Welcome to little lamb

Code » ssp » commit 4bcd4aa

Add documentation

author Olivier Brunel
2023-08-20 14:48:20 UTC
committer Olivier Brunel
2023-08-20 14:55:39 UTC
parent ed1328920c89d6de044290160e572c1f27ec7a4f

Add documentation

src/doc/include/show-entry.md +5 -0
src/doc/ssp-add.1.md +50 -0
src/doc/ssp-edit.1.md +52 -0
src/doc/ssp-export.1.md +38 -0
src/doc/ssp-get.1.md +82 -0
src/doc/ssp-import.1.md +34 -0
src/doc/ssp-list.1.md +72 -0
src/doc/ssp-remove.1.md +23 -0
src/doc/ssp-rename.1.md +20 -0
src/doc/ssp-show.1.md +85 -0
src/doc/ssp.1.md +109 -11

diff --git a/src/doc/include/show-entry.md b/src/doc/include/show-entry.md
new file mode 100644
index 0000000..78ae9c2
--- /dev/null
+++ b/src/doc/include/show-entry.md
@@ -0,0 +1,5 @@
+! INFO:
+! Afterwards, the entry will be shown. This is done by re-opening the database
+! and processing the entry as via `ssp show <entry>`
+! As such, it can serve as a confirmation that the database was successfully
+! edited.
diff --git a/src/doc/ssp-add.1.md b/src/doc/ssp-add.1.md
new file mode 100644
index 0000000..e1ed7f1
--- /dev/null
+++ b/src/doc/ssp-add.1.md
@@ -0,0 +1,50 @@
+% ssp
+% ssp-add(1)
+
+# NAME
+
+ssp-add - add an entry
+
+# SYNOPSIS
+
+*ssp* add [OPTION..] `ENTRY` `SECRET`
+
+# DESCRIPTION
+
+The *add* command allows to add a new entry to an existing database, or to
+create a new database.
+
+`ENTRY` must be the entry's name, that will be used to identify the
+newly-created entry.
+
+`SECRET` must be the entry's secret, encoded in base32.
+
+Unless *--time* is used, the new entry will be set to be counter-based. Unless
+set with *--algo*, the hashing algorithm is SHA1.
+
+<inc show-entry.md>
+
+# OPTIONS
+
+: *-a*, *--algo* `ALGO`
+:: Set `ALGO` as hashing algorithm; Defaults to sha1. Use `list` to list
+:: available algorithms.
+
+: *-C*, *--comments* `COMMENTS`
+:: Set `COMMENTS` as the entry's comments.
+
+: *-c*, *--counter* `NUM`
+:: Set entry to be counter-based (HOTP) with the next counter value to be `NUM`
+:: Defaults to 1.
+
+: *-d*, *--digits* `NUM`
+:: Set to return an OTP of `NUM` digits. Valid values are from 5 to 9 (both
+:: included); Defaults to 6.
+
+: *-t*, *--time*[=`SECS`]
+:: Set entry to be time-based (TOTP) with a precision of `SECS` seconds. Valid
+:: values are from 10 to 59 (both included); Default to 30.
+
+# SEE ALSO
+
+[ssp-edit](1), [ssp-remove](1)
diff --git a/src/doc/ssp-edit.1.md b/src/doc/ssp-edit.1.md
new file mode 100644
index 0000000..b9a04e1
--- /dev/null
+++ b/src/doc/ssp-edit.1.md
@@ -0,0 +1,52 @@
+% ssp
+% ssp-edit(1)
+
+# NAME
+
+ssp-edit - edit an entry
+
+# SYNOPSIS
+
+*ssp* edit -e `ENTRY` `OPTION`[..]
+
+# DESCRIPTION
+
+The *edit* command allows to edit an existing entry, updating one or more fields
+at a time.
+
+<inc show-entry.md>
+
+! HINT:
+! The *edit* command does not allow to rename an entry. To do so, refer to the
+! *rename* command instead.
+
+# OPTIONS
+
+: *-a*, *--algo* `ALGO`
+:: Set `ALGO` as hashing algorithm; Defaults to sha1. Use `list` to list
+:: available algorithms.
+
+: *-C*, *--comments* `COMMENTS`
+:: Set `COMMENTS` as the entry's comments.
+
+: *-c*, *--counter*[=`NUM`]
+:: Set entry to be counter-based (HOTP) with the next counter value to be `NUM`
+:: Defaults to 1.
+
+: *-d*, *--digits* `NUM`
+:: Set to return an OTP of `NUM` digits. Valid values are from 5 to 9 (both
+:: included); Defaults to 6.
+
+: *-e*, *--entry* `ENTRY`
+:: Edit the entry `ENTRY`. This option is required.
+
+: *-s*, *--secret* `SECRET`
+:: Set `SECRET` to be the entry's secret. `SECRET` must be base32-encoded.
+
+: *-t*, *--time*[=`SECS`]
+:: Set entry to be time-based (TOTP) with a precision of `SECS` seconds. Valid
+:: values are from 10 to 59 (both included); Default to 30.
+
+# SEE ALSO
+
+[ssp-add](1), [ssp-rename](1), [ssp-remove](1)
diff --git a/src/doc/ssp-export.1.md b/src/doc/ssp-export.1.md
new file mode 100644
index 0000000..93ff160
--- /dev/null
+++ b/src/doc/ssp-export.1.md
@@ -0,0 +1,38 @@
+% ssp
+% ssp-export(1)
+
+# NAME
+
+ssp-export - export entries
+
+# SYNOPSIS
+
+*ssp* export [`OPTION`..] [`PATTERN`]
+
+# DESCRIPTION
+
+The *export* command allows to export existing entries. Note that the exported
+entries will obviously feature their secrets, and as such should be handled with
+care.
+
+Entries are exported to *stdout* in an INI-like format. Secrets are written as
+base32-encoded strings, comments (if featured/any) are written in between
+double-quotes (`"`) are escaped as per the rules described for arguments in
+[ssp](1).
+
+By default, all entries from the database are exported. If `PATTERN` is
+specified however, only matching entries will be exported.
+Refer to [ssp-list](1) for more on pattern matching.
+
+! INFO:
+! The *export* command is merely an alias for the *list* command with its
+! *--format* option. Refer to [ssp-show](1) for more about the actual format.
+
+# OPTIONS
+
+: *-C*, *--no-comments*
+:: Do not export entries' comments.
+
+# SEE ALSO
+
+[ssp-list](1), [ssp-show](1)
diff --git a/src/doc/ssp-get.1.md b/src/doc/ssp-get.1.md
new file mode 100644
index 0000000..fad401e
--- /dev/null
+++ b/src/doc/ssp-get.1.md
@@ -0,0 +1,82 @@
+% ssp
+% ssp-get(1)
+
+# NAME
+
+ssp-get - get a One-Time Password
+
+# SYNOPSIS
+
+*ssp* get -e `ENTRY` | -s `SECRET` [`OPTION`..]
+
+# DESCRIPTION
+
+The *get* command is the "main" command, as it's the one allowing you to get a
+One-Time Password (OTP). Other commands are mainly about database/entries
+management.
+
+Usually you will want to get an OTP for an existing entry, using its parameters
+as set in the database. However, it is possible to override such values using
+command-line options.
+
+You can also get an OTP without using any entry, and therefore without the need
+for a database, by specifying all the needed settings via command-line options.
+
+As such, you need to specify at least one of *--entry* or *--secret*. Other
+options are optional and only needed to override entry/default values.
+
+By default the password will be written to *stdout* with either "HOTP: " or
+"TOTP: " as prefix, depending on whether it is a counter-based or time-based
+password, respectively.
+
+To remove said prefix and only have the generated password itself written out,
+use general option *--quiet*.
+
+# OPTIONS
+
+: *-a*, *--algo* `ALGO`
+:: Use `ALGO` as hashing algorithm; Defaults to sha1 unless *--entry* is used.
+:: Use `ssp add --algo=list` to list available algorithms.
+
+: *-C*, *--counter-val* `NUM`
+:: Same as *--counter* but don't update entry in the database.
+
+: *-c*, *--counter*[=`NUM`]
+:: Return a counter-based password (HOTP) using `NUM` as value for the counter;
+:: Defaults to 1.
+:: Note that when using an entry (specified via *--entry*) the entry will be
+:: updated in order to increment its counter value (unless the entry is /not/
+:: counter-based). If for some reason you want the database/entry /not/ to be
+:: updated, use *--counter-val* instead.
+
+: *-d*, *--digits* `NUM`
+:: Return an OTP of `NUM` digits. Valid values are from 5 to 9 (both
+:: included); Defaults to 6 unless *--entry* is used.
+
+: *-e*, *--entry* `ENTRY`
+:: Get a password for `ENTRY`. This means the database will be looked for an
+:: entry named `ENTRY` and its settings will be used as default. Any option
+:: specified on command-line /after/ will then override said values.
+:: In other words, any options given /before/ *--entry* will be ignored.
+::
+:: Additionally, when the entry is counter-based, the database will be updated
+:: with the entry's counter value incremented (unless *--counter-val* was used).
+::
+:: (Note that if the entry is /not/ counter-based but *--counter* is used, the
+:: database will obviously not be updated, leaving the entry as it was, e.g.
+:: time-based.)
+
+: *-s*, *--secret* `SECRET`
+:: Use `SECRET` as secret. `SECRET` must be base32-encoded. Note that this can
+:: be used after *--entry* in order to use a different secret but keep/re-use
+:: all other settings as defaults, or it can be used /instead/ of *--entry* to
+:: get a password without using an entry/database at all.
+
+: *-T*, *--use-time* `TS`
+:: Use `TS` as unix timestamp instead of the current time. This only applies
+:: when getting a time-based password.
+
+: *-t*, *--time*[=`SECS`]
+:: Return a time-based password (TOTP) using a precision of `SECS` seconds.
+:: Valid values are from 10 to 59 (both included); Default to 30 unless *--entry*
+:: is used.
diff --git a/src/doc/ssp-import.1.md b/src/doc/ssp-import.1.md
new file mode 100644
index 0000000..2d923b6
--- /dev/null
+++ b/src/doc/ssp-import.1.md
@@ -0,0 +1,34 @@
+% ssp
+% ssp-import(1)
+
+# NAME
+
+ssp-import - import entries
+
+# SYNOPSIS
+
+*ssp* import `FILE`
+
+# DESCRIPTION
+
+The *import* command allows to import existing entries in INI-like format into a
+new or existing database.
+
+The expected format from `FILE` is the same as generated with the *export*
+command; Refer to [ssp-show](1) (option *--format*) for more.
+
+! NOTE:
+! You cannot use *stdin* for imported data since it will be used to get the
+! database's password.
+!
+! If you want to use a program's output as data to be imported without using a
+! temporary file, a solution might be process substitution.
+!
+! For example, it could look like this:
+! `ssp import <(someprog --export)`
+!
+! Refer to your shell's manual for actual syntax.
+
+# SEE ALSO
+
+[ssp-export](1)
diff --git a/src/doc/ssp-list.1.md b/src/doc/ssp-list.1.md
new file mode 100644
index 0000000..f4fc45e
--- /dev/null
+++ b/src/doc/ssp-list.1.md
@@ -0,0 +1,72 @@
+% ssp
+% ssp-list(1)
+
+# NAME
+
+ssp-list - list entries
+
+# SYNOPSIS
+
+*ssp* list [`OPTION`..] [`PATTERN`]
+
+# DESCRIPTION
+
+The *list* command allows to list existing entries.
+
+By default, all entries from the database are listed. If `PATTERN` is specified
+however, only matching entries will be exported.
+
+Pattern matching is performed by checking whether the entries' name match the
+given `PATTERN`, which must be a shell wildcard pattern, as per [fnmatch](3).
+
+This means you can use a question mark (`?`) to indicate one character exactly,
+and a star (`*`) to indicate zero, one or more characters. Remember that those
+shall most likely be escaped from your shell in order to be passed as-is to
+*ssp*.
+
+By default only the entries' names are listed (written in between double-quotes
+and escaped as per the escaping rules for arguments described in [ssp](1)),
+using a newline (`\n`) as separator.
+
+You can use a different separator using *--sep*, or have the full entries' be
+shown using *--details*.
+
+
+# OPTIONS
+
+: *-C*, *--no-comments*
+:: Do not export entries' comments. Only applies with *--details* or *--format*.
+
+: *-d*, *--details*
+:: Show entries' details. Instead of only listing entries' names, show details
+:: of each matching entries.
+:: Note that by default secrets will /not/ be written out; specify *--secret*
+:: in order to include them as well.
+
+: *-e*, *--escape-comments*
+:: Write comments within double-quotes (`"`) and escaped as per the escaping
+:: rules described in [ssp](1) for arguments. Implies *--details*.
+
+: *-f*, *--format*
+:: Output a list in INI-like format. Refer to [ssp-show](1) for more on the
+:: actual format.
+::
+:: Much like with *--details* this will show details of each matching entries,
+:: but unlike *--details* secrets /will be/ included.
+::
+:: This is mainly intended for exporting data, and in fact the *export* command
+:: is an alias for `list --format`
+
+: *-S*, *--secret*
+:: Show entries' secrets. Implies *--details*.
+
+: *-s*, *--sep* `SEP`
+:: Use `SEP` as separator instead of the default (a newline). This doesn't apply
+:: with *--details* nor *--format*.
+::
+:: Note that entries' names are always written within double-quotes (and escaped
+:: as per escaping rules described for arguments described in [ssp](1)).
+
+# SEE ALSO
+
+[ssp-export](1), [ssp-show](1)
diff --git a/src/doc/ssp-remove.1.md b/src/doc/ssp-remove.1.md
new file mode 100644
index 0000000..df6a22a
--- /dev/null
+++ b/src/doc/ssp-remove.1.md
@@ -0,0 +1,23 @@
+% ssp
+% ssp-remove(1)
+
+# NAME
+
+ssp-remove - remove an entry
+
+# SYNOPSIS
+
+*ssp* remove `ENTRY`
+
+# DESCRIPTION
+
+The *remove* command allows to remove existing entry `ENTRY` from the database.
+
+! WARN:
+! No confirmation will be asked.
+! As a safe-guard, unless general option *--quiet* was used, the entry will be
+! shown before its removal, including its secret.
+
+# SEE ALSO
+
+[ssp-edit](1), [ssp-add](1)
diff --git a/src/doc/ssp-rename.1.md b/src/doc/ssp-rename.1.md
new file mode 100644
index 0000000..faab2d7
--- /dev/null
+++ b/src/doc/ssp-rename.1.md
@@ -0,0 +1,20 @@
+% ssp
+% ssp-rename(1)
+
+# NAME
+
+ssp-rename - rename an entry
+
+# SYNOPSIS
+
+*ssp* rename `ENTRY` `NEWNAME`
+
+# DESCRIPTION
+
+The *rename* command allows to rename  existing entry `ENTRY` to `NEWNAME`.
+
+<inc show-entry.md>
+
+# SEE ALSO
+
+[ssp-edit](1)
diff --git a/src/doc/ssp-show.1.md b/src/doc/ssp-show.1.md
new file mode 100644
index 0000000..968fcc2
--- /dev/null
+++ b/src/doc/ssp-show.1.md
@@ -0,0 +1,85 @@
+% ssp
+% ssp-show(1)
+
+# NAME
+
+ssp-show - show an entry
+
+# SYNOPSIS
+
+*ssp* show OPTION[..] `ENTRY`
+
+# DESCRIPTION
+
+The *show* command allows to show an existing entry.
+
+! HINT:
+! You can only show one entry at a time, specifying its full name. It is
+! possible to show multiple entries via pattern matching using the *list*
+! command (and its *--details* option). Refer to [ssp-list](1) for more.
+
+# OPTIONS
+
+: *-C*, *--no-comments*
+:: Do not export entries' comments.
+
+: *-e*, *--escape-comments*
+:: Write comments within double-quotes (`"`) and escaped as per the escaping
+:: rules described in [ssp](1) for arguments.
+
+: *-f*, *--format*
+:: Output a list in INI-like format. See [[FORMAT]] below for more.
+:: Implies *--secret*
+::
+:: This is mainly intended for exporting data, and is used by the *export*
+:: command.
+
+: *-S*, *--secret*
+:: Show entries' secrets (as base32-encoded string).
+
+# FORMAT
+
+When using *--format* details of the entry will be shown in an INI-like format,
+mainly intended for import/export.
+
+! HINT: Tip
+! You can list more than one entry at a time in the same format using the
+! *--format* option of the *list* command and its pattern matching feature.
+!
+! In order to export all entries from the database, simply use the *export*
+! command (which is an alias for `list --format`).
+
+Therefore, first the name of the entry will be featured within square brackets,
+denoting a section name. As such, no double-quotes will be used. However, the
+escaping rules (as described in [ssp](1) for arguments) still apply.
+
+Each setting will then be written on a single line, in a `name=value` form. Here
+are the list of names/settings :
+
+: *algo*
+:: Hashing algorithm. Same value as for the *--algo* option. Refer to
+:: [ssp-add](1) for more.
+
+: *digits*
+:: Number of digits.
+
+: *counter*
+:: Indicate this is a counter-based password. The value is the next value to be
+:: used for said counter.
+
+: *time*
+:: Indicate this is a time-based password. The value is always 1.
+
+: *precision*
+:: The precision for time-based password.
+
+: *secret*
+:: The secret as a base32-encoded string.
+
+: *comments*
+:: Comments associated with the entry, within double-quotes and escaped as per
+:: the escaping rules described for arguments in [ssp](1).
+
+# SEE ALSO
+
+[ssp-list](1), [ssp-export](1)
diff --git a/src/doc/ssp.1.md b/src/doc/ssp.1.md
index 9eab108..82145bc 100644
--- a/src/doc/ssp.1.md
+++ b/src/doc/ssp.1.md
@@ -3,35 +3,133 @@
 
 # NAME
 
-ssp - 
+ssp - One-Time Password management
 
 # SYNOPSIS
 
-*ssp* [*-q*] [*-v*] [*--debug* [[@[`level`]:]+`FD`|`FILE`]] [*-O* [@[`level`]:]+`FD`|`FILE`]
+*ssp* [*-q*] [*-D* `FILE`] `<command>`
+
+# DESCRIPTION
+
+*ssp* is a simple, fast & secure command-line tool to manage your One-Time
+Passwords (OTPs), whether you want to handle them from your computer or as a
+backup solution.
 
 # OPTIONS
 
+: *-D*, *--database* `FILE`
+:: Use `FILE` as database. Defaults to `$HOME/ssp.db`
+
 : *--debug* [[@[`level`]:]+`FD`|`FILE`]
 <inc autoopt_debug.md>
 <inc autoopt_logdbg_level.md>
 
 <inc opt_help.md>
 
-: *-O*, *--log-file* [@[`level`]:]+`FD`|`FILE`
-<inc autoopt_log.md>
-<inc autoopt_logdbg_level.md>
-
 : *-q*, *--quiet*
 <inc autoopt_quiet.md>
 
-: *-v*, *--verbose*
-<inc autoopt_verbose.md>
-
 <inc opt_version.md>
 
-# DESCRIPTION
+# COMMANDS
+
+The following commands are available through *ssp*. Note that you can abbreviate
+a command's name so long as there's no other match possible.
+
+: *add*
+:: Add a new entry
+
+: *edit*
+:: Edit an existing entry
+
+: *export*
+:: Export entries to file
+
+: *get*
+:: Get a One-Time Password
+
+: *import*
+:: Import entries from file
+
+: *list*
+:: List entries
+
+: *remove*
+:: Remove an entry
+
+: *rename*
+:: Rename an entry
+
+: *show*
+:: Show an entry
+
+To get more information about any of them and their supported options, refer to
+the command's own page ( *ssp-`<command>`* ).
+
+# HOW TO WRITE ARGUMENTS
+
+Whenever you need to specify text, such as file/entry names or comments, the
+same rule apply.
+
+There are no restrictions of length or acceptable characters imposed by *ssp*
+(e.g. file names obviously need to be valid filenames, i.e. no slashes or NUL
+byte).
+Specifically, inputs are treated as byte streams and processed as such.
+
+Note however that in order to use specific characters, or simply spaces, you'll
+need to put argument within double-quotes (`"`).
+
+## Escaping rules
+
+Characters with special escaping are as follow :
+
+: double-quote (`"`)
+:: Escaped by prefixing with a backslash (`\`)
+
+: backslash (`\`)
+:: Escaped by prefixing with a backslash (`\`)
+
+: bell (`0x07`)
+:: Escaped as `\a`
+
+: backspace (`0x08`)
+:: Escaped as `\b`
+
+: tabulation (`0x09`)
+:: Escaped as `\t`
+
+: line feed (`0x0a`)
+:: Escaped as `\n`
+
+: vertical tabulation (`0x0b`)
+:: Escaped as `\v`
+
+: form feed (`0x0c`)
+:: Escaped as `\f`
+
+: carriage return (`0x0d`)
+:: Escaped as `\r`
+
+Additionally, specific bytes can be specified using hex-mode, that is `\x`
+followed by its hexadecimal code. (For example, byte 127 would be escaped as
+`\x7f`).
+
+Anything else will be treated as-is.
+
+# DATABASE
+
+The database is written as a password-protected file.
+
+More specifically, PBKDF2-HMAC-SHA3-256 is used with 500,000 iterations to
+derive a key from the password and a randomly generated salt, said key is then
+used to encrypt the database using ChaCha20-Poly1305.
+
+Whenever writing to the database, the actual file is not changed. Instead a new
+file is created, encrypted data is written to it and only once successfully
+written the file is renamed, thusly replacing the original/old one (if any).
 
-*ssp* is...
+As such, should any error occur during the (re-)writing process, your current
+database file will remain untouched and no data will be lost.
 
 <inc bugs.md>