Feedback CLI usage

[Meai]

Hi,
it took me quite a while to understand how to do a successful call and I even had to debug the code to figure out why things weren't working for me. Maybe partially because I tried to do it on windows so some errors like "Program not found" made no sense to me (I had to look in the source code and realize that it means it was trying to find an editor and that was VI and then how to change that, then realize that it doesnt work on Windows and 'vscode --wait' doesnt work either and notepad.exe doesnt work either). Also it seems it requires ctrl+z for input ending instead of ctrl+d on linux(?) as in the docs. The way that I have to write "--input -" was also unintuitive to me, is that really a widely known convention? On Linux there also exists a way to do multi lines where I have to write \ after every newline but it was also always very hard for me to get it done correctly so maybe your way is better anyway but I think it shouldnt default to multiline, it should still allow a simple string input if I dont specify the '-'.

Also when I used the --json option the resulting file wasn't able to be read as a vault file, so I wonder what the point of it is then?

Another point is that you simply take the first certificate found on e.g the github page .keys by default, but I think if someone doesn't specify anything then the default should be that the CLI asks me to enter a number or maybe even let me select from the list because you retrieve them all anyway. Otherwise the result will very often be that I'll have to specify the key by index but indices can change all the time, it's very brittle I think. The ssh-ed25519 public keys seem to be so short that maybe it would even make sense to simply let people paste the key instead of reading it from an external location, or maybe let me paste how a key starts.. some kind of way that is better than selecting by index because who knows.. users can always change their keys on github around and then I might select the wrong one. The UX is: How do we collaboratively agree that I'll share a secret with you via your github keys? The other person would have to tell me: Hey, please pick index 7. I think it's just too brittle, maybe you have a better idea to improve this?

But my main point is that in my opinion the default CLI could or should be as simple as this (perhaps with a ssh-vault-config.json that would specify the rest of the options in the same folder):
ssh-vault encrypt "mysecret" // print to stdout
ssh-vault decrypt "pasted ssh text block" // print to stdout

Thanks for a great tool, I think it's really mostly the usability that was the issue for me when I tried it!

[nbari]

Hi @Meai, thanks for the feedback,

You can change the editor by using the env var EDITOR (#58)

Regarding the key to use, you can pass only the index: (but also keep in mind that no matter what key you use the recipient should know/have his keys)

To get all your indexes:

$ ssh-vault fingerprint -u Meai
ID: 1 Type: ssh-rsa Comment:
      SHA256:lK2GqdEJ1rLHPRDtb9FYW6J5IEu7qzQFo+fk3WOa09o
      MD5 93:44:35:ca:27:88:42:e6:21:c6:cd:00:22:af:ac:0a

ID: 2 Type: ssh-rsa Comment:
      SHA256:R0kQuw4/AgKENYBlun6iTgkKKeA0NlEtqTeL6PHM434
      MD5 44:b2:3b:55:65:87:59:40:a7:10:90:4e:c7:be:33:13

ID: 3 Type: ssh-ed25519 Comment:
      SHA256:e91UiVaqjNhgHrS6iZyXvZ/RJ5gbiTD0R7ZAza/v1xE

ID: 4 Type: ssh-ed25519 Comment:
      SHA256:1ivp/z/owhqhL/liV2T/uQY2X5CGl+9mZWxA56pCmQQ

To send a message using your key ID 3:

$ echo "hi" | ssh-vault create -u Meai -k 3
SSH-VAULT;CHACHA20-POLY1305;SHA256:e91UiVaqjNhgHrS6iZyXvZ/RJ5gbi
TD0R7ZAza/v1xE;sXp48y0qKFOE23vU4B4L3dAw1/a0lYFMoV3J/SojXjg=;BuHW
SpFqpzA+csdrwdISuMArbA/agzANrdRPwc9nHbOune8jF69k3Eg9CgjjKO/x0AFb
Ib7el6z8/NJT;7WlN1kfmO85sSYWzkE7s1nglTlKWi9i5A4nfhiDGsA==%

the option --json is because some use the output from an API (mainly when doing CI/CD)

If just only need to share a secret fast without even knowing the keys you can use:

$  echo "hi" | ssh-vault create -u new

That will return something you can share like:

echo "SSH-VAULT;CHACHA20-POLY1305;SHA256:f9QIuGOSqfXyky79XSi3mZZ2H2ZBe
+4Qx2Fw0znZ3Hc;3qZRpQxVNXTVl4+GzNbUbIMCZ7+suzmY/z9udAioaD0=;q/IB
XMDHRkF5OjhI28JVBStd02Tgbh1a2r7PD/oFZORd7SRoQMYWMxG5f+XXiM3kcMPg
ZU+6P4nxzkgp;2QHiybrY4FzQQugU81C7LZvT87PHONWmQpUOZb7VTQ==" | ssh-vault view -k https://ssh-keys.online/key/9bzJVdyPhv6prejZi3q4XQpC21sq7pZuKV7vmDsDdh6N

Or depending on your keys (without a passphrase) you could do:

$ echo "hi" | ssh-vault create -k ./id_rsa.pub | ssh-vault view -k ./id_rsa
hi

Or check the 1password op example: https://ssh-vault.com/view.html#_1password