github.com/oleiade/trousseau

Critical fixes:

• Fix broken decryption: io.Reader read into zero-length buffer (GPG, AES, SSH, Gist)
• Fix AES-256 key derivation: re-derive key from stored salt during decryption
• Fix AddRecipientAction: append was inside loop, adding recipient N times
• Fix RemoveRecipientAction: filter kept the wrong variable, inverting logic
• Fix GetPassphrase: returned empty local variable instead of config value
• Fix DelAction: vault.Lock return value was silently discarded

Security:

• Add HostKeyCallback to SSH client to prevent MITM attacks
• Sanitize remote path in SSH Pull to prevent command injection
• Set store file permissions to 0600 (owner-only) instead of 0700/0755
• Set config file permissions to 0600

Other:

• Align environment variable names with README documentation
• Skip config/store setup when displaying --help
• Pass config file path through to config.Load (TOML config was ignored)
• Simplify prependSalt implementation
• Fix typo in before.go error message

Changelog

47950fb Add circleci configuration
6d0cce5 Add configuration for releases deployment on tags
0baad74 Add goreleaser files to gitignore
6b55bb5 Cleanup unit tests
6f35d5a Declare go module
3d57d96 Drop Debian
b9301e0 Drop GOXC
f4cc2ab Drop Godeps and vendor
747c72d Drop Makefile
57a0c0e Drop Travis
7e1ef07 Drop docs
127da6a Drop integration tests
1f4724e Ensure CircleCI release job works, and uploads Homebrew formula
20b0c71 Fix goxc release process, and exclude build/ from git
c47d3ca Hotfix: homebrew recipe for version 4.0.0
932f177 Hotfix: logo image link in README
06691b3 Merge branch 'feature/circleci' into develop
a393454 Merge branch 'feature/cleanup' into develop
e0d3c7a Merge branch 'feature/goreleaser' into develop
7ff8299 Merge branch 'feature/modules' into develop
15d0c70 Merge branch 'feature/use_standard_project_layout' into develop
a63bac2 Merge branch 'release/v0.4.1'
9db58b8 Move data store related code in internal/store
779c5fb Move gpg agent related code in pkg/gpgagent
f45722e Move private code into internal/trousseau
486b685 Move reusable packages in pkg/
2e03245 Setup goreleaser
bd97b7b Tidy
dbec1a6 Update gitignore