.git
.DS_Store

**/secret/*
Hello World

#!/bin/sh
set -ex
# 改行以外の空白で文字列を分割しない
IFS='
'
if ! gpg=$(command -v gpg2) >/dev/null; then
  echo "$0 requires gpg2" >&2
  false
fi
# if ! sha256sum=$(command -v sha256sum) >/dev/null; then
#   echo "$0 requires sha256sum" >&2
#   false
# fi
if [ -f .encrypt/master_key.gpg ]; then
  echo "No master key in repositry. Repositry not initialized for pijul-encrypt" >&2
  false
fi
encrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --passphrase-fd 0 \
      --sign --encrypt-to-default-key --symmetric "$path"
}
# decrypt() {
#   path=$1
#   $gpg --decrypt .encrypt.d/master_key.gpg |
#     $gpg --batch --output - --pinentry-mode loopback --passphrase-fd 0 \
#       --decrypt "$path"
# }
rules=$(cat .encrypt)
# globを展開、マッチするディレクトリの中身も全部マッチしたいのでfindを噛ませる
# shellcheck disable=SC2086
secrets_in_worktree=$(find $(cat .encrypt) -type f)
: "↓debug secrets_in_worktree↓
$secrets_in_worktree"
# pijulが記録しているパスのうち`.encrypt`にマッチするもの
secrets_in_tracked=$(printf '%s\n' $secrets_in_worktree $(pijul list) | sort | uniq -d)
: "↓debug secrets_in_tracked↓
$secrets_in_tracked"
# .encryptにマッチするパスをremoveして`.gpg`をつけてaddし直す
for path in $secrets_in_tracked; do
  case $path in
  *.gpg)
    break
    ;;
  *)
    pijul remove "$path" # 秘密のファイルはrecordしてはいけない
    touch "$path.gpg"
    pijul add "$path.gpg"
    ;;
  esac
done
# # `.gpg`で終わるファイルを更新
# for path in $(pijul list); do
#   case $path in
#   .encrypt.d/master_key.gpg) ;;
#   *.gpg)
#     if [ -f "$path" ]; then
#       rm "$path"
#     fi
#     encrypt "${path%%.gpg}"
#     ;;
#   esac
# done

[hooks]
record = ['sh ./.pijul/hook-encrypt.sh']

.git
.DS_Store

**/secret/*
Hello World