GFSEC-USE(1)

📦
version 0.5.1 · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 GFSEC-USE(1) — the gfsecret manual, but make it a group chat 💖

okay bestie, sit down, hydrate, because we're about to talk about gfsec-use — the little icon that goes and fetches your secret back 🫶

✨ NAME ✨

gfsec-use — make use of a shared secret 🎀

🌸 SYNOPSIS 🌸

gfsec-use [-h|--help] [-v|--version] [-c|--config file] [-k|--keep]
          [-o|--output file] [-r|--restore-cmd command] [-d|--destroy-
          cmd command] [command...]

🦋 DESCRIPTION 🦋

so, gfsec-use reconstructs a secret file that somebody already split up before, using a tool like gfsplit(1) or its bestie sibling gfsec-split(1). like, the secret got chopped into shares and yeeted across your disks/USB sticks/whatever, and now we're putting humpty dumpty back together 💅

then? a user-specified command (or just a plain shell, no pressure) gets spawned once the secret has been reconstructed. and the moment that command terminates, the secret file gets deleted. gone. poof. 🙈

it's giving "here for a good time, not a long time" and honestly? iconic.

👑 OPTIONS 👑

  • -h, --help — show the help message. the "what do I do" button 💖
  • -v, --version — show the version message. the "who even am I" button ✨
  • -c, --config file — point at a specific config file. but listen: if that file doesn't exist, a .conf extension gets appended to the filename, and then a matching file gets searched for in $XDG_CONFIG_HOME/gfsecret. and if you don't use this option at all? it just assumes a default config of $XDG_CONFIG_HOME/gfsecret/default.conf 🎀
  • -k, --keep — do NOT delete the reconstructed file when the command you specified terminates. basically the "no, I want to keep it actually" flag 🫶
  • -o, --output file — write the reconstructed secret into the file you name. this overrides the OUTFILE parameter from the config file. your call wins, periodt 💅
  • -r, --restore-cmd command — run the command you give instead of writing the reconstructed secret to a file. the secret gets sent straight to that command's standard input. sneaky, efficient, love that 🌈
  • -d, --destroy-cmd command — run the command you give instead of deleting the reconstructed secret file when things terminate. you want a custom goodbye ritual? valid 💀

🌈 CONFIGURATION FILE 🌈

a config file describes one secret file to reconstruct. just one. monogamy 🎀

blank lines are ignored. lines that start with a # character are also ignored (that's your comment corner, bestie).

here are the directives you can use:

  • OUTFILE=file — say which file the reconstructed secret should be written into 📝
  • RESTORE=command — say which command to run once the secret has been reconstructed ✨
  • DESTROY=command — say which command to run to destroy the secret when things terminate 💀
  • MINSHARES=n — the minimal number of shares needed to reconstruct the secret. if you don't specify it, the default is 2 👯
  • URI=uri — an URI telling us where to find a share 🔎

and here are the supported URI schemes, one by one:

  • file:/// — a file on the local filesystem. your basic girlie 🏠
  • uuid://uuid/ — a file on the external volume identified by the specified UUID 🦋
  • label://label/ — a file on the external volume identified by the specified label 🏷️
  • mtp://serial/ — a file on the MTP device identified by the specified serial number 📱
  • http://host/ — a file on a web server identified by its hostname 🌐
  • https://host/ — same as the previous one, but the web server is accessed through a secure connection 🔒

okay and whatever scheme you pick, the file part of the URI must end with an extension indicating the share number, exactly as generated by gfsplit(1). no extension, no share, no reconstruction. rules are rules 😤

the URI may also include a share=no parameter — that means the corresponding file contains the whole secret and not only a share. and in that case? the whole "previous remark about the share number in the extension" thing does not apply. exempt. free. 🕊️

another parameter is sha256, which specifies the expected SHA-256 hash value of the share data. if you specify that parameter, a share will only be used if the data actually matches the expected hash value. vibe check passed or the share doesn't get in 🙅‍♀️

also, gfsec-split(1) — the program used to split a file into shares — will automatically generate a suitable configuration file that lets you reconstruct the original file. it does the homework for you, obsessed 🥰

🎀 EXAMPLE CONFIGURATION FILE 🎀

OUTFILE=/home/alice/mysecret
MINSHARES=2
URI=file:///home/alice/.local/share/gfsecret/mysecret.024
URI=label://USBSTICK/mysecret.070?sha256=hex_hash
URI=mtp://RF2GB6X704P/Documents/mysecret.139

look at her go. three URIs, three different vibes, one secret 👑

😭 REPORTING BUGS 😭

found a bug? report bugs to Damien Goutte-Gattat. be nice, be specific, include the deets 💖

🫶 SEE ALSO 🫶

gfsec-split(1), gfsplit(1), gfcombine(1), libgfshare(3), gfshare(7)

go read the whole friend group, they all hang out together 🌸

Copyright © 2017,2021 Damien Goutte-Gattat

This program is released under the GNU General Public License. See the COPYING file in the source distribution or http://www.gnu.org/licenses/gpl.html. 📜

this was gfsecret 0.5.1, dated 2021-07-17 — mwah, bye bestie, go reconstruct something 💅💖
📦 where this page comes from