pass.cpp

Go to the documentation of this file.

// SPDX-FileCopyrightText: 2016 Anne Jan Brouwer
// SPDX-License-Identifier: GPL-3.0-or-later
#include "pass.h"
 
#include "gpgidgeneration.h"
#include "gpgidsigner.h"
#include "gpgkeystate.h"
#include "pathvalidator.h"
#include "processinfo.h"
#include "util.h"
#include <QCoreApplication>
#include <QDebug>
#include <QDir>
#include <QFile>
#include <QFileInfo>
#include <QHash>
#include <QLocale>
#include <QProcess>
#include <QRandomGenerator>
#include <QRegularExpression>
#include <QTextStream>
#include <array>
#include <optional>
#include <utility>
 
#include "qtpasslogging.h"
 
using Enums::GIT_INIT;
using Enums::GIT_PULL;
using Enums::GIT_PUSH;
using Enums::GPG_GENKEYS;
using Enums::PASS_COPY;
using Enums::PASS_INIT;
using Enums::PASS_INSERT;
using Enums::PASS_MOVE;
using Enums::PASS_REMOVE;
using Enums::PASS_SHOW;
 
namespace {
auto fallbackCharset(const QString &input, const QString &fallback) -> QString {
  return input.isEmpty() ? fallback : input;
}
 
auto effectiveCharset(const PasswordConfiguration &passConfig) -> QString {
  int sel = passConfig.selected;
  if (sel < 0 || sel >= PasswordConfiguration::CHARSETS_COUNT)
    sel = PasswordConfiguration::ALLCHARS;
  return fallbackCharset(
      passConfig.Characters[sel],
      passConfig.Characters[PasswordConfiguration::ALLCHARS]);
}
} // namespace
 
Pass::Pass() : env(QProcessEnvironment::systemEnvironment()) {
  connect(&exec, &Executor::finished, this, &Pass::finished);
  connect(&exec, &Executor::error, this, &Pass::finished);
 
  connect(&exec, &Executor::starting, this, &Pass::startingExecuteWrapper);
  connect(&exec, &Executor::drained, this, [this] {
    // Idle means the queue is empty and nothing runs, so no insert is in
    // flight: force the pending count to zero. A report that never arrived
    // (the "No such transaction" path in ImitatePass::finished(), or any
    // later change that drops an insert without reporting) would otherwise
    // leave the count one too high for the rest of the session, and every
    // later dialog would take its own report for an earlier one and wait for
    // ever. Idle cannot fall between a dialog's insertsPending() read and its
    // own report, since that insert keeps the executor busy.
    m_insertsPending = 0;
    emit idle();
  });
  // Each queued process starts in the environment as the store is then:
  // the Git pin is judged at that moment (dequeuing() comes just before the
  // start, on this thread).
  connect(&exec, &Executor::dequeuing, this, [this](int, bool completes) {
    if (completes) {
      exec.setEnvironment(withCurrentGitPin(env));
    }
  });
  // Merge our vars into WSLENV rather than blindly appending a duplicate
  // entry. WSLENV flags: /p translates the path, /u forwards from Windows
  // into WSL only; /w would be the other direction, from WSL out, and leaves
  // pass inside WSL without the value. Everything updateEnv() sets for pass
  // has to cross, the signing key above all: without it pass does not check
  // the .gpg-id signature.
  const QStringList wslenvVars = {
      QStringLiteral("PASSWORD_STORE_DIR/p"),
      QStringLiteral("PASSWORD_STORE_SIGNING_KEY/u"),
      QStringLiteral("PASSWORD_STORE_GENERATED_LENGTH/u"),
      QStringLiteral("PASSWORD_STORE_CHARACTER_SET/u"),
      QStringLiteral("PASSWORD_STORE_GPG_OPTS/u"),
      QStringLiteral("GIT_CEILING_DIRECTORIES/p"),
      QStringLiteral("GIT_LITERAL_PATHSPECS/u")};
  const QString existing = env.value(QStringLiteral("WSLENV"));
  if (existing.isEmpty()) {
    env.insert(QStringLiteral("WSLENV"), wslenvVars.join(':'));
  } else {
    QStringList parts = existing.split(':', Qt::SkipEmptyParts);
    for (const QString &v : wslenvVars) {
      if (!parts.contains(v))
        parts.append(v);
    }
    env.insert(QStringLiteral("WSLENV"), parts.join(':'));
  }
}
 
void Pass::executeWrapper(PROCESS id, const QString &app,
                          const QStringList &args, bool readStdout,
                          bool readStderr) {
  executeWrapper(id, app, args, QString(), readStdout, readStderr);
}
 
void Pass::executeWrapper(PROCESS id, const QString &app,
                          const QStringList &args, QString input,
                          bool readStdout, bool readStderr) {
  beforeExecute(id);
  qCDebug(lcQtPass) << app << loggableArgs(args);
  exec.execute(id, m_settings.passStore, app, args, std::move(input),
               readStdout, readStderr);
}
 
auto Pass::loggableArgs(const QStringList &args) -> QStringList {
  // Secrets travel on stdin (Insert's content, KeygenDialog's batch file),
  // never in argv; this keeps the log honest should that ever change.
  static const QStringList secretOptions{
      QStringLiteral("--passphrase"), QStringLiteral("--override-session-key")};
  QStringList out;
  bool hide = false;
  for (const QString &arg : args) {
    if (hide) {
      out << QStringLiteral("<redacted>");
      hide = false;
      continue;
    }
    if (arg.startsWith(QStringLiteral("otpauth://"))) {
      out << QStringLiteral("<redacted>");
      continue;
    }
    if (arg.startsWith(QStringLiteral("--passphrase=")) ||
        arg.startsWith(QStringLiteral("--override-session-key="))) {
      out << arg.left(arg.indexOf(u'=') + 1) + QStringLiteral("<redacted>");
      continue;
    }
    hide = secretOptions.contains(arg);
    out << arg;
  }
  return out;
}
 
void Pass::beforeExecute(PROCESS /*id*/) {}
 
void Pass::init(const AppSettings &settings) {
  m_settings = settings;
#ifdef __APPLE__
  // If it exists, prepend gpgtools to PATH
  if (QFile(QStringLiteral("/usr/local/MacGPG2/bin")).exists())
    env.insert(QStringLiteral("PATH"),
               QStringLiteral("/usr/local/MacGPG2/bin:") +
                   env.value(QStringLiteral("PATH")));
  // Add missing /usr/local/bin (exact component match, no leading colon)
  const QString currentPath = env.value(QStringLiteral("PATH"));
  if (!currentPath.split(':', Qt::SkipEmptyParts)
           .contains(QStringLiteral("/usr/local/bin"))) {
    env.insert(QStringLiteral("PATH"),
               currentPath.isEmpty()
                   ? QStringLiteral("/usr/local/bin")
                   : QStringLiteral("/usr/local/bin:") + currentPath);
  }
#endif
 
  // The configured gpgHome wins over GNUPGHOME only when it exists: a stale
  // one (#1711) fails every gpg call with "No secret key". Clearing the
  // setting restores the inherited value rather than keeping the old path.
  const QString inheritedHome = QProcessEnvironment::systemEnvironment().value(
      QStringLiteral("GNUPGHOME"));
  const auto useInheritedHome = [this, &inheritedHome]() {
    if (inheritedHome.isEmpty()) {
      env.remove(QStringLiteral("GNUPGHOME"));
    } else {
      env.insert(QStringLiteral("GNUPGHOME"), inheritedHome);
    }
  };
  if (m_settings.gpgHome.isEmpty()) {
    useInheritedHome();
  } else {
    QDir absHome(m_settings.gpgHome);
    absHome.makeAbsolute();
    if (absHome.exists()) {
      env.insert(QStringLiteral("GNUPGHOME"), absHome.path());
    } else {
      if (inheritedHome.isEmpty()) {
        qCWarning(lcQtPass) << "gpgHome" << absHome.path()
                            << "does not exist; using the default GnuPG home";
        emit statusMsg(tr("Configured GPG home %1 does not exist, using the "
                          "default keyring")
                           .arg(absHome.path()),
                       5000);
      } else {
        qCWarning(lcQtPass)
            << "gpgHome" << absHome.path() << "does not exist; using GNUPGHOME"
            << inheritedHome << "from the environment";
        emit statusMsg(tr("Configured GPG home %1 does not exist, using "
                          "GNUPGHOME %2 from the environment")
                           .arg(absHome.path(), inheritedHome),
                       5000);
      }
      useInheritedHome();
    }
  }
}
 
auto Pass::generatePassword(unsigned int length, const QString &charset)
    -> QString {
  if (length == 0) {
    emit critical(tr("Invalid password length"),
                  tr("Can't generate password with zero length."));
    return {};
  }
  QString passwd;
  if (m_settings.usePwgen) {
    // --secure goes first as it overrides --no-* otherwise
    QStringList args;
    args.append("-1");
    if (!m_settings.lessRandom) {
      args.append("--secure");
    }
    args.append(m_settings.avoidCapitals ? "--no-capitalize" : "--capitalize");
    args.append(m_settings.avoidNumbers ? "--no-numerals" : "--numerals");
    if (m_settings.useSymbols) {
      args.append("--symbols");
    }
    args.append(QString::number(length));
    if (Executor::executeBlocking(m_settings.pwgenExecutable, args, &passwd) ==
        0) {
      static const QRegularExpression literalNewLines{"[\\n\\r]"};
      passwd.remove(literalNewLines);
    } else {
      passwd.clear();
      qCDebug(lcQtPass) << "pwgen fail";
      // Report it, as the other generation failures do: otherwise Generate
      // does nothing silently and OK then saves an empty (or, on Edit, the
      // old) password.
      emit critical(
          tr("Password generation failed"),
          tr("Could not run pwgen (\"%1\"). Check the pwgen program in the "
             "settings, or turn \"Use pwgen\" off.")
              .arg(m_settings.pwgenExecutable));
    }
  } else {
    // An empty CUSTOM charset falls back to ALLCHARS, not a weak password
    // (#780).
    const QString cs = fallbackCharset(
        charset, m_settings.passwordConfiguration
                     .Characters[PasswordConfiguration::ALLCHARS]);
    if (cs.length() > 0) {
      passwd = generateRandomPassword(cs, length);
    } else {
      emit critical(
          tr("No characters chosen"),
          tr("Can't generate password, there are no characters to choose from "
             "set in the configuration!"));
    }
  }
  return passwd;
}
 
bool Pass::gpgSupportsEd25519(const QString &gpgExecutable) {
  const QString exe =
      gpgExecutable.isEmpty() ? QStringLiteral("gpg") : gpgExecutable;
  QString out, err;
  if (Executor::executeBlocking(exe, {"--version"}, &out, &err) != 0) {
    return false;
  }
  QRegularExpression versionRegex(R"(gpg \‍(GnuPG\) (\d+)\.(\d+))");
  QRegularExpressionMatch match = versionRegex.match(out);
  if (!match.hasMatch()) {
    return false;
  }
  int major = match.captured(1).toInt();
  int minor = match.captured(2).toInt();
  return major > 2 || (major == 2 && minor >= 1);
}
 
// ed25519 (GnuPG 2.1+) generates much faster than RSA.
QString Pass::getDefaultKeyTemplate(const QString &gpgExecutable) {
  if (gpgSupportsEd25519(gpgExecutable)) {
    return QStringLiteral("%echo Generating a default key\n"
                          "Key-Type: EdDSA\n"
                          "Key-Curve: Ed25519\n"
                          "Subkey-Type: ECDH\n"
                          "Subkey-Curve: Curve25519\n"
                          "Name-Real: \n"
                          "Name-Comment: QtPass\n"
                          "Name-Email: \n"
                          "Expire-Date: 0\n"
                          "%no-protection\n"
                          "%commit\n"
                          "%echo done");
  }
  return QStringLiteral("%echo Generating a default key\n"
                        "Key-Type: RSA\n"
                        "Subkey-Type: RSA\n"
                        "Name-Real: \n"
                        "Name-Comment: QtPass\n"
                        "Name-Email: \n"
                        "Expire-Date: 0\n"
                        "%no-protection\n"
                        "%commit\n"
                        "%echo done");
}
 
namespace {
auto resolveWslGpgconfPath(const QString &lastPart) -> QString {
  qsizetype lastSep = lastPart.lastIndexOf('/');
  if (lastSep < 0) {
    lastSep = lastPart.lastIndexOf('\\');
  }
  if (lastSep >= 0) {
    return lastPart.left(lastSep + 1) + "gpgconf";
  }
  return QStringLiteral("gpgconf");
}
 
QString findGpgconfInGpgDir(const QString &gpgPath) {
  QFileInfo gpgInfo(gpgPath);
  if (!gpgInfo.isAbsolute()) {
    return {};
  }
 
  QDir dir(gpgInfo.absolutePath());
 
#ifdef Q_OS_WIN
  QFileInfo candidateExe(dir.filePath("gpgconf.exe"));
  if (candidateExe.isExecutable()) {
    return candidateExe.filePath();
  }
#endif
 
  QFileInfo candidate(dir.filePath("gpgconf"));
  if (candidate.isExecutable()) {
    return candidate.filePath();
  }
  return {};
}
 
} // namespace
 
auto Pass::resolveGpgconfCommand(const QString &gpgPath)
    -> ResolvedGpgconfCommand {
  if (gpgPath.trimmed().isEmpty()) {
    return {"gpgconf", {}};
  }
 
  // WSL: gpgconf next to the configured gpg, same distribution, via --exec
  // not the shell. An unparsed form (`wsl sh -c ...`, bare `wsl`) falls back
  // to gpgconf on the Windows PATH.
  if (const auto wsl = Executor::parseWslCommand(gpgPath)) {
    if (!QFileInfo(wsl->command).fileName().startsWith("gpg")) {
      return {"gpgconf", {}};
    }
    const auto gpgconf = wsl->with(resolveWslGpgconfPath(wsl->command));
    return {gpgconf.launcher, gpgconf.argv({})};
  }
 
  const QStringList parts = QProcess::splitCommand(gpgPath);
  if (parts.isEmpty()) {
    return {"gpgconf", {}};
  }
  const QString first = parts.first();
  if (QFileInfo(first).fileName().compare("wsl", Qt::CaseInsensitive) == 0 ||
      QFileInfo(first).fileName().compare("wsl.exe", Qt::CaseInsensitive) ==
          0) {
    return {"gpgconf", {}};
  }
 
  if (!first.contains('/') && !first.contains('\\')) {
    return {"gpgconf", {}};
  }
 
  QString gpgconfPath = findGpgconfInGpgDir(first);
  if (!gpgconfPath.isEmpty()) {
    return {gpgconfPath, {}};
  }
 
  return {"gpgconf", {}};
}
 
void Pass::GenerateGPGKeys(QString batch) {
  const QString gpgPath = m_settings.gpgExecutable;
  if (gpgPath.isEmpty()) {
    // The executor would fail an empty executable with a generic process
    // error; the keygen dialog waits for generateGPGKeysFailed and a reason
    // it can show. Queued so we do not re-enter KeygenDialog::done(), which
    // drives key generation synchronously.
    QMetaObject::invokeMethod(
        this,
        [this]() {
          emit generateGPGKeysFailed(tr("No GPG executable configured"));
          emit processErrorExit(1, tr("No GPG executable configured"));
        },
        Qt::QueuedConnection);
    return;
  }
 
  // A stale gpg-agent holding the key database lock causes "database locked"
  // timeouts during key generation.
  ResolvedGpgconfCommand resolvedGpgconf = resolveGpgconfCommand(gpgPath);
  QStringList killArgs = resolvedGpgconf.arguments;
  killArgs << "--kill";
  killArgs << "gpg-agent";
  // Use same environment as key generation to target correct gpg-agent
  if (Executor::executeBlocking(env, resolvedGpgconf.program, killArgs) != 0) {
    qCWarning(lcQtPass) << "Failed to kill gpg-agent";
  }
 
  executeWrapper(GPG_GENKEYS, gpgPath, {"--gen-key", "--no-tty", "--batch"},
                 std::move(batch), true, true);
}
 
auto Pass::listKeys(QStringList keystrings, bool secret) -> QList<UserInfo> {
  QStringList args = {"--no-tty", "--with-colons", "--with-fingerprint"};
  args.append(secret ? "--list-secret-keys" : "--list-keys");
 
  for (const QString &keystring : std::as_const(keystrings)) {
    if (!keystring.isEmpty()) {
      args.append(keystring);
    }
  }
  QString p_out;
  if (Executor::executeBlocking(m_settings.gpgExecutable, args, &p_out) != 0) {
    return {};
  }
  return parseGpgColonOutput(p_out, secret);
}
 
auto Pass::listKeys(const QString &keystring, bool secret) -> QList<UserInfo> {
  return listKeys(QStringList(keystring), secret);
}
 
namespace {
 
auto containsAny(const QString &str, const QStringList &patterns) -> bool {
  for (const QString &p : patterns) {
    if (str.contains(p)) {
      return true;
    }
  }
  return false;
}
 
// @p patterns must already be lowercase; only @p str is lowered.
auto containsAnyCaseInsensitive(const QString &str, const QStringList &patterns)
    -> bool {
  const QString lower = str.toLower();
  for (const QString &p : patterns) {
    if (lower.contains(p)) {
      return true;
    }
  }
  return false;
}
 
} // namespace
 
auto gpgErrorMessage(const QString &err) -> QString {
  // Machine-readable status tokens added by --status-fd 2
  if (containsAny(err, {QStringLiteral("[GNUPG:] KEYEXPIRED"),
                        QStringLiteral("[GNUPG:] INV_RECP 5 ")}))
    return QCoreApplication::translate(
        "Pass", "Encryption failed: GPG key has expired. Please renew or "
                "replace it.");
  if (containsAny(err, {QStringLiteral("[GNUPG:] KEYREVOKED"),
                        QStringLiteral("[GNUPG:] INV_RECP 4 ")}))
    return QCoreApplication::translate(
        "Pass", "Encryption failed: GPG key has been revoked.");
  if (containsAny(err, {QStringLiteral("[GNUPG:] NO_PUBKEY"),
                        QStringLiteral("[GNUPG:] INV_RECP")}))
    return QCoreApplication::translate(
        "Pass", "Encryption failed: recipient GPG key not found or invalid. "
                "Check that the key ID in .gpg-id is correct and imported.");
  if (err.contains(QStringLiteral("[GNUPG:] FAILURE")))
    return QCoreApplication::translate(
        "Pass", "Encryption failed. Check that your GPG key is valid.");
 
  // Locale-dependent fallbacks
  if (containsAnyCaseInsensitive(err, {QLatin1String("key has expired"),
                                       QLatin1String("key expired")}))
    return QCoreApplication::translate(
        "Pass", "Encryption failed: GPG key has expired. Please renew or "
                "replace it.");
  if (containsAnyCaseInsensitive(err, {QLatin1String("key has been revoked"),
                                       QLatin1String("revoked")}))
    return QCoreApplication::translate(
        "Pass", "Encryption failed: GPG key has been revoked.");
  // pass passes no --status-fd, so this is all gpg says about a key that is
  // present but cannot encrypt: expired, revoked, without an encryption
  // subkey, or not trusted ("There is no assurance this key belongs to the
  // named user"). "Not found ... imported" would send the user the wrong
  // way; gpg's own lines, shown below this, say which it is.
  if (containsAnyCaseInsensitive(err, {QLatin1String("unusable public key")}))
    return QCoreApplication::translate(
        "Pass", "Encryption failed: a recipient's GPG key cannot be used. It "
                "may have expired or been revoked, have no encryption subkey, "
                "or not be trusted; gpg's message below says which.");
  if (containsAnyCaseInsensitive(err, {QLatin1String("no public key"),
                                       QLatin1String("no secret key")}))
    return QCoreApplication::translate(
        "Pass", "Encryption failed: recipient GPG key not found or invalid. "
                "Check that the key ID in .gpg-id is correct and imported.");
  if (containsAnyCaseInsensitive(err, {QLatin1String("encryption failed")}))
    return QCoreApplication::translate(
        "Pass", "Encryption failed. Check that your GPG key is valid.");
 
  return {};
}
 
void Pass::finished(int id, int exitCode, const QString &out,
                    const QString &err) {
  auto pid = static_cast<PROCESS>(id);
 
  // Pop the Show() this completion belongs to whether it worked or not, or
  // the next result would be attributed to the wrong file.
  QString shownFile;
  if (pid == PASS_SHOW && !m_pendingShows.isEmpty()) {
    shownFile = m_pendingShows.dequeue();
  }
  // Count this insert off, success or failure, before its result goes out, so
  // insertsPending() tracks the inserts still awaiting a report. Each insert
  // reaches here once as PASS_INSERT.
  if (pid == PASS_INSERT && m_insertsPending > 0) {
    --m_insertsPending;
  }
 
  if (exitCode != 0) {
    handleProcessError(pid, exitCode, out, err);
    return;
  }
 
  if (pid == PASS_SHOW) {
    emit finishedShow(out, shownFile);
    return;
  }
  emitProcessFinishedSignal(pid, out, err);
}
 
void Pass::handleProcessError(PROCESS pid, int exitCode, const QString &out,
                              const QString &err) {
  Q_UNUSED(out);
 
  if (pid == PASS_INSERT) {
    const QString friendly = gpgErrorMessage(err);
    const QString why =
        friendly.isEmpty() ? err : formatInsertError(friendly, err);
    const bool written = insertWritten(err);
    emit insertFailed(why, written);
    if (written) {
      // The entry is in the store; a git step after it failed (a commit
      // that could not be signed, with pass.signcommits, say). The dialog
      // closes on this, so say it here rather than only in the output
      // panel.
      emit critical(tr("Saved, not committed"),
                    tr("The entry is saved in the store, but recording it "
                       "in git failed. What was reported:\n\n%1")
                        .arg(err.trimmed()));
    }
    emit processErrorExit(exitCode, why);
    return;
  }
 
  if (pid == GPG_GENKEYS) {
    emit generateGPGKeysFailed(err);
  }
  emit processErrorExit(exitCode, err);
}
 
auto Pass::formatInsertError(const QString &friendly, const QString &err)
    -> QString {
  QStringList humanLines;
  for (const QString &line : err.split('\n')) {
    QString cleanedLine = line;
    cleanedLine.remove('\r');
    if (!cleanedLine.startsWith(QLatin1String("[GNUPG:]")))
      humanLines.append(cleanedLine);
  }
  const QString humanErr = humanLines.join('\n').trimmed();
  return humanErr.isEmpty() ? friendly : friendly + "\n\n" + humanErr;
}
 
void Pass::emitProcessFinishedSignal(PROCESS pid, const QString &out,
                                     const QString &err) {
  // Only output that cannot contain a secret reaches the generic listeners
  // (the output panel among them); Enums::processInfo is the one table.
  if (pid >= 0 && pid < Enums::PROCESS_COUNT &&
      !Enums::processInfo(pid).secret) {
    emit finishedAnyWithPid(out, err, pid);
  }
 
  // The kind-specific signal. PASS_SHOW is emitted by finished(), which
  // knows the file. Content search runs in-process (NativeGrep), not
  // through `pass grep`, and emits finishedGrep itself.
  using Signal = void (Pass::*)(const QString &, const QString &);
  static const QHash<int, Signal> kSignals{
      {GIT_INIT, &Pass::finishedGitInit},
      {GIT_PULL, &Pass::finishedGitPull},
      {GIT_PUSH, &Pass::finishedGitPush},
      {PASS_INSERT, &Pass::finishedInsert},
      {PASS_REMOVE, &Pass::finishedRemove},
      {PASS_INIT, &Pass::finishedInit},
      {PASS_MOVE, &Pass::finishedMove},
      {PASS_COPY, &Pass::finishedCopy},
      {GPG_GENKEYS, &Pass::finishedGenerateGPGKeys},
  };
  if (const Signal signal = kSignals.value(pid, nullptr)) {
    (this->*signal)(out, err);
  }
}
 
void Pass::setEnvVar(const QString &name, const QString &value) {
  if (value.isEmpty())
    env.remove(name);
  else
    env.insert(name, value);
}
 
void Pass::updateEnv() {
  setEnvVar(QStringLiteral("PASSWORD_STORE_SIGNING_KEY"),
            m_settings.passSigningKey);
  setEnvVar(QStringLiteral("PASSWORD_STORE_DIR"), m_settings.passStore);
  // Every path QtPass hands git names one file or folder: an entry called
  // "a*.gpg" must not make `git rm -f -- a*.gpg` remove every entry that
  // matches. Also reaches the git that pass runs, which passes names the
  // same way.
  setEnvVar(QStringLiteral("GIT_LITERAL_PATHSPECS"), QStringLiteral("1"));
 
  const PasswordConfiguration &passConfig = m_settings.passwordConfiguration;
  setEnvVar(QStringLiteral("PASSWORD_STORE_GENERATED_LENGTH"),
            QString::number(passConfig.length));
 
  setEnvVar(QStringLiteral("PASSWORD_STORE_CHARACTER_SET"),
            effectiveCharset(passConfig));
 
  // pass hands PASSWORD_STORE_GPG_OPTS to every gpg it runs: the user's own
  // options (split as pass's shell splits them: spaces, tabs, newlines),
  // then the output limit ImitatePass passes directly.
  QStringList gpgOpts = QProcessEnvironment::systemEnvironment()
                            .value(QStringLiteral("PASSWORD_STORE_GPG_OPTS"))
                            .split(QRegularExpression(QStringLiteral("\\s+")),
                                   Qt::SkipEmptyParts);
  gpgOpts << maxOutputArgs();
  setEnvVar(QStringLiteral("PASSWORD_STORE_GPG_OPTS"),
            gpgOpts.join(QLatin1Char(' ')));
 
  // As pass does: git never looks for a repository above the store's own
  // parent. A store that is not a repository itself but lies inside one (a
  // dotfiles repository in the home folder) would otherwise have its entries
  // committed and pushed there by native git mode. Only in the environment
  // of the processes QtPass runs for the store, never QtPass's own, which a
  // file manager or terminal it opens would inherit. pass sets its own
  // ceiling whatever this says. A store kept inside a larger repository on
  // purpose opts out (gitUseParentRepository), and then, as without a
  // store, whatever ceiling QtPass was started with applies.
  // A ceiling git cannot take as one entry (the parent's path holds the
  // list separator) is backed by GIT_DIR and GIT_WORK_TREE naming the
  // store's own repository (Util::gitStoreVariables()); pass unsets those
  // for itself and keeps its own ceiling.
  setEnvVar(QStringLiteral("GIT_DIR"), QString());
  setEnvVar(QStringLiteral("GIT_WORK_TREE"), QString());
  if (m_settings.gitUseParentRepository || m_settings.passStore.isEmpty()) {
    setEnvVar(QStringLiteral("GIT_CEILING_DIRECTORIES"),
              qEnvironmentVariable("GIT_CEILING_DIRECTORIES"));
  } else {
    for (const auto &[name, value] : Util::gitStoreVariables(
             m_settings.passStore, m_settings.gitExecutable)) {
      setEnvVar(name, value);
    }
  }
 
  exec.setEnvironment(env);
}
 
auto Pass::withCurrentGitPin(QProcessEnvironment base) const
    -> QProcessEnvironment {
  if (m_settings.gitUseParentRepository || m_settings.passStore.isEmpty()) {
    return base;
  }
  base.remove(QStringLiteral("GIT_DIR"));
  base.remove(QStringLiteral("GIT_WORK_TREE"));
  for (const auto &[name, value] : Util::gitStoreVariables(
           m_settings.passStore, m_settings.gitExecutable)) {
    base.insert(name, value);
  }
  return base;
}
 
auto Pass::maxOutputArgs() -> QStringList {
  return {QStringLiteral("--max-output"), QString::number(kMaxPlaintextBytes)};
}
 
namespace {
#ifdef Q_OS_WIN
constexpr auto kPathCase = Qt::CaseInsensitive;
#else
constexpr auto kPathCase = Qt::CaseSensitive;
#endif

auto isAtOrUnder(const QString &path, const QString &dir,
                 const QString &dirPrefix) -> bool {
  return path.compare(dir, kPathCase) == 0 ||
         path.startsWith(dirPrefix, kPathCase);
}

struct GpgIdLookup {
  QDir start;
  QString storeDir;
  QString storePrefix;
};

auto gpgIdLookup(const QString &for_file, const QString &passStore)
    -> GpgIdLookup {
  const QString normalizedFile = QDir::fromNativeSeparators(for_file);
  // Inside the store means at a path boundary: "/store-other/x" is not
  // under "/store", however the prefix compares.
  const QString storeDir =
      QDir::cleanPath(QDir::fromNativeSeparators(passStore));
  const QString storePrefix = storeDir.endsWith(QLatin1Char('/'))
                                  ? storeDir
                                  : storeDir + QLatin1Char('/');
  const QString cleanFile = QDir::cleanPath(normalizedFile);
  const bool insideStore = isAtOrUnder(cleanFile, storeDir, storePrefix);
  // A relative name is one inside the store; an absolute path outside it
  // stays what it is and the walk stops at once.
  const QString fullPath = insideStore || QDir::isAbsolutePath(cleanFile)
                               ? cleanFile
                               : storePrefix + cleanFile;
  // A folder (trailing separator, which cleanPath() dropped, or an existing
  // directory) wants its own list; an entry wants its folder's.
  const bool isFolder =
      normalizedFile.endsWith(QLatin1Char('/')) || QFileInfo(fullPath).isDir();
  // A folder that does not exist yet (an entry saved into a new folder, a
  // move to one) starts the walk at its nearest existing ancestor in the
  // store, as pass's set_gpg_recipients does: otherwise the walk ended at
  // once and the store root's list was taken over the one in between.
  QString start = isFolder ? fullPath : QFileInfo(fullPath).absolutePath();
  while (!QFileInfo(start).exists() &&
         isAtOrUnder(QDir::cleanPath(start), storeDir, storePrefix) &&
         QDir::cleanPath(start) != storeDir) {
    start = QFileInfo(start).absolutePath();
  }
  return {QDir(start), storeDir, storePrefix};
}

auto isOwnGpgId(const QFileInfo &candidate) -> bool {
  return candidate.exists() && !candidate.isSymLink() &&
         !candidate.isJunction();
}

auto nearestGpgId(const GpgIdLookup &lookup) -> std::optional<QString> {
  QDir dir = lookup.start;
  while (dir.exists() && isAtOrUnder(QDir::cleanPath(dir.absolutePath()),
                                     lookup.storeDir, lookup.storePrefix)) {
    const QFileInfo candidate(dir.absoluteFilePath(".gpg-id"));
    if (isOwnGpgId(candidate)) {
      return candidate.absoluteFilePath();
    }
    if (!dir.cdUp()) {
      break;
    }
  }
  return std::nullopt;
}
 
} // namespace
 
auto Pass::refuseLinkedPath(const QString &path, LinkScope scope,
                            PathSpelling spelling) -> bool {
  const QString full = QDir::isAbsolutePath(path)
                           ? path
                           : QDir(m_settings.passStore).filePath(path);
  // The link check below walks only under the store as configured: a path
  // spelled through the root's link target would get no more than the
  // entry itself judged. No caller makes one; say so if one starts to.
  if (spelling == PathSpelling::Configured &&
      PathValidator::isTargetSpelled(m_settings.passStore, full)) {
    qCWarning(lcQtPass)
        << "Path spelled through the store root's link target, not as the "
           "store is configured; Pass operations expect the configured "
           "spelling:"
        << full;
  }
  if (!Util::isUnderLink(full, m_settings.passStore,
                         scope == LinkScope::EntryAndParents)) {
    return false;
  }
  const QString why =
      tr("%1 is, or lies behind, a symbolic link or junction. What that "
         "points to is not part of the password store and is left alone.")
          .arg(QDir::toNativeSeparators(QDir::cleanPath(full)));
  refuseAsNotPartOfStore(why);
  return true;
}
 
auto Pass::refuseFolderOutsideStore(const QString &folder, QString *relative)
    -> bool {
  if (const std::optional<QString> inStore =
          PathValidator::storeRelativePath(m_settings.passStore, folder)) {
    if (relative != nullptr) {
      *relative = *inStore;
    }
    return false;
  }
  refuseAsNotPartOfStore(
      tr("%1 is not inside the password store. Recipients are set for the "
         "store or a folder in it.")
          .arg(QDir::toNativeSeparators(QDir::cleanPath(folder))));
  return true;
}
 
auto Pass::unfinishedGitOperationReason() -> QString {
  if (!m_settings.useGit) {
    return {};
  }
  // One git call names the path of each marker file or directory, whether or
  // not it exists; the backend runs it in the store (ImitatePass with
  // `-C <store>`, RealPass through `pass git`). The markers, paired with the
  // operation each one means, in the order git prints them back.
  const std::array<std::pair<QLatin1String, QString>, 6> markers{{
      {QLatin1String("rebase-merge"), tr("rebase")},
      {QLatin1String("rebase-apply"), tr("rebase")},
      {QLatin1String("MERGE_HEAD"), tr("merge")},
      {QLatin1String("CHERRY_PICK_HEAD"), tr("cherry-pick")},
      {QLatin1String("REVERT_HEAD"), tr("revert")},
      // A multi-commit cherry-pick or revert keeps its sequencer state after a
      // conflict resolution is committed, when CHERRY_PICK_HEAD/REVERT_HEAD is
      // already gone but `--continue` has more commits to apply. Checked last,
      // so the specific head above names the operation when it is still there.
      {QLatin1String("sequencer"), tr("cherry-pick or revert")},
  }};
  QStringList args{QStringLiteral("rev-parse")};
  for (const auto &marker : markers) {
    args << QStringLiteral("--git-path") << marker.first;
  }
  QString out;
  if (!storeGit(args, &out)) {
    // Git is off, the store is not a repository, or git could not be asked:
    // nothing is refused, as the operation would run anyway.
    return {};
  }
  const QStringList paths = out.split(QLatin1Char('\n'), Qt::SkipEmptyParts);
  for (int i = 0; i < paths.size() && i < static_cast<int>(markers.size());
       ++i) {
    const QString path = paths.at(i).trimmed();
    const QString full = QDir::isAbsolutePath(path)
                             ? path
                             : QDir(m_settings.passStore).filePath(path);
    if (!QFileInfo::exists(full)) {
      continue;
    }
    return tr("The store's Git repository is in the middle of a %1. Finish or "
              "abort it with git before changing the store, or what you change "
              "may be lost.")
        .arg(markers.at(static_cast<size_t>(i)).second);
  }
  return {};
}
 
auto Pass::refusePendingPull() -> bool {
  if (!m_settings.useGit || !exec.hasQueued(Enums::GIT_PULL)) {
    return false;
  }
  const QString why =
      tr("The password store is being updated (a Git pull is in progress). "
         "Wait until it has finished, then try again.");
  // Like refuseAsNotPartOfStore(): the interface arms when an operation starts
  // and is released by processErrorExit(); a refusal starts nothing.
  emit startingExecuteWrapper();
  emit critical(tr("Update in progress"), why);
  emit processErrorExit(1, why);
  return true;
}
 
auto Pass::refuseUnfinishedGitOperation() -> bool {
  const QString why = unfinishedGitOperationReason();
  if (why.isEmpty()) {
    return false;
  }
  // Like refuseAsNotPartOfStore(): the interface arms when an operation starts
  // and is released by finished()/processErrorExit(); a refusal starts
  // nothing, so it emits both ends.
  emit startingExecuteWrapper();
  emit critical(tr("Unfinished Git operation"), why);
  emit processErrorExit(1, why);
  return true;
}
 
void Pass::refuseAsNotPartOfStore(const QString &why) {
  // The interface arms itself when an operation starts and is released by
  // finished or processErrorExit; a refusal starts nothing, so emits both.
  emit startingExecuteWrapper();
  emit critical(tr("Not part of the store"), why);
  emit processErrorExit(1, why);
}
 
auto Pass::getGpgIdPath(const QString &for_file, const QString &passStore)
    -> QString {
  return nearestGpgId(gpgIdLookup(for_file, passStore))
      .value_or(
          QDir(QDir::fromNativeSeparators(passStore)).filePath(".gpg-id"));
}
 
auto Pass::refuseSkippedGpgId(const QString &file, bool signing,
                              const QString &except) -> bool {
  // Without a signing key the parent's list applies, as it does for pass.
  if (!signing) {
    return false;
  }
  QString recordError;
  const std::optional<QString> skipped =
      skippedGpgId(file, m_settings.passStore, &recordError);
  if (!skipped || (!except.isEmpty() &&
                   QDir::cleanPath(*skipped) == QDir::cleanPath(except))) {
    return false;
  }
  // The strings keep the context they were translated in.
  if (!recordError.isEmpty()) {
    emit critical(QCoreApplication::translate(
                      "ImitatePass", "Cannot check the recipient list"),
                  QCoreApplication::translate(
                      "ImitatePass", "%1 Whether %2 was removed cannot be "
                                     "told, so nothing was encrypted.")
                      .arg(recordError, QDir::toNativeSeparators(*skipped)));
    return true;
  }
  emit critical(
      QCoreApplication::translate("ImitatePass", "Recipient list missing"),
      QCoreApplication::translate(
          "ImitatePass",
          "The signed recipient list %1 is missing or is not a regular file. "
          "QtPass does not fall back to a parent folder's list for it: that "
          "list was not signed for this folder. If a link is under that name, "
          "remove it. Then open Users for that folder and save its "
          "recipients, which writes and signs a fresh list.")
          .arg(QDir::toNativeSeparators(*skipped)));
  return true;
}
 
auto Pass::verifySignedList(const GpgIdSigner &signer, const QString &gpgIdFile,
                            QByteArray *contents, QString *why) const -> bool {
  if (!signer.verifyFile(gpgIdFile, contents)) {
    return false;
  }
  // Authentic and unmodified is not the same as current: an older signed
  // list put back into the store is refused once this device has seen a
  // newer one, and one signed for another folder is refused here.
  QString reason;
  if (GpgIdGeneration::accept(gpgIdFile, *contents, m_settings.passStore,
                              &reason) != GpgIdGeneration::Verdict::Accepted) {
    if (why != nullptr) {
      *why = reason;
    }
    return false;
  }
  return true;
}
 
auto Pass::skippedGpgId(const QString &forFile, const QString &passStore,
                        QString *recordError) -> std::optional<QString> {
  const GpgIdLookup lookup = gpgIdLookup(forFile, passStore);
  QDir dir = lookup.start;
  // The same walk as nearestGpgId(), stopping at the list it finds, and
  // short of the store root: the root's own list has no parent to fall
  // back to, and the signature check refuses it when it is missing.
  while (dir.exists() && QDir::cleanPath(dir.absolutePath())
                             .startsWith(lookup.storePrefix, kPathCase)) {
    const QFileInfo candidate(dir.absoluteFilePath(".gpg-id"));
    if (isOwnGpgId(candidate)) {
      return std::nullopt;
    }
    // A link under the name (dangling or not), or nothing under it where
    // this device accepted a list before: both are the folder's list gone,
    // not a folder that never had one.
    if (candidate.isSymLink() || candidate.isJunction()) {
      return candidate.absoluteFilePath();
    }
    // An unreadable record is not "never seen": whether a list was accepted
    // here cannot be told, so this folder is refused too (fail closed), with
    // the record's own reason for the caller to show.
    QString why;
    const std::optional<qint64> seen =
        GpgIdGeneration::remembered(candidate.absoluteFilePath(), &why);
    if (!seen) {
      if (recordError != nullptr) {
        *recordError =
            why.isEmpty()
                ? tr("The generation record of the recipient lists cannot "
                     "be read.")
                : why;
      }
      return candidate.absoluteFilePath();
    }
    if (*seen > 0) {
      return candidate.absoluteFilePath();
    }
    if (!dir.cdUp()) {
      break;
    }
  }
  return std::nullopt;
}
 
namespace {

auto judgedRecipients(GpgIdGeneration::Verdict verdict,
                      const QByteArray &contents, const QString &gpgIdPath,
                      const QString &why) -> Pass::RecipientsForEditing {
  using RecipientsForEditing = Pass::RecipientsForEditing;
  RecipientsForEditing result;
  switch (verdict) {
  case GpgIdGeneration::Verdict::Accepted:
    result.state = RecipientsForEditing::State::Verified;
    result.recipients = Pass::parseRecipients(contents, gpgIdPath);
    break;
  case GpgIdGeneration::Verdict::Rollback:
    // Authentic and this folder's, only older: the recovery goes through
    // this dialog, so it is preselected, with the reason in view.
    result.state = RecipientsForEditing::State::VerifiedRollback;
    result.recipients = Pass::parseRecipients(contents, gpgIdPath);
    result.warning = why;
    break;
  case GpgIdGeneration::Verdict::Unbound:
  case GpgIdGeneration::Verdict::Conflict:
  case GpgIdGeneration::Verdict::WrongFolder:
  case GpgIdGeneration::Verdict::WrongStore:
  case GpgIdGeneration::Verdict::Malformed:
  case GpgIdGeneration::Verdict::RecordUnavailable:
    // Signed, but not shown to be this folder's list, not a list to trust,
    // or nothing to judge it by: preselecting it would sign it in.
    result.state = RecipientsForEditing::State::Rejected;
    result.warning =
        Pass::tr("%1 Nothing is preselected: saving would sign whatever is "
                 "in it. Select the recipients yourself.")
            .arg(why);
    break;
  }
  return result;
}
 
} // namespace
 
auto Pass::recipientsForEditing(const QString &dir, const QString &passStore)
    -> RecipientsForEditing {
  RecipientsForEditing result;
  const QString folder = dir.isEmpty() ? QString() : dir;
  const QString gpgIdPath = getGpgIdPath(folder, passStore);
  const GpgIdSigner signer(
      m_settings.gpgExecutable,
      GpgIdSigner::keysFromSetting(m_settings.passSigningKey));
  if (!signer.enabled()) {
    // A list that is there but cannot be read as one (too large, not a
    // regular file, unreadable) is not an empty list: preselecting nothing
    // without a word would let OK write a new list over it, and later
    // re-encryptions drop whoever it named.
    // Read once and parsed from those bytes: a second read could find
    // something else under the name. A link counts as there, dangling too.
    const QFileInfo info(gpgIdPath);
    if (!info.exists() && !info.isSymLink()) {
      result.state = RecipientsForEditing::State::Unsigned;
      return result;
    }
    const std::optional<QByteArray> bytes =
        Util::readRegularFile(gpgIdPath, Util::kMaxGpgIdBytes);
    if (!bytes) {
      result.state = RecipientsForEditing::State::Rejected;
      result.warning =
          tr("%1 cannot be read as a recipient list (a regular file of at "
             "most %2), so nothing is preselected. Check it before choosing "
             "recipients here: OK writes a new list over it.")
              .arg(gpgIdPath,
                   QLocale().formattedDataSize(Util::kMaxGpgIdBytes));
      return result;
    }
    result.state = RecipientsForEditing::State::Unsigned;
    result.recipients = parseRecipients(*bytes, gpgIdPath);
    return result;
  }
  QString recordError;
  if (const std::optional<QString> skipped =
          skippedGpgId(folder, passStore, &recordError)) {
    // The folder's own list was removed or replaced by a link (or the record
    // that would tell cannot be read): the list the walk found further up
    // was not signed for this folder, so preselecting it would sign it in
    // here with one click.
    result.state = RecipientsForEditing::State::Rejected;
    result.warning =
        recordError.isEmpty()
            ? tr("The recipient list %1 is missing or is not a regular file, "
                 "so nothing is preselected: the list of a parent folder was "
                 "not signed for this one. Select this folder's recipients "
                 "yourself; OK writes and signs a fresh list.")
                  .arg(*skipped)
            : tr("%1 Nothing is preselected: whether %2 was removed cannot "
                 "be told.")
                  .arg(recordError, *skipped);
    return result;
  }
  if (!QFileInfo::exists(gpgIdPath)) {
    // A folder without a list yet (new store, new profile): nothing to
    // verify and nothing to preselect.
    result.state = RecipientsForEditing::State::Verified;
    return result;
  }
  QByteArray contents;
  if (!signer.verifyFile(gpgIdPath, &contents)) {
    result.state = RecipientsForEditing::State::Rejected;
    result.warning =
        tr("The recipient list %1 does not verify against the signing key, "
           "so nothing is preselected: saving would sign whatever is in it. "
           "Select the recipients yourself; OK writes and signs a fresh list.")
            .arg(gpgIdPath);
    return result;
  }
  QString why;
  const GpgIdGeneration::Verdict verdict =
      GpgIdGeneration::accept(gpgIdPath, contents, passStore, &why);
  return judgedRecipients(verdict, contents, gpgIdPath, why);
}
 
auto Pass::getRecipientList(const QString &for_file, const QString &passStore)
    -> QStringList {
  const QString gpgIdPath = getGpgIdPath(for_file, passStore);
  // The root .gpg-id comes back whatever it is; a link is not a list.
  if (Util::isLinkedFolder(gpgIdPath)) {
    return {};
  }
  const std::optional<QByteArray> bytes =
      Util::readRegularFile(gpgIdPath, Util::kMaxGpgIdBytes);
  if (!bytes) {
    return {};
  }
  return parseRecipients(*bytes, gpgIdPath);
}
 
auto Pass::parseRecipients(const QByteArray &contents,
                           const QString &sourceName) -> QStringList {
  QStringList recipients;
  const QString text = QString::fromUtf8(contents);
  for (const QString &line : text.split(QLatin1Char('\n'))) {
    QString recipient = line.split(QLatin1Char('#')).first().trimmed();
    if (recipient.isEmpty()) {
      continue;
    }
    if (!Util::isValidKeyId(recipient)) {
      // Never drop a recipient silently: the list is written back verbatim
      // by UsersDialog, so a skipped line disappears from .gpg-id.
      qCWarning(lcQtPass) << "Skipping unusable recipient in" << sourceName
                          << ":" << recipient;
      continue;
    }
    recipients += recipient;
  }
  return recipients;
}
 
auto Pass::seedGpgIdFile(const QString &newDir, const QString &passStore)
    -> bool {
  const QString gpgIdFile = QDir(newDir).absoluteFilePath(".gpg-id");
  if (QFileInfo::exists(gpgIdFile)) {
    return false;
  }
  // Resolving from the file to be created finds the parent's .gpg-id whether
  // or not newDir has a trailing separator.
  const QStringList recipients = getRecipientList(gpgIdFile, passStore);
  if (recipients.isEmpty()) {
    return false;
  }
  // Only reached without a signing key, so no generation header: a plain
  // list stays readable for clients that take a comment for a recipient.
  // Staged and replacing nothing: a link planted after the exists() above
  // (a dangling one passes it) fails the seed instead of being written through.
  return Util::writeFileReplacing(
      gpgIdFile,
      (recipients.join(QLatin1Char('\n')) + QLatin1Char('\n')).toUtf8(), false);
}
 
/* Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
 */
 
auto Pass::boundedRandom(quint32 bound) -> quint32 {
  if (bound < 2) {
    return 0;
  }
 
  quint32 randval;
  // arc4random_uniform-style rejection against modulo bias: drop values
  // below 2^32 % bound, which (1 + ~bound) % bound computes in quint32.
  const quint32 rejectionThreshold = (1 + ~bound) % bound;
 
  do {
    randval = QRandomGenerator::system()->generate();
  } while (randval < rejectionThreshold);
 
  return randval % bound;
}
 
auto Pass::generateRandomPassword(const QString &charset, unsigned int length)
    -> QString {
  if (charset.isEmpty() || length == 0U) {
    return {};
  }
  QString out;
  for (unsigned int i = 0; i < length; ++i) {
    out.append(charset.at(static_cast<int>(
        boundedRandom(static_cast<quint32>(charset.length())))));
  }
  return out;
}