lib.ec.secret_store.TarGpg: Add the write path #147
2026-10-17
lib.ec.secret_store.TarGpg: Add the write path
All checks were successful
CI / Packaging - Kali Linux (pull_request) Successful in 4m32s
CI / Packaging - OpenSUSE Tumbleweed (pull_request) Successful in 4m52s
CI / Packaging test (pull_request) Successful in 0s
CI / Packaging - Kali Linux (push) Successful in 4m35s
CI / Packaging - OpenSUSE Tumbleweed (push) Successful in 5m17s
CI / Packaging test (push) Successful in 0s
The TarGpg store is read-only: put() and unlink() raise, so the store can be copied from, but not into, and a copy that lands entries and blobs below a host prefix has no tarball target. This matches the way jw-pkg secrets has worked for a long time. Since Stores are now FileContext-backed, a write path can be cleanly implemented, and that's what this commit does. A put rebuilds the tarball: the existing members minus the removed, plus the written one; the result is signed with the recipient from JW_SECRETS_TARGPG_RECIPIENT and written back to the tarball location, which must be a local path. A missing tarball is an empty store, so a put creates it. The put dispatch follows the other stores: a typed entry put replaces the entry with the given serialized content, a key put merges into its entry, creating it if it does not exist yet, and an untyped put below an entry lands a key there, otherwise a blob. unlink() removes the node's member. Signed-off-by: Jan Lindemann <jan@janware.com> Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.1.0