret format
|
|
when parsing but still does offer (limited) support for Key-Value operations, i.e. retrieving keys,
|
|
listing keys and writing (the first instance) keys. Some multi-value operations are not directly
|
|
supported. Use `gopass edit` for these.
|
|
|
|
Note: The parser will ensure that every parsed secret contains a terminating newline. Even if the
|
|
input didn't have one.
|
|
|
|
Format:
|
|
|
|
```text
|
|
Line | Description
|
|
0 | Password
|
|
1-n | Body
|
|
```
|
|
|
|
The parser uses the `: ` separator to identify potential Key Value pairs.
|
|
When updating existing pairs only the first value will be rewritten.
|
|
New pairs are always appended at the end.
|
|
|
|
## YAML
|
|
|
|
Note: Using YAML is discouraged as YAML can be troublesome for humans, e.g. parsing of unquoted numbers.
|
|
|
|
The [YAML Format](../pkg/gopass/secrets/yaml.go) is used if there is a YAML marker (`---`) after the body:
|
|
|
|
```text
|
|
YAML is a gopass secret that contains a parsed YAML data structure.
|
|
This is a legacy data type that is discouraged for new users as YAML
|
|
is neither trivial nor intuitive for users manually editing secrets (e.g.
|
|
unquoted phone numbers being parsed as octal and such).
|
|
|
|
Format
|
|
------
|
|
Line | Description
|
|
0 | Password
|
|
1-n | Body
|
|
n+1 | Separator ("---")
|
|
n+2 | YAML content.
|
|
```
|
|
|
|
## Deprecated formats
|
|
|
|
`gopass` used to support different secret formats. These were deemed suboptimal and retired.
|
|
We still support parsing of these formats but don't write them anymore.
|
|
|
|
### MIME
|
|
|
|
`gopass` briefly had a custom secrets format based on multipart MIME. This did prove to be even more troublesome for humans than YAML so it was quickly deprecated.
|
|
|
|
These secrets are identified by a well known header.
|
|
|
|
```text
|
|
GOPASS-SECRET-1.0
|
|
Password: ...
|
|
[other headers]
|
|
|
|
[Body]
|
|
```
|
|
|
|
### Plain
|
|
|
|
The old KV implementation had some limitations so we did sometimes fall back to the old Plain format. With the new KV implementation this is not necessary anymore so this was removed.
|
|
|
|
## Parser Priority Order
|
|
|
|
When gopass reads a secret from disk it tries each parser in a fixed order and uses the first one that succeeds:
|
|
|
|
1. **Legacy MIME** — Identified by a `GOPASS-SECRET-1.0` header. If a permanent parse error occurs the secret is returned as AKV and the error is propagated.
|
|
2. **YAML** — Identified by a `---` YAML separator somewhere in the body. Falls through to AKV if parsing fails.
|
|
3. **AKV (Key-Value)** — The default parser. Always succeeds.
|
|
|
|
This order means that a secret that accidentally resembles a YAML document (e.g. contains `---`) will be parsed as YAML rather than AKV, which can lead to surprising behaviour. To avoid this, use `gopass show --noparsing` to see the raw content.
|
|
|
|
## References
|
|
|
|
Secrets can reference other secrets in the store using a `gopass://` URI:
|
|
|
|
```text
|
|
gopass://path/to/other/secret
|
|
```
|
|
|
|
When `core.follow-references` is set to `true` (default: `false`) and a secret's password field contains a `gopass://` URI, gopass will transparently retrieve the referenced secret instead of returning the URI itself. This allows a single canonical secret to be referenced from multiple locations without duplicating the value.
|
|
|
|
To enable this feature:
|
|
|
|
```shell
|
|
gopass config core.follow-references true
|
|
```
|
|
|
|
References are resolved at read time. Circular references are not supported and will cause an error.
|