PASSWORD STORE WITH GIT

OVERVIEW

This document describes a minimal and auditable setup for managing
passwords using Password Store (pass) with GPG encryption and Git
version control.

The goal is to provide secure, scriptable, and transparent password
management using standard Unix tools, with optional synchronization
across multiple machines via Git.


DESIGN GOALS

- rely on simple, well-known Unix tools
- keep passwords encrypted at rest using GPG
- use Git only as a transport and history mechanism
- avoid graphical password managers or databases
- keep all data human-readable and auditable


ASSUMPTIONS

- Slackware is running on the system
- GnuPG is installed and functional
- Git is installed and configured
- the user has a working GPG key
- the user has basic familiarity with the command line


INSTALLING PASSWORD STORE

Password Store is installed from SlackBuilds.

Clone the SlackBuild repository and build the package:

    git clone https://git.sr.ht/~r1w1s1/slackbuilds
    cd slackbuilds/password-store

    DOWNLOAD_URL=$(grep '^DOWNLOAD=' password-store.info | \
      awk -F'"' '{print $2}')
    wget "$DOWNLOAD_URL"

    sudo ./password-store.SlackBuild
    sudo installpkg /tmp/password-store-*.t?z


INITIALIZING PASS

If no GPG key exists, generate one:

    gpg --full-generate-key

Select:
- key type: RSA and RSA
- key size: 4096 bits

List available keys:

    gpg --list-keys

Initialize the password store using the desired key ID:

    pass init "your-gpg-key-id"

Basic usage examples:

    pass insert email/account
    pass show email/account
    pass ls
    pass rm email/account


USING PASS WITH GIT

Initialize a Git repository inside the password store:

    pass git init

Add a remote repository:

    pass git remote add origin git@your-git-server.com:pass-store

Generate a password:

    pass generate Amazon/amazon@email.com 21

Insert a password manually:

    pass insert Amazon/other@email.com

Push changes to the remote repository:

    pass git push -u --all

Subsequent updates can be pushed with:

    pass git push

Git tracks encrypted files only; plaintext passwords are never stored.


GPG KEY EXPIRATION NOTES

GPG keys normally expire, which is a recommended security practice.

Setting a key to never expire increases risk: if the key is compromised,
it remains valid indefinitely. Consider this carefully before proceeding.

To modify key expiration:

List keys:

    gpg --list-keys

Edit the key:

    gpg --edit-key YOUR_KEY_ID

Change expiration:

    expire

Enter `0` to disable expiration and confirm.


SYNCING KEYS ACROSS MACHINES

Export the public key:

    gpg --export --armor YOUR_KEY_ID > my-key.asc

On another machine, import it:

    gpg --import my-key.asc
    gpg --list-keys

Ensure the same key ID is used to initialize pass on each system.


GPG AGENT CONFIGURATION

To avoid repeated passphrase prompts, configure gpg-agent.

Create or edit the configuration file:

    vim ~/.gnupg/gpg-agent.conf

Example settings:

    default-cache-ttl 600
    max-cache-ttl 7200
    pinentry-program /usr/bin/pinentry-gtk-2

These settings cache the passphrase for a limited time and use a GTK2
pinentry prompt.

Reload the agent:

    gpgconf --reload gpg-agent


CONCLUSION

Password Store combined with GPG and Git provides a secure, transparent,
and script-friendly solution for managing secrets.

By keeping encryption, storage, and synchronization separate, this setup
avoids complexity while preserving full user control and auditability,
in line with traditional Unix and Slackware principles.


------------------------------------------------------------------

Last Modified: 2026-01-03 05:34:07 UTC