DOCSEARCHbyAlgolia
Submit Docs

gopass Documentation

repository·master·Indexed 27 days ago

https://github.com/gopasspw/gopass

A standard UNIX password manager designed for teams and a drop-in replacement for `pass`. It provides encrypted credential management with versioning via Git and supports backends such as GPG and age. Features include a CLI for secret management, a Secret Service daemon implementing the org.freedesktop.secrets D-Bus API for Linux, and a Go API via the `pkg/gopass` package.

Tokens
43.5K
Snippets
115
Records
288
Agent score
92%

What's inside gopass

  1. Overview of gopass features

    master

    gopass is a secure secret storage tool that supports several advanced features:

    • Secure secret storage: Encrypted storage of secrets.
    • Multiple stores: Ability to mount multiple stores into your root store.
    • Recipient management: Manage multiple users for each store.
    • Password quality assistance (beta): Offline checks for common password flaws.
    • Password leak checker (integration): Offline checks against known leaks using gopass-hibp.
    • PAGER support: Automatic invocation of a pager for long outputs.
    • JSON API (integration): Enables use as a native extension for browser plugins.
    • Automatic fuzzy search: Searches for matching entries if a literal match is not found.
    • gopass sync: Syncing of remote repositories and GPG keys.
    • Desktop Notifications: Notifications for long-running operations.
    • REPL (beta): Integrated shell with autocompletion by running gopass.
    • OTP support: Generation of TOTP/(HOTP) tokens from stored secrets.
    • Extensions: Extend functionality via custom commands using the gopass API.

  2. Understand the gopass security model and threat model

    master

    gopass is designed to provide confidentiality for secret content using GPG, but it does not protect the names or presence of secrets.

    Key Security Properties:

    • Confidentiality: Secret content is encrypted via GPG. Secret names are visible to anyone with access to the repository.
    • Integrity: Currently, gopass does not protect the integrity of the store (plans for signed git commits are in progress).
    • Availability: High availability is achieved through its decentralized Git-based nature; stores can be cloned from a server or recovered from local copies.
    • Non-repudiation: Not supported.

    Threat Model:

    • Assumes no attackers are present on your local machine.
    • Anyone with access to the Git repository can see the list of stored secrets, but cannot read their content.

  3. Use the experimental cryptfs storage backend

    master
    The cryptfs backend is an experimental storage backend currently in PREVIEW. It functions by hashing secret names and storing the mapping from names to actual files inside an age encrypted lookup table. While the underlying filesystem is flexible, it defaults to using gitfs.

  5. Understand supported secret formats in gopass

    master

    gopass supports several secret formats including Key-Value (AKV), YAML, and legacy formats like MIME and Plain. The parser automatically detects the format based on a specific priority order.

    Important: If a secret contains a --- separator, it will be parsed as YAML even if you intended it to be Key-Value. Use gopass show --noparsing to inspect the raw content if you encounter unexpected parsing behavior.

  6. Verify update security and GPG signatures

    master

    The gopass updater uses TLS to connect to github.com. While it does not use certificate pinning, security is maintained through a multi-layered verification process:

    1. The downloaded binary's SHA-256 checksum is verified against a checksum file.
    2. The checksum file's GPG signature is verified against a hardcoded project public key embedded in the gopass binary.

    This ensures that even if a Man-in-the-Middle (MitM) attack occurs via a compromised CA or a malicious HTTP proxy, a malicious binary cannot be substituted without the project's GPG signing key.

  7. Use the fs storage backend

    master
    The fs backend is the simplest storage backend available in gopass. It stores data directly on the filesystem without any Revision Control System (RCS) support. It is primarily intended for testing purposes or very simple use cases where versioning and synchronization are not required.

  8. Use the experimental jjfs storage backend

    master
    The jjfs storage backend is an EXPERIMENTAL implementation that uses JJ (Jujutsu) / Git. It is intended as an example of how a non-git backend can be implemented and is not well tested. Use it with caution in production environments.

  9. Understand the gopass architecture and core concepts

    master
    At its core, gopass manages directories known as stores or mounts. These directories contain GPG-encrypted text files. The tool handles the encryption and decryption processes transparently when you access these files. It also uses heuristics to parse file content to support various operations on the stored data.

  11. Understand gopass backend architecture

    master

    gopass uses a pluggable architecture for two main types of backends:

    1. Storage and Revision Control System (storage): Defines how data is stored on disk and how version control (RCS) is handled.
    2. Encryption (crypto): Defines how the data is encrypted and decrypted.

    Note that backend names and responsibilities are currently unstable and subject to change.

  12. Batch bootstrap gopass for teams

    master

    You can use gopass in a fully scripted mode to bootstrap a shared store for a team.

    1. The first user initializes the store and pushes it to a remote using the --create flag.
    2. Subsequent team members initialize their local setup by cloning the existing remote without the --create flag.