add flag to print credentials as csv

.drone.yml

@@ -3,27 +3,32 @@ name: default
 
 steps:
  - name: fmt
-   image: rust:1.43.0
+   image: rust:1.37.0
    commands:
      -  rustup component add rustfmt
      -  cargo fmt --all -- --check
  - name: test
-   image: ubuntu:focal
+   image: rust:1.37.0
-   environment:
-    DEBIAN_FRONTEND: noninteractive
    commands:
-    - apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev 
+    - apt update && apt install -y libcryptsetup-dev libkeyutils-dev
-    - cargo test --locked
+    - cargo test
- - name: publish
+
-   image: ubuntu:focal
+ - name: build
-   environment:
+   image: rust:1.37.0
-    DEBIAN_FRONTEND: noninteractive
-    CARGO_REGISTRY_TOKEN:
-     from_secret: cargo_tkn
    commands:
-    - grep -E 'version ?= ?"${DRONE_TAG}"' -i Cargo.toml || (printf "incorrect crate/tag version" && exit 1)
+    - apt update && apt install -y libcryptsetup-dev libkeyutils-dev
-    - apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev 
+    - cargo install -f --path . --root .
-    - cargo package --all-features
+   when:
-    - cargo publish --all-features
+    event: tag
+ - name: publish
+   image: plugins/github-release
+   settings:
+     api_key:
+      from_secret: github_release
+     files:
+      - bin/fido2luks
+     checksum:
+      - md5
+      - sha256
    when:
     event: tag    

.gitignore

@@ -2,7 +2,3 @@
 **/*.rs.bk
 .idea/
 *.iml
-fido2luks.bash
-fido2luks.elv
-fido2luks.fish
-fido2luks.zsh

Cargo.lock

@@ -1,25 +1,10 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-[[package]]
-name = "addr2line"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b6a2d3371669ab3ca9797670853d61402b03d0b4b9ebf33d677dfa720203072"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee2a4ec343196209d6594e19543ae87a39f96d5534d7174822a3ad825dd6ed7e"
-
 [[package]]
 name = "aho-corasick"
-version = "0.7.13"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "043164d8ba5c4c3035fec9bbee8647c0261d788f3474306f93bb65901cae0e86"
+checksum = "8716408b8bc624ed7f65d223ddb9ac2d044c0547b6fa4b0d554f3a9540496ada"
 dependencies = [
  "memchr",
 ]
@@ -52,29 +37,37 @@ checksum = "1d49d90015b3c36167a20fe2810c5cd875ad504b39cff3d4eae7977e6b7c1cb2"
 
 [[package]]
 name = "autocfg"
-version = "1.0.1"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
+checksum = "f8aac770f1885fd7e387acedd76065302551364496e46b3dd00860b2f8359b9d"
 
 [[package]]
 name = "backtrace"
-version = "0.3.50"
+version = "0.3.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46254cf2fdcdf1badb5934448c1bcbe046a56537b3987d96c51a7afc5d03f293"
+checksum = "b1e692897359247cc6bb902933361652380af0f1b7651ae5c5013407f30e109e"
 dependencies = [
- "addr2line",
+ "backtrace-sys",
  "cfg-if",
  "libc",
- "miniz_oxide",
- "object",
  "rustc-demangle",
 ]
 
 [[package]]
-name = "bindgen"
+name = "backtrace-sys"
-version = "0.54.0"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66c0bb6167449588ff70803f4127f0684f9063097eca5016f37eb52b92c2cf36"
+checksum = "78848718ee1255a2485d1309ad9cdecfc2e7d0362dd11c6829364c6b35ae1bc7"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.53.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb26d6a69a335b8cb0e7c7e9775cd5666611dc50a37177c3f2cedcfc040e8c8"
 dependencies = [
  "bitflags",
  "cexpr",
@@ -86,8 +79,8 @@ dependencies = [
  "lazycell",
  "log",
  "peeking_take_while",
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
  "regex",
  "rustc-hash",
  "shlex",
@@ -100,18 +93,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
 
-[[package]]
-name = "bstr"
-version = "0.2.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31accafdb70df7871592c058eca3985b71104e15ac32f64706022c58867da931"
-dependencies = [
- "lazy_static",
- "memchr",
- "regex-automata",
- "serde",
-]
-
 [[package]]
 name = "byteorder"
 version = "1.3.4"
@@ -130,9 +111,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.60"
+version = "1.0.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef611cc68ff783f18535d77ddd080185275713d852c4f5cbb6122c462a7a825c"
+checksum = "c3d87b23d6a92cd03af510a5ade527033f6aa6fa92161e2d5863a907d4c5e31d"
 
 [[package]]
 name = "cexpr"
@@ -162,9 +143,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "2.33.3"
+version = "2.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
+checksum = "5067f5bb2d80ef5d68b4c87db81601f0b75bca627bc2ef76b141d7b846a3c6d9"
 dependencies = [
  "ansi_term",
  "atty",
@@ -200,9 +181,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.4.4"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b153fe7cbef478c567df0f972e02e6d736db11affe43dfc9c56a9374d1adfb87"
+checksum = "cced8691919c02aac3cb0a1bc2e9b73d89e832bf9a06fc579d4e71b68a2da061"
 dependencies = [
  "crossbeam-utils",
  "maybe-uninit",
@@ -225,7 +206,7 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "058ed274caafc1f60c4997b5fc07bf7dc7cca454af7c6e81edffe5f33f70dace"
 dependencies = [
- "autocfg 1.0.1",
+ "autocfg 1.0.0",
  "cfg-if",
  "crossbeam-utils",
  "lazy_static",
@@ -236,13 +217,12 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-queue"
-version = "0.2.3"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "774ba60a54c213d409d5353bda12d49cd68d14e45036a285234c8d6f91f92570"
+checksum = "c695eeca1e7173472a32221542ae469b3e9aac3a4fc81f7696bcad82029493db"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
- "maybe-uninit",
 ]
 
 [[package]]
@@ -251,24 +231,11 @@ version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3c7c73a2d1e9fc0886a08b93e98eb643461230d5f1925e4036204d5f2e261a8"
 dependencies = [
- "autocfg 1.0.1",
+ "autocfg 1.0.0",
  "cfg-if",
  "lazy_static",
 ]
 
-[[package]]
-name = "csv"
-version = "1.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00affe7f6ab566df61b4be3ce8cf16bc2576bca0963ceb0955e45d514bf9a279"
-dependencies = [
- "bstr",
- "csv-core",
- "itoa",
- "ryu",
- "serde",
-]
-
 [[package]]
 name = "csv-core"
 version = "0.1.10"
@@ -280,14 +247,14 @@ dependencies = [
 
 [[package]]
 name = "ctap_hmac"
-version = "0.4.3"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ccc28f298181e943187fa63805e652bc4806ad43708beebd22c230fbe0baa3"
+checksum = "c5fec79b66e3a7bc6a7ace0f4c98f0748892b36d3c5c317fadfce0344fd185dc"
 dependencies = [
  "byteorder",
  "cbor-codec",
  "crossbeam",
- "csv",
+ "csv-core",
  "derive_builder",
  "failure",
  "failure_derive",
@@ -296,8 +263,6 @@ dependencies = [
  "rand 0.6.5",
  "ring",
  "rust-crypto",
- "serde",
- "serde_derive",
  "untrusted",
 ]
 
@@ -319,10 +284,10 @@ checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
 dependencies = [
  "fnv",
  "ident_case",
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
  "strsim 0.9.3",
- "syn 1.0.41",
+ "syn 1.0.18",
 ]
 
 [[package]]
@@ -332,8 +297,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
 dependencies = [
  "darling_core",
- "quote 1.0.7",
+ "quote 1.0.3",
- "syn 1.0.41",
+ "syn 1.0.18",
 ]
 
 [[package]]
@@ -344,9 +309,9 @@ checksum = "a2658621297f2cf68762a6f7dc0bb7e1ff2cfd6583daef8ee0fed6f7ec468ec0"
 dependencies = [
  "darling",
  "derive_builder_core",
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
- "syn 1.0.41",
+ "syn 1.0.18",
 ]
 
 [[package]]
@@ -356,16 +321,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2791ea3e372c8495c0bc2033991d76b512cd799d07491fbd6890124db9458bef"
 dependencies = [
  "darling",
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
- "syn 1.0.41",
+ "syn 1.0.18",
 ]
 
 [[package]]
 name = "either"
-version = "1.6.1"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
+checksum = "bb1f6b1ce1c140482ea30ddd3335fc0024ac7ee112895426e0a629a6c20adfe3"
 
 [[package]]
 name = "env_logger"
@@ -382,9 +347,9 @@ dependencies = [
 
 [[package]]
 name = "failure"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d32e9bd16cc02eae7db7ef620b392808b89f6a5e16bb3497d159c6b92a0f4f86"
+checksum = "b8529c2421efa3066a5cbd8063d2244603824daccb6936b079010bb2aa89464b"
 dependencies = [
  "backtrace",
  "failure_derive",
@@ -392,19 +357,19 @@ dependencies = [
 
 [[package]]
 name = "failure_derive"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
+checksum = "030a733c8287d6213886dd487564ff5c8f6aae10278b3588ed177f9d18f8d231"
 dependencies = [
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
- "syn 1.0.41",
+ "syn 1.0.18",
  "synstructure",
 ]
 
 [[package]]
 name = "fido2luks"
-version = "0.2.14"
+version = "0.2.9"
 dependencies = [
  "ctap_hmac",
  "failure",
@@ -420,9 +385,9 @@ dependencies = [
 
 [[package]]
 name = "fnv"
-version = "1.0.7"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+checksum = "2fad85553e09a6f881f739c29f0b00b0f01357c743266d478b68951ce23285f3"
 
 [[package]]
 name = "fuchsia-cprng"
@@ -436,12 +401,6 @@ version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f5f3913fa0bfe7ee1fd8248b6b9f42a5af4b9d65ec2dd2c3c26132b950ecfc2"
 
-[[package]]
-name = "gimli"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaf91faf136cb47367fa430cd46e37a788775e7fa104f8b4bcb3861dc389b724"
-
 [[package]]
 name = "glob"
 version = "0.3.0"
@@ -459,9 +418,9 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.1.16"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c30f6d0bc6b00693347368a67d41b58f2fb851215ff1da49e90fe2c5c667151"
+checksum = "61565ff7aaace3525556587bd2dc31d4a07071957be715e63ce7b1eccf51a8f4"
 dependencies = [
  "libc",
 ]
@@ -489,9 +448,9 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "itoa"
-version = "0.4.6"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc6f3ad7b9d11a0c00842ff8de1b60ee58661048eb8049ed33c73594f359d7e6"
+checksum = "b8b7a7c0c47db5545ed3fef7468ee7bb5b74691498139e4b3f6a20685dc6dd8e"
 
 [[package]]
 name = "lazy_static"
@@ -501,21 +460,21 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "lazycell"
-version = "1.3.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+checksum = "b294d6fa9ee409a054354afc4352b0b9ef7ca222c69b8812cbea9e7d2bf3783f"
 
 [[package]]
 name = "libc"
-version = "0.2.77"
+version = "0.2.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f96b10ec2560088a8e76961b00d47107b3a625fecb76dedb29ee7ccbf98235"
+checksum = "99e85c08494b21a9054e7fe1374a732aeadaff3980b6990b94bfd3a70f690005"
 
 [[package]]
 name = "libcryptsetup-rs"
-version = "0.4.2"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9042dbf4b7e4309494949696496e230c9052af64559d3441627d639898c172c"
+checksum = "38cd24132ee0239515bc895782f65ab3e382a0f78e7cee30417159e5c6f81b6b"
 dependencies = [
  "either",
  "libc",
@@ -528,9 +487,9 @@ dependencies = [
 
 [[package]]
 name = "libcryptsetup-rs-sys"
-version = "0.1.4"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b75a2b946509fb39fdb4b232c973166da14be373d09a43eb36b82f775d8244e"
+checksum = "0c605998e81e2a99c1f4c5d0be45ea1df6f1dc45dc64f5ca2847b0dbebf49ae7"
 dependencies = [
  "bindgen",
  "cc",
@@ -550,9 +509,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.11"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
+checksum = "14b6052be84e6b71ab17edffc2eeabf5c2c3ae1fdb464aae35ac50c67a44e1f7"
 dependencies = [
  "cfg-if",
 ]
@@ -571,28 +530,18 @@ checksum = "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400"
 
 [[package]]
 name = "memoffset"
-version = "0.5.6"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
+checksum = "b4fc2c02a7e374099d4ee95a193111f72d2110197fe200272371758f6c3643d8"
 dependencies = [
- "autocfg 1.0.1",
+ "autocfg 1.0.0",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c60c0dfe32c10b43a144bad8fc83538c52f58302c92300ea7ec7bf7b38d5a7b9"
-dependencies = [
- "adler",
- "autocfg 1.0.1",
 ]
 
 [[package]]
 name = "nom"
-version = "5.1.2"
+version = "5.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffb4262d26ed83a1c0a33a38fe2bb15797329c85770da05e6b828ddb782627af"
+checksum = "0b471253da97532da4b61552249c521e01e736071f71c1a4f7ebbfbf0a06aad6"
 dependencies = [
  "memchr",
  "version_check",
@@ -611,19 +560,13 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.12"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac267bcc07f48ee5f8935ab0d24f316fb722d7a1292e2913f0cc196b29ffd611"
+checksum = "c62be47e61d1842b9170f0fdeec8eba98e60e90e5446449a0545e5152acd7096"
 dependencies = [
- "autocfg 1.0.1",
+ "autocfg 1.0.0",
 ]
 
-[[package]]
-name = "object"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5"
-
 [[package]]
 name = "peeking_take_while"
 version = "0.1.2"
@@ -632,31 +575,33 @@ checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.18"
+version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d36492546b6af1463394d46f0c834346f31548646f6ba10849802c9c9a27ac33"
+checksum = "05da548ad6865900e60eaba7f589cc0783590a92e940c26953ff81ddbab2d677"
 
 [[package]]
 name = "proc-macro-error"
-version = "1.0.4"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+checksum = "98e9e4b82e0ef281812565ea4751049f1bdcdfccda7d3f459f2e138a40c08678"
 dependencies = [
  "proc-macro-error-attr",
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
- "syn 1.0.41",
+ "syn 1.0.18",
  "version_check",
 ]
 
 [[package]]
 name = "proc-macro-error-attr"
-version = "1.0.4"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+checksum = "4f5444ead4e9935abd7f27dc51f7e852a0569ac888096d5ec2499470794e2e53"
 dependencies = [
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
+ "syn 1.0.18",
+ "syn-mid",
  "version_check",
 ]
 
@@ -671,11 +616,11 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.21"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36e28516df94f3dd551a587da5357459d9b36d945a7c37c3557928c1c2ff2a2c"
+checksum = "df246d292ff63439fea9bc8c0a270bed0e390d5ebd4db4ba15aba81111b5abe3"
 dependencies = [
- "unicode-xid 0.2.1",
+ "unicode-xid 0.2.0",
 ]
 
 [[package]]
@@ -695,11 +640,11 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.7"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
+checksum = "2bdc6c187c65bca4260c9011c9e3132efe4909da44726bad24cf7572ae338d7f"
 dependencies = [
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
 ]
 
 [[package]]
@@ -842,9 +787,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.3.9"
+version = "1.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3780fcf44b193bc4d09f36d2a3c87b251da4a046c87795a0d35f4f927ad8e6"
+checksum = "a6020f034922e3194c711b82a627453881bc4682166cabb07134a10c26ba7692"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -852,20 +797,11 @@ dependencies = [
  "thread_local",
 ]
 
-[[package]]
-name = "regex-automata"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae1ded71d66a4a97f5e961fd0cb25a5f366a42a41570d16a763a69c092c26ae4"
-dependencies = [
- "byteorder",
-]
-
 [[package]]
 name = "regex-syntax"
-version = "0.6.18"
+version = "0.6.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26412eb97c6b088a6997e05f69403a802a92d520de2f8e63c2b65f9e0f47c4e8"
+checksum = "7fe5bd57d1d7414c6b5ed48563a2c855d995ff777729dcd91c369ec7fea395ae"
 
 [[package]]
 name = "ring"
@@ -922,9 +858,9 @@ checksum = "dcf128d1287d2ea9d80910b5f1120d0b8eede3fbf1abe91c40d39ea7d51e6fda"
 
 [[package]]
 name = "ryu"
-version = "1.0.5"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71d301d4193d031abdd79ff7e3dd721168a9572ef3fe51a1517aba235bd8f86e"
+checksum = "ed3d612bc64430efeb3f7ee6ef26d590dce0c43249217bddc62112540c7941e1"
 
 [[package]]
 name = "scopeguard"
@@ -949,26 +885,26 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.116"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96fe57af81d28386a513cbc6858332abc6117cfdb5999647c6444b8f43a370a5"
+checksum = "36df6ac6412072f67cf767ebbde4133a5b2e88e76dc6187fa7104cd16f783399"
 
 [[package]]
 name = "serde_derive"
-version = "1.0.116"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f630a6370fd8e457873b4bd2ffdae75408bc291ba72be773772a4c2a065d9ae8"
+checksum = "9e549e3abf4fb8621bd1609f11dfc9f5e50320802273b12f3811a67e6716ea6c"
 dependencies = [
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
- "syn 1.0.41",
+ "syn 1.0.18",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.57"
+version = "1.0.51"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "164eacbdb13512ec2745fb09d51fd5b22b0d65ed294a1dcf7285a360c80a675c"
+checksum = "da07b57ee2623368351e9a0488bb0b261322a15a6e0ae53e243cbdc0f4208da9"
 dependencies = [
  "itoa",
  "ryu",
@@ -995,9 +931,9 @@ checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
 
 [[package]]
 name = "structopt"
-version = "0.3.18"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33f6461027d7f08a13715659b2948e1602c31a3756aeae9378bfe7518c72e82"
+checksum = "863246aaf5ddd0d6928dfeb1a9ca65f505599e4e1b399935ef7e75107516b4ef"
 dependencies = [
  "clap",
  "lazy_static",
@@ -1006,15 +942,15 @@ dependencies = [
 
 [[package]]
 name = "structopt-derive"
-version = "0.4.11"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c92e775028122a4b3dd55d58f14fc5120289c69bee99df1d117ae30f84b225c9"
+checksum = "d239ca4b13aee7a2142e6795cbd69e457665ff8037aed33b3effdc430d2f927a"
 dependencies = [
  "heck",
  "proc-macro-error",
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
- "syn 1.0.41",
+ "syn 1.0.18",
 ]
 
 [[package]]
@@ -1030,25 +966,36 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "1.0.41"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6690e3e9f692504b941dc6c3b188fd28df054f7fb8469ab40680df52fdcc842b"
+checksum = "410a7488c0a728c7ceb4ad59b9567eb4053d02e8cc7f5c0e0eeeb39518369213"
 dependencies = [
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
- "unicode-xid 0.2.1",
+ "unicode-xid 0.2.0",
+]
+
+[[package]]
+name = "syn-mid"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7be3539f6c128a931cf19dcee741c1af532c7fd387baa739c03dd2e96479338a"
+dependencies = [
+ "proc-macro2 1.0.10",
+ "quote 1.0.3",
+ "syn 1.0.18",
 ]
 
 [[package]]
 name = "synstructure"
-version = "0.12.4"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b834f2d66f734cb897113e34aaff2f1ab4719ca946f9a7358dba8f8064148701"
+checksum = "67656ea1dc1b41b1451851562ea232ec2e5a80242139f7e679ceccfb5d61f545"
 dependencies = [
- "proc-macro2 1.0.21",
+ "proc-macro2 1.0.10",
- "quote 1.0.7",
+ "quote 1.0.3",
- "syn 1.0.41",
+ "syn 1.0.18",
- "unicode-xid 0.2.1",
+ "unicode-xid 0.2.0",
 ]
 
 [[package]]
@@ -1080,12 +1027,11 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.1.44"
+version = "0.1.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+checksum = "ca8a50ef2360fbd1eeb0ecd46795a87a19024eb4b53c5dc916ca1fd95fe62438"
 dependencies = [
  "libc",
- "wasi",
  "winapi",
 ]
 
@@ -1097,9 +1043,9 @@ checksum = "e83e153d1053cbb5a118eeff7fd5be06ed99153f00dbcd8ae310c5fb2b22edc0"
 
 [[package]]
 name = "unicode-width"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
+checksum = "caaa9d531767d1ff2150b9332433f32a24622147e5ebb1f26409d5da67afd479"
 
 [[package]]
 name = "unicode-xid"
@@ -1109,9 +1055,9 @@ checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
 
 [[package]]
 name = "unicode-xid"
-version = "0.2.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
+checksum = "826e7639553986605ec5979c7dd957c7895e93eabed50ab2ffa7f6128a75097c"
 
 [[package]]
 name = "untrusted"
@@ -1130,21 +1076,15 @@ dependencies = [
 
 [[package]]
 name = "vec_map"
-version = "0.8.2"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+checksum = "05c78687fb1a80548ae3250346c3db86a80a7cdd77bda190189f2d0a0987c81a"
 
 [[package]]
 name = "version_check"
-version = "0.9.2"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5a972e5669d67ba988ce3dc826706fb0a8b01471c088cb0b6110b805cc36aed"
+checksum = "078775d0255232fb988e6fccf26ddc9d1ac274299aaedcedce21c6f72cc533ce"
-
-[[package]]
-name = "wasi"
-version = "0.10.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
 
 [[package]]
 name = "which"
@@ -1157,9 +1097,9 @@ dependencies = [
 
 [[package]]
 name = "winapi"
-version = "0.3.9"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+checksum = "8093091eeb260906a183e6ae1abdba2ef5ef2257a21801128899c3fc699229c6"
 dependencies = [
  "winapi-i686-pc-windows-gnu",
  "winapi-x86_64-pc-windows-gnu",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fido2luks"
-version = "0.2.14"
+version = "0.2.9"
 authors = ["shimunn <shimun@shimun.net>"]
 edition = "2018"
 
@@ -11,7 +11,7 @@ repository = "https://github.com/shimunn/fido2luks"
 readme = "README.md"
 keywords = ["luks", "fido2", "u2f"]
 categories = ["command-line-utilities"]
-license = "MPL-2.0"
+license-file = "LICENSE"
 
 [dependencies]
 ctap_hmac = { version="0.4.2", features = ["request_multiple"] }
@@ -25,31 +25,9 @@ serde_json = "1.0.51"
 serde_derive = "1.0.106"
 serde = "1.0.106"
 
-[build-dependencies]
-ctap_hmac = { version="0.4.2", features = ["request_multiple"] }
-hex = "0.3.2"
-ring = "0.13.5"
-failure = "0.1.5"
-rpassword = "4.0.1"
-libcryptsetup-rs = "0.4.1"
-structopt = "0.3.2"
-
 [profile.release]
 lto = true
 opt-level = 'z'
 panic = 'abort'
 incremental = false
 overflow-checks = false
-
-[package.metadata.deb]
-depends = "$auto, cryptsetup"
-build-depends = "libclang-dev, libcryptsetup-dev"
-extended-description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator"
-assets = [
-    ["target/release/fido2luks", "usr/bin/", "755"],
-    ["fido2luks.bash", "usr/share/bash-completion/completions/fido2luks", "644"],
-    ["initramfs-tools/keyscript.sh", "/lib/cryptsetup/scripts/fido2luks", "755" ],
-    ["initramfs-tools/hook/fido2luks.sh", "etc/initramfs-tools/hooks/", "755" ],
-    ["initramfs-tools/fido2luks.conf", "etc/", "644"],
-]
-conf-files = ["/etc/fido2luks.conf"]

PKGBUILD

@@ -1,25 +0,0 @@
-# Maintainer: shimunn <shimun@shimun.net>
-pkgname=fido2luks
-pkgver=0.2.12
-pkgrel=1
-makedepends=('rust' 'cargo' 'cryptsetup' 'clang')
-depends=('cryptsetup')
-arch=('i686' 'x86_64' 'armv6h' 'armv7h')
-pkgdesc="Decrypt your LUKS partition using a FIDO2 compatible authenticator"
-url="https://github.com/shimunn/fido2luks"
-license=('MPL-2.0')
-
-pkgver() {
-	# Use tag version if possible otherwise concat project version and git ref
-	git describe --exact-match --tags HEAD 2> /dev/null || \
-		echo "$(cargo pkgid | cut -d'#' -f2).$(git describe --always)"
-}
-
-build() {
-    cargo build --release --locked --all-features --target-dir=target
-}
-
-package() {
-    install -Dm 755 target/release/${pkgname} -t "${pkgdir}/usr/bin"
-    install -Dm 644 ../fido2luks.bash "${pkgdir}/usr/share/bash-completion/completions/fido2luks"
-}

README.md

@@ -1,8 +1,8 @@
 # fido2luks [![Crates.io Version](https://img.shields.io/crates/v/fido2luks.svg)](https://crates.io/crates/fido2luks)
 
-This will allow you to unlock your LUKS encrypted disk with an FIDO2 compatible key.
+This will allow you to unlock your luks encrypted disk with an fido2 compatible key
 
-Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T
+Note: This has only been tested under Fedora 31 using a Solo Key, Trezor Model T
 
 ## Setup
 
@@ -65,7 +65,7 @@ cp /usr/bin/fido2luks /boot/fido2luks/
 cp /etc/fido2luks.conf /boot/fido2luks/
 ```
 
-## Testing
+## Test
 
 Just reboot and see if it works, if that's the case you should remove your old less secure password from your LUKS header:
 
@@ -96,13 +96,6 @@ set -a
 
 Then add the new secret to each device and update dracut afterwards `dracut -f`
 
-### Multiple keys
-
-Additional/backup keys are supported, Multiple fido2luks credentials can be added to your /etc/fido2luks.conf file. Credential tokens are comma separated.
-```
-FIDO2LUKS_CREDENTIAL_ID=<CREDENTIAL1>,<CREDENTIAL2>,<CREDENTIAL3>
-```
-
 ## Removal
 
 Remove `rd.luks.2fa` from `GRUB_CMDLINE_LINUX` in /etc/default/grub
@@ -114,17 +107,3 @@ sudo -E fido2luks -i replace-key /dev/disk/by-uuid/<DISK_UUID>
 
 sudo rm -rf /usr/lib/dracut/modules.d/96luks-2fa /etc/dracut.conf.d/luks-2fa.conf /etc/fido2luks.conf
 ```
-
-## License
-
-Licensed under
-
- * Mozilla Public License 2.0, ([LICENSE-MPL](LICENSE-MPL) or https://www.mozilla.org/en-US/MPL/2.0/)
-
-### Contribution
-
-Unless you explicitly state otherwise, any contribution intentionally
-submitted for inclusion in the work by you, as defined in the MPL 2.0
-license, shall be licensed as above, without any additional terms or
-conditions.
-

build.rs

@@ -1,24 +0,0 @@
-#![allow(warnings)]
-#[macro_use]
-extern crate failure;
-extern crate ctap_hmac as ctap;
-
-#[path = "src/cli_args/mod.rs"]
-mod cli_args;
-#[path = "src/error.rs"]
-mod error;
-#[path = "src/util.rs"]
-mod util;
-
-use cli_args::Args;
-use std::env;
-use std::str::FromStr;
-use structopt::clap::Shell;
-use structopt::StructOpt;
-
-fn main() {
-    // generate completion scripts, zsh does panic for some reason
-    for shell in Shell::variants().iter().filter(|shell| **shell != "zsh") {
-        Args::clap().gen_completions(env!("CARGO_PKG_NAME"), Shell::from_str(shell).unwrap(), ".");
-    }
-}

initramfs-tools/Makefile

@@ -1,11 +0,0 @@
-.PHONY: install
-install:
-	chmod +x hook/fido2luks.sh keyscript.sh
-	cp -f hook/fido2luks.sh /etc/initramfs-tools/hooks/
-	mkdir -p /usr/share/fido2luks
-	cp -f keyscript.sh /lib/cryptsetup/scripts/fido2luks
-	update-initramfs -u
-remove:
-	sh -c "grep 'keyscript=fido2luks' -i /etc/crypttab && ( echo 'ERROR: your system is still setup to use fido2luks during boot' && exit 1) || exit 0"
-	rm /etc/initramfs-tools/hooks/fido2luks.sh /lib/cryptsetup/scripts/fido2luks
-	update-initramfs -u

initramfs-tools/README.md

@@ -1,34 +0,0 @@
-## Initramfs-tools based systems(Ubuntu and derivatives)
-
-For easiest installation [download and install the precompiled deb from releases.](https://github.com/shimunn/fido2luks/releases). However it is possible to build from source via the instructions on the main readme.
-
-```
-sudo -s
-
-# Insert FIDO key.
-fido2luks credential
-# Tap FIDO key
-# Copy returned string <CREDENTIAL>
-
-nano /etc/fido2luks.conf
-# Insert <CREDENTIAL> 
-# FIDO2LUKS_CREDENTIAL_ID=<CREDENTIAL> 
-
-set -a
-. /etc/fido2luks.conf
-fido2luks -i add-key /dev/<LUKS PARTITION>
-# Current password: <Any current LUKS password>
-# Password: <Password used as FIDO challange>
-# Tap FIDO key
-
-nano /etc/crypttab
-# Append to end ",discard,initramfs,keyscript=fido2luks"
-# E.g. sda6_crypt UUID=XXXXXXXXXX none luks,discard,initramfs,keyscript=fido2luks
-
-update-initramfs -u
-
-
-```
-
-[Recording showing part of the setup](https://shimun.net/fido2luks/setup.svg)
-

initramfs-tools/fido2luks.conf

@@ -1,3 +0,0 @@
-FIDO2LUKS_SALT=Ask
-#FIDO2LUKS_PASSWORD_HELPER="/usr/bin/plymouth ask-for-password --prompt 'FIDO2 password salt'"
-FIDO2LUKS_CREDENTIAL_ID=

initramfs-tools/hook/fido2luks.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-
-case "$1" in
-prereqs)
-	echo ""
-	exit 0
-	;;
-
-esac
-
-. /usr/share/initramfs-tools/hook-functions
-copy_file config /etc/fido2luks.conf /etc/fido2luks.conf
-copy_exec /usr/bin/fido2luks
-exit 0

initramfs-tools/keyscript.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-set -a
-. /etc/fido2luks.conf
-
-if [ -z "$FIDO2LUKS_PASSWORD_HELPER" ]; then
-	MSG="FIDO2 password salt for $CRYPTTAB_NAME"
-	export FIDO2LUKS_PASSWORD_HELPER="plymouth ask-for-password --prompt '$MSG'"
-fi
-
-if [ "$FIDO2LUKS_USE_TOKEN" -eq 1 ]; then
-	export FIDO2LUKS_CREDENTIAL_ID="$FIDO2LUKS_CREDENTIAL_ID,$(fido2luks token list --csv $CRYPTTAB_SOURCE)"
-fi
-
-fido2luks print-secret --bin

src/cli.rs

@@ -1,36 +1,134 @@
 use crate::error::*;
-use crate::luks::{Fido2LuksToken, LuksDevice};
-use crate::util::sha256;
 use crate::*;
-use cli_args::*;
 
-use structopt::clap::Shell;
 use structopt::StructOpt;
 
 use ctap::{FidoCredential, FidoErrorKind};
-
+use failure::_core::fmt::{Display, Error, Formatter};
-use std::io::{Read, Write};
+use failure::_core::str::FromStr;
-use std::str::FromStr;
+use failure::_core::time::Duration;
+use std::io::Write;
+use std::process::exit;
 use std::thread;
-use std::time::Duration;
 
+use crate::luks::{Fido2LuksToken, LuksDevice};
+use crate::util::sha256;
 use std::borrow::Cow;
 use std::collections::HashSet;
-use std::fs::File;
 use std::time::SystemTime;
 
-pub use cli_args::Args;
+#[derive(Debug, Eq, PartialEq, Clone)]
+pub struct HexEncoded(pub Vec<u8>);
 
-fn read_pin(ap: &AuthenticatorParameters) -> Fido2LuksResult<String> {
+impl Display for HexEncoded {
-    if let Some(src) = ap.pin_source.as_ref() {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
-        let mut pin = String::new();
+        f.write_str(&hex::encode(&self.0))
-        File::open(src)?.read_to_string(&mut pin)?;
-        Ok(pin)
-    } else {
-        util::read_password("Authenticator PIN", false)
     }
 }
 
+impl AsRef<[u8]> for HexEncoded {
+    fn as_ref(&self) -> &[u8] {
+        &self.0[..]
+    }
+}
+
+impl FromStr for HexEncoded {
+    type Err = hex::FromHexError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(HexEncoded(hex::decode(s)?))
+    }
+}
+
+#[derive(Debug, Eq, PartialEq, Clone)]
+pub struct CommaSeparated<T: FromStr + Display>(pub Vec<T>);
+
+impl<T: Display + FromStr> Display for CommaSeparated<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
+        for i in &self.0 {
+            f.write_str(&i.to_string())?;
+            f.write_str(",")?;
+        }
+        Ok(())
+    }
+}
+
+impl<T: Display + FromStr> FromStr for CommaSeparated<T> {
+    type Err = <T as FromStr>::Err;
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(CommaSeparated(
+            s.split(',')
+                .map(|part| <T as FromStr>::from_str(part))
+                .collect::<Result<Vec<_>, _>>()?,
+        ))
+    }
+}
+
+#[derive(Debug, StructOpt)]
+pub struct Credentials {
+    /// FIDO credential ids, separated by ',' generate using fido2luks credential
+    #[structopt(name = "credential-id", env = "FIDO2LUKS_CREDENTIAL_ID")]
+    pub ids: CommaSeparated<HexEncoded>,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct AuthenticatorParameters {
+    /// Request a PIN to unlock the authenticator
+    #[structopt(short = "P", long = "pin")]
+    pub pin: bool,
+
+    /// Await for an authenticator to be connected, timeout after n seconds
+    #[structopt(
+        long = "await-dev",
+        name = "await-dev",
+        env = "FIDO2LUKS_DEVICE_AWAIT",
+        default_value = "15"
+    )]
+    pub await_time: u64,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct LuksParameters {
+    #[structopt(env = "FIDO2LUKS_DEVICE")]
+    device: PathBuf,
+
+    /// Try to unlock the device using a specifc keyslot, ignore all other slots
+    #[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
+    slot: Option<u32>,
+}
+
+#[derive(Debug, StructOpt, Clone)]
+pub struct LuksModParameters {
+    /// Number of milliseconds required to derive the volume decryption key
+    /// Defaults to 10ms when using an authenticator or the default by cryptsetup when using a password
+    #[structopt(long = "kdf-time", name = "kdf-time")]
+    kdf_time: Option<u64>,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct SecretParameters {
+    /// Salt for secret generation, defaults to 'ask'
+    ///
+    /// Options:{n}
+    ///  - ask              : Prompt user using password helper{n}
+    ///  - file:<PATH>      : Will read <FILE>{n}
+    ///  - string:<STRING>  : Will use <STRING>, which will be handled like a password provided to the 'ask' option{n}
+    #[structopt(
+        name = "salt",
+        long = "salt",
+        env = "FIDO2LUKS_SALT",
+        default_value = "ask"
+    )]
+    pub salt: InputSalt,
+    /// Script used to obtain passwords, overridden by --interactive flag
+    #[structopt(
+        name = "password-helper",
+        env = "FIDO2LUKS_PASSWORD_HELPER",
+        default_value = "/usr/bin/env systemd-ask-password 'Please enter second factor for LUKS disk encryption!'"
+    )]
+    pub password_helper: PasswordHelper,
+}
+
 fn derive_secret(
     credentials: &[HexEncoded],
     salt: &[u8; 32],
@@ -67,6 +165,171 @@ fn derive_secret(
     Ok((sha256(&[salt, &unsalted[..]]), cred.clone()))
 }
 
+fn read_pin() -> Fido2LuksResult<String> {
+    util::read_password("Authenticator PIN", false)
+}
+
+#[derive(Debug, StructOpt)]
+pub struct Args {
+    /// Request passwords via Stdin instead of using the password helper
+    #[structopt(short = "i", long = "interactive")]
+    pub interactive: bool,
+    #[structopt(subcommand)]
+    pub command: Command,
+}
+
+#[derive(Debug, StructOpt, Clone)]
+pub struct OtherSecret {
+    /// Use a keyfile instead of a password
+    #[structopt(short = "d", long = "keyfile", conflicts_with = "fido_device")]
+    keyfile: Option<PathBuf>,
+    /// Use another fido device instead of a password
+    /// Note: this requires for the credential fot the other device to be passed as argument as well
+    #[structopt(short = "f", long = "fido-device", conflicts_with = "keyfile")]
+    fido_device: bool,
+}
+
+#[derive(Debug, StructOpt)]
+pub enum Command {
+    #[structopt(name = "print-secret")]
+    PrintSecret {
+        /// Prints the secret as binary instead of hex encoded
+        #[structopt(short = "b", long = "bin")]
+        binary: bool,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+    },
+    /// Adds a generated key to the specified LUKS device
+    #[structopt(name = "add-key")]
+    AddKey {
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        /// Will wipe all other keys
+        #[structopt(short = "e", long = "exclusive")]
+        exclusive: bool,
+        /// Will add an token to your LUKS 2 header, including the credential id
+        #[structopt(short = "t", long = "token")]
+        token: bool,
+        #[structopt(flatten)]
+        existing_secret: OtherSecret,
+        #[structopt(flatten)]
+        luks_mod: LuksModParameters,
+    },
+    /// Replace a previously added key with a password
+    #[structopt(name = "replace-key")]
+    ReplaceKey {
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        /// Add the password and keep the key
+        #[structopt(short = "a", long = "add-password")]
+        add_password: bool,
+        /// Will add an token to your LUKS 2 header, including the credential id
+        #[structopt(short = "t", long = "token")]
+        token: bool,
+        #[structopt(flatten)]
+        replacement: OtherSecret,
+        #[structopt(flatten)]
+        luks_mod: LuksModParameters,
+    },
+    /// Open the LUKS device
+    #[structopt(name = "open")]
+    Open {
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
+        name: String,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        #[structopt(short = "r", long = "max-retries", default_value = "0")]
+        retries: i32,
+    },
+    /// Open the LUKS device using credentials embedded in the LUKS 2 header
+    #[structopt(name = "open-token")]
+    OpenToken {
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
+        name: String,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        #[structopt(short = "r", long = "max-retries", default_value = "0")]
+        retries: i32,
+    },
+    /// Generate a new FIDO credential
+    #[structopt(name = "credential")]
+    Credential {
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        /// Name to be displayed on the authenticator if it has a display
+        #[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME")]
+        name: Option<String>,
+    },
+    /// Check if an authenticator is connected
+    #[structopt(name = "connected")]
+    Connected,
+    Token(TokenCommand),
+}
+
+///LUKS2 token related operations
+#[derive(Debug, StructOpt)]
+pub enum TokenCommand {
+    /// List all tokens associated with the specified device
+    List {
+        #[structopt(env = "FIDO2LUKS_DEVICE")]
+        device: PathBuf,
+        /// Dump all credentials as CSV
+        #[structopt(long = "csv")]
+        csv: bool,
+    },
+    /// Add credential to a keyslot
+    Add {
+        #[structopt(env = "FIDO2LUKS_DEVICE")]
+        device: PathBuf,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        /// Slot to which the credentials will be added
+        #[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
+        slot: u32,
+    },
+    /// Remove credentials from token(s)
+    Remove {
+        #[structopt(env = "FIDO2LUKS_DEVICE")]
+        device: PathBuf,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        /// Token from which the credentials will be removed
+        #[structopt(long = "token")]
+        token_id: Option<u32>,
+    },
+    /// Remove all unassigned tokens
+    GC {
+        #[structopt(env = "FIDO2LUKS_DEVICE")]
+        device: PathBuf,
+    },
+}
+
 pub fn parse_cmdline() -> Args {
     Args::from_args()
 }
@@ -82,7 +345,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
         } => {
             let pin_string;
             let pin = if authenticator.pin {
-                pin_string = read_pin(authenticator)?;
+                pin_string = read_pin()?;
                 Some(pin_string.as_ref())
             } else {
                 None
@@ -99,7 +362,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
         } => {
             let pin_string;
             let pin = if authenticator.pin {
-                pin_string = read_pin(authenticator)?;
+                pin_string = read_pin()?;
                 Some(pin_string.as_ref())
             } else {
                 None
@@ -107,7 +370,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
             let salt = if interactive || secret.password_helper == PasswordHelper::Stdin {
                 util::read_password_hashed("Password", false)
             } else {
-                secret.salt.obtain_sha256(&secret.password_helper)
+                secret.salt.obtain(&secret.password_helper)
             }?;
             let (secret, _cred) = derive_secret(
                 credentials.ids.0.as_slice(),
@@ -143,7 +406,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
             ..
         } => {
             let pin = if authenticator.pin {
-                Some(read_pin(authenticator)?)
+                Some(read_pin()?)
             } else {
                 None
             };
@@ -151,7 +414,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                 if interactive || secret.password_helper == PasswordHelper::Stdin {
                     util::read_password_hashed(q, verify)
                 } else {
-                    secret.salt.obtain_sha256(&secret.password_helper)
+                    secret.salt.obtain(&secret.password_helper)
                 }
             };
             let other_secret = |salt_q: &str,
@@ -259,7 +522,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
         } => {
             let pin_string;
             let pin = if authenticator.pin {
-                pin_string = read_pin(authenticator)?;
+                pin_string = read_pin()?;
                 Some(pin_string.as_ref())
             } else {
                 None
@@ -268,7 +531,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                 if interactive || secret.password_helper == PasswordHelper::Stdin {
                     util::read_password_hashed(q, verify)
                 } else {
-                    secret.salt.obtain_sha256(&secret.password_helper)
+                    secret.salt.obtain(&secret.password_helper)
                 }
             };
 
@@ -449,17 +712,5 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                 Ok(())
             }
         },
-        Command::GenerateCompletions { shell, out_dir } => {
-            Args::clap().gen_completions(
-                env!("CARGO_PKG_NAME"),
-                match shell.as_ref() {
-                    "bash" => Shell::Bash,
-                    "fish" => Shell::Fish,
-                    _ => unreachable!("structopt shouldn't allow us to reach this point"),
-                },
-                &out_dir,
-            );
-            Ok(())
-        }
     }
 }

src/cli_args/mod.rs

@@ -1,295 +0,0 @@
-use std::fmt::{Display, Error, Formatter};
-use std::path::PathBuf;
-use std::str::FromStr;
-use structopt::clap::AppSettings;
-use structopt::StructOpt;
-
-mod config;
-#[cfg(any(feature = "setup", test))]
-mod setup;
-
-pub use config::*;
-
-#[derive(Debug, Eq, PartialEq, Clone)]
-pub struct HexEncoded(pub Vec<u8>);
-
-impl Display for HexEncoded {
-    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
-        f.write_str(&hex::encode(&self.0))
-    }
-}
-
-impl AsRef<[u8]> for HexEncoded {
-    fn as_ref(&self) -> &[u8] {
-        &self.0[..]
-    }
-}
-
-impl FromStr for HexEncoded {
-    type Err = hex::FromHexError;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        Ok(HexEncoded(hex::decode(s)?))
-    }
-}
-
-#[derive(Debug, Eq, PartialEq, Clone)]
-pub struct CommaSeparated<T: FromStr + Display>(pub Vec<T>);
-
-impl<T: Display + FromStr> Display for CommaSeparated<T> {
-    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
-        for i in &self.0 {
-            f.write_str(&i.to_string())?;
-            f.write_str(",")?;
-        }
-        Ok(())
-    }
-}
-
-impl<T: Display + FromStr> FromStr for CommaSeparated<T> {
-    type Err = <T as FromStr>::Err;
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        Ok(CommaSeparated(
-            s.split(',')
-                .map(|part| <T as FromStr>::from_str(part))
-                .collect::<Result<Vec<_>, _>>()?,
-        ))
-    }
-}
-
-#[derive(Debug, StructOpt)]
-pub struct Credentials {
-    /// FIDO credential ids, separated by ',' generate using fido2luks credential
-    #[structopt(name = "credential-id", env = "FIDO2LUKS_CREDENTIAL_ID")]
-    pub ids: CommaSeparated<HexEncoded>,
-}
-
-#[derive(Debug, StructOpt)]
-pub struct AuthenticatorParameters {
-    /// Request a PIN to unlock the authenticator
-    #[structopt(short = "P", long = "pin")]
-    pub pin: bool,
-
-    /// Location to read PIN from
-    #[structopt(long = "pin-source", env = "FIDO2LUKS_PIN_SOURCE")]
-    pub pin_source: Option<PathBuf>,
-
-    /// Await for an authenticator to be connected, timeout after n seconds
-    #[structopt(
-        long = "await-dev",
-        name = "await-dev",
-        env = "FIDO2LUKS_DEVICE_AWAIT",
-        default_value = "15"
-    )]
-    pub await_time: u64,
-}
-
-#[derive(Debug, StructOpt)]
-pub struct LuksParameters {
-    #[structopt(env = "FIDO2LUKS_DEVICE")]
-    pub device: PathBuf,
-
-    /// Try to unlock the device using a specifc keyslot, ignore all other slots
-    #[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
-    pub slot: Option<u32>,
-}
-
-#[derive(Debug, StructOpt, Clone)]
-pub struct LuksModParameters {
-    /// Number of milliseconds required to derive the volume decryption key
-    /// Defaults to 10ms when using an authenticator or the default by cryptsetup when using a password
-    #[structopt(long = "kdf-time", name = "kdf-time")]
-    pub kdf_time: Option<u64>,
-}
-
-#[derive(Debug, StructOpt)]
-pub struct SecretParameters {
-    /// Salt for secret generation, defaults to 'ask'
-    ///
-    /// Options:{n}
-    ///  - ask              : Prompt user using password helper{n}
-    ///  - file:<PATH>      : Will read <FILE>{n}
-    ///  - string:<STRING>  : Will use <STRING>, which will be handled like a password provided to the 'ask' option{n}
-    #[structopt(
-        name = "salt",
-        long = "salt",
-        env = "FIDO2LUKS_SALT",
-        default_value = "ask"
-    )]
-    pub salt: SecretInput,
-    /// Script used to obtain passwords, overridden by --interactive flag
-    #[structopt(
-        name = "password-helper",
-        env = "FIDO2LUKS_PASSWORD_HELPER",
-        default_value = "/usr/bin/env systemd-ask-password 'Please enter second factor for LUKS disk encryption!'"
-    )]
-    pub password_helper: PasswordHelper,
-}
-#[derive(Debug, StructOpt)]
-pub struct Args {
-    /// Request passwords via Stdin instead of using the password helper
-    #[structopt(short = "i", long = "interactive")]
-    pub interactive: bool,
-    #[structopt(subcommand)]
-    pub command: Command,
-}
-
-#[derive(Debug, StructOpt, Clone)]
-pub struct OtherSecret {
-    /// Use a keyfile instead of a password
-    #[structopt(short = "d", long = "keyfile", conflicts_with = "fido_device")]
-    pub keyfile: Option<PathBuf>,
-    /// Use another fido device instead of a password
-    /// Note: this requires for the credential fot the other device to be passed as argument as well
-    #[structopt(short = "f", long = "fido-device", conflicts_with = "keyfile")]
-    pub fido_device: bool,
-}
-
-#[derive(Debug, StructOpt)]
-pub enum Command {
-    #[structopt(name = "print-secret")]
-    PrintSecret {
-        /// Prints the secret as binary instead of hex encoded
-        #[structopt(short = "b", long = "bin")]
-        binary: bool,
-        #[structopt(flatten)]
-        credentials: Credentials,
-        #[structopt(flatten)]
-        authenticator: AuthenticatorParameters,
-        #[structopt(flatten)]
-        secret: SecretParameters,
-    },
-    /// Adds a generated key to the specified LUKS device
-    #[structopt(name = "add-key")]
-    AddKey {
-        #[structopt(flatten)]
-        luks: LuksParameters,
-        #[structopt(flatten)]
-        credentials: Credentials,
-        #[structopt(flatten)]
-        authenticator: AuthenticatorParameters,
-        #[structopt(flatten)]
-        secret: SecretParameters,
-        /// Will wipe all other keys
-        #[structopt(short = "e", long = "exclusive")]
-        exclusive: bool,
-        /// Will add an token to your LUKS 2 header, including the credential id
-        #[structopt(short = "t", long = "token")]
-        token: bool,
-        #[structopt(flatten)]
-        existing_secret: OtherSecret,
-        #[structopt(flatten)]
-        luks_mod: LuksModParameters,
-    },
-    /// Replace a previously added key with a password
-    #[structopt(name = "replace-key")]
-    ReplaceKey {
-        #[structopt(flatten)]
-        luks: LuksParameters,
-        #[structopt(flatten)]
-        credentials: Credentials,
-        #[structopt(flatten)]
-        authenticator: AuthenticatorParameters,
-        #[structopt(flatten)]
-        secret: SecretParameters,
-        /// Add the password and keep the key
-        #[structopt(short = "a", long = "add-password")]
-        add_password: bool,
-        /// Will add an token to your LUKS 2 header, including the credential id
-        #[structopt(short = "t", long = "token")]
-        token: bool,
-        #[structopt(flatten)]
-        replacement: OtherSecret,
-        #[structopt(flatten)]
-        luks_mod: LuksModParameters,
-    },
-    /// Open the LUKS device
-    #[structopt(name = "open")]
-    Open {
-        #[structopt(flatten)]
-        luks: LuksParameters,
-        #[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
-        name: String,
-        #[structopt(flatten)]
-        credentials: Credentials,
-        #[structopt(flatten)]
-        authenticator: AuthenticatorParameters,
-        #[structopt(flatten)]
-        secret: SecretParameters,
-        #[structopt(short = "r", long = "max-retries", default_value = "0")]
-        retries: i32,
-    },
-    /// Open the LUKS device using credentials embedded in the LUKS 2 header
-    #[structopt(name = "open-token")]
-    OpenToken {
-        #[structopt(flatten)]
-        luks: LuksParameters,
-        #[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
-        name: String,
-        #[structopt(flatten)]
-        authenticator: AuthenticatorParameters,
-        #[structopt(flatten)]
-        secret: SecretParameters,
-        #[structopt(short = "r", long = "max-retries", default_value = "0")]
-        retries: i32,
-    },
-    /// Generate a new FIDO credential
-    #[structopt(name = "credential")]
-    Credential {
-        #[structopt(flatten)]
-        authenticator: AuthenticatorParameters,
-        /// Name to be displayed on the authenticator if it has a display
-        #[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME")]
-        name: Option<String>,
-    },
-    /// Check if an authenticator is connected
-    #[structopt(name = "connected")]
-    Connected,
-    Token(TokenCommand),
-    /// Generate bash completion scripts
-    #[structopt(name = "completions", setting = AppSettings::Hidden)]
-    GenerateCompletions {
-        /// Shell to generate completions for: bash, fish
-        #[structopt(possible_values = &["bash", "fish"])]
-        shell: String,
-        out_dir: PathBuf,
-    },
-}
-
-///LUKS2 token related operations
-#[derive(Debug, StructOpt)]
-pub enum TokenCommand {
-    /// List all tokens associated with the specified device
-    List {
-        #[structopt(env = "FIDO2LUKS_DEVICE")]
-        device: PathBuf,
-        /// Dump all credentials as CSV
-        #[structopt(long = "csv")]
-        csv: bool,
-    },
-    /// Add credential to a keyslot
-    Add {
-        #[structopt(env = "FIDO2LUKS_DEVICE")]
-        device: PathBuf,
-        #[structopt(flatten)]
-        credentials: Credentials,
-        /// Slot to which the credentials will be added
-        #[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
-        slot: u32,
-    },
-    /// Remove credentials from token(s)
-    Remove {
-        #[structopt(env = "FIDO2LUKS_DEVICE")]
-        device: PathBuf,
-        #[structopt(flatten)]
-        credentials: Credentials,
-        /// Token from which the credentials will be removed
-        #[structopt(long = "token")]
-        token_id: Option<u32>,
-    },
-    /// Remove all unassigned tokens
-    GC {
-        #[structopt(env = "FIDO2LUKS_DEVICE")]
-        device: PathBuf,
-    },
-}

src/cli_args/setup.rs

@@ -1,94 +0,0 @@
-use crate::cli_args::SecretInput;
-use crate::error::Fido2LuksResult;
-use crate::luks::LuksDevice;
-use std::io::{stdin, BufRead, BufReader};
-use std::path::{Path, PathBuf};
-
-enum Setup {
-    Welcome,
-    Disks {
-        disks: Vec<PathBuf>,
-    },
-    Unlocked {
-        disks: Vec<LuksDevice>,
-        current_secrets: Vec<Vec<u8>>,
-    },
-    Salt {
-        disks: Vec<PathBuf>,
-        current_secrets: Vec<Vec<u8>>,
-        salt: SecretInput,
-    },
-    Config {
-        salt: SecretInput,
-    },
-}
-
-impl Setup {
-    fn description(&self) -> String {
-        match self {
-            Self::Welcome => {
-                "Please enter the device path for all disks you want to protect".into()
-            }
-            _ => "".into(),
-        }
-    }
-
-    fn next(self) -> Fido2LuksResult<Self> {
-        println!("{}", self.description());
-        Ok(match self {
-            Self::Welcome => {
-                let mut disks = Vec::new();
-                for path in BufReader::new(stdin()).lines() {
-                    let path_string = path?;
-                    let path = match path_string.as_str() {
-                        "" => break,
-                        path => Path::new(path),
-                    };
-                    if path.exists() {
-                        disks.push(path.to_path_buf());
-                    } else {
-                        eprintln!(
-                            "{} does not exist, try again or hit enter to finish",
-                            path.display()
-                        );
-                    }
-                }
-                Self::Disks { disks }
-            }
-            Self::Disks { disks } => {
-                let mut luks_devs = Vec::new();
-                let add_dev = |path: &Path| -> Fido2LuksResult<Option<LuksDevice>> {
-                    match LuksDevice::load(path) {
-                        Ok(luks) => return Ok(Some(luks)),
-                        Err(dev) => {
-                            let mut ans = String::new();
-                            loop {
-                                eprint!("Failed to open {}\nIs it an LUKS device or could it be the mounted block device? Skip/Replace (s,r): ");
-                                stdin().read_line(&mut ans)?;
-                                match ans.as_str() {
-                                    "s" => return Ok(None),
-                                    "r" => {
-                                        print!("Enter an new device path: ");
-                                        stdin().read_line(&mut ans)?;
-                                        let path = PathBuf::from(&ans);
-                                        return add_dev(path.as_path());
-                                    }
-                                    _ => (),
-                                }
-                            }
-                        }
-                    }
-                    Ok(None)
-                };
-                for dev in disks.iter() {
-                    let path = PathBuf::from(&dev);
-                    if let Some(luks) = add_dev(path.as_path()) {
-                        luks_devs.push(luks);
-                    }
-                }
-                unreachable!()
-            }
-            _ => unreachable!(),
-        })
-    }
-}

src/config.rs

@@ -10,33 +10,33 @@ use std::process::Command;
 use std::str::FromStr;
 
 #[derive(Debug, Clone, PartialEq)]
-pub enum SecretInput {
+pub enum InputSalt {
     AskPassword,
     String(String),
     File { path: PathBuf },
 }
 
-impl Default for SecretInput {
+impl Default for InputSalt {
     fn default() -> Self {
-        SecretInput::AskPassword
+        InputSalt::AskPassword
     }
 }
 
-impl From<&str> for SecretInput {
+impl From<&str> for InputSalt {
     fn from(s: &str) -> Self {
         let mut parts = s.split(':');
         match parts.next() {
-            Some("ask") | Some("Ask") => SecretInput::AskPassword,
+            Some("ask") | Some("Ask") => InputSalt::AskPassword,
-            Some("file") => SecretInput::File {
+            Some("file") => InputSalt::File {
                 path: parts.collect::<Vec<_>>().join(":").into(),
             },
-            Some("string") => SecretInput::String(parts.collect::<Vec<_>>().join(":")),
+            Some("string") => InputSalt::String(parts.collect::<Vec<_>>().join(":")),
             _ => Self::default(),
         }
     }
 }
 
-impl FromStr for SecretInput {
+impl FromStr for InputSalt {
     type Err = Fido2LuksError;
 
     fn from_str(s: &str) -> Result<Self, Self::Err> {
@@ -44,42 +44,21 @@ impl FromStr for SecretInput {
     }
 }
 
-impl fmt::Display for SecretInput {
+impl fmt::Display for InputSalt {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
         f.write_str(&match self {
-            SecretInput::AskPassword => "ask".to_string(),
+            InputSalt::AskPassword => "ask".to_string(),
-            SecretInput::String(s) => ["string", s].join(":"),
+            InputSalt::String(s) => ["string", s].join(":"),
-            SecretInput::File { path } => ["file", path.display().to_string().as_str()].join(":"),
+            InputSalt::File { path } => ["file", path.display().to_string().as_str()].join(":"),
         })
     }
 }
 
-impl SecretInput {
+impl InputSalt {
-    pub fn obtain_string(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<String> {
+    pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> {
-        Ok(String::from_utf8(self.obtain(password_helper)?)?)
-    }
-
-    pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<Vec<u8>> {
-        let mut secret = Vec::new();
-        match self {
-            SecretInput::File { path } => {
-                //TODO: replace with try_blocks
-                let mut do_io = || File::open(path)?.read_to_end(&mut secret);
-                do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
-            }
-            SecretInput::AskPassword => {
-                secret.extend_from_slice(password_helper.obtain()?.as_bytes())
-            }
-
-            SecretInput::String(s) => secret.extend_from_slice(s.as_bytes()),
-        }
-        Ok(secret)
-    }
-
-    pub fn obtain_sha256(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> {
         let mut digest = digest::Context::new(&digest::SHA256);
         match self {
-            SecretInput::File { path } => {
+            InputSalt::File { path } => {
                 let mut do_io = || {
                     let mut reader = File::open(path)?;
                     let mut buf = [0u8; 512];
@@ -94,7 +73,10 @@ impl SecretInput {
                 };
                 do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
             }
-            _ => digest.update(self.obtain(password_helper)?.as_slice()),
+            InputSalt::AskPassword => {
+                digest.update(password_helper.obtain()?.as_bytes());
+            }
+            InputSalt::String(s) => digest.update(s.as_bytes()),
         }
         let mut salt = [0u8; 32];
         salt.as_mut().copy_from_slice(digest.finish().as_ref());
@@ -153,9 +135,10 @@ impl PasswordHelper {
             Systemd => unimplemented!(),
             Stdin => Ok(util::read_password("Password", true)?),
             Script(password_helper) => {
-                let password = Command::new("sh")
+                let mut helper_parts = password_helper.split(' ');
-                    .arg("-c")
+
-                    .arg(&password_helper)
+                let password = Command::new((&mut helper_parts).next().unwrap())
+                    .args(helper_parts)
                     .output()
                     .map_err(|e| Fido2LuksError::AskPassError {
                         cause: error::AskPassError::IO(e),
@@ -175,30 +158,24 @@ mod test {
     #[test]
     fn input_salt_from_str() {
         assert_eq!(
-            "file:/tmp/abc".parse::<SecretInput>().unwrap(),
+            "file:/tmp/abc".parse::<InputSalt>().unwrap(),
-            SecretInput::File {
+            InputSalt::File {
                 path: "/tmp/abc".into()
             }
         );
         assert_eq!(
-            "string:abc".parse::<SecretInput>().unwrap(),
+            "string:abc".parse::<InputSalt>().unwrap(),
-            SecretInput::String("abc".into())
+            InputSalt::String("abc".into())
-        );
-        assert_eq!(
-            "ask".parse::<SecretInput>().unwrap(),
-            SecretInput::AskPassword
-        );
-        assert_eq!(
-            "lol".parse::<SecretInput>().unwrap(),
-            SecretInput::default()
         );
+        assert_eq!("ask".parse::<InputSalt>().unwrap(), InputSalt::AskPassword);
+        assert_eq!("lol".parse::<InputSalt>().unwrap(), InputSalt::default());
     }
 
     #[test]
     fn input_salt_obtain() {
         assert_eq!(
-            SecretInput::String("abc".into())
+            InputSalt::String("abc".into())
-                .obtain_sha256(&PasswordHelper::Stdin)
+                .obtain(&PasswordHelper::Stdin)
                 .unwrap(),
             [
                 186, 120, 22, 191, 143, 1, 207, 234, 65, 65, 64, 222, 93, 174, 34, 35, 176, 3, 97,

src/error.rs

@@ -1,9 +1,5 @@
 use ctap::FidoError;
-use libcryptsetup_rs::LibcryptErr;
 use std::io;
-use std::io::ErrorKind;
-use std::string::FromUtf8Error;
-use Fido2LuksError::*;
 
 pub type Fido2LuksResult<T> = Result<T, Fido2LuksError>;
 
@@ -85,6 +81,11 @@ impl From<LuksError> for Fido2LuksError {
     }
 }
 
+use libcryptsetup_rs::LibcryptErr;
+use std::io::ErrorKind;
+use std::string::FromUtf8Error;
+use Fido2LuksError::*;
+
 impl From<FidoError> for Fido2LuksError {
     fn from(e: FidoError) -> Self {
         AuthenticatorError { cause: e }

src/main.rs

@@ -4,13 +4,15 @@ extern crate ctap_hmac as ctap;
 #[macro_use]
 extern crate serde_derive;
 use crate::cli::*;
+use crate::config::*;
 use crate::device::*;
 use crate::error::*;
 use std::io;
+use std::path::PathBuf;
 use std::process::exit;
 
 mod cli;
-pub mod cli_args;
+mod config;
 mod device;
 mod error;
 mod luks;
@@ -19,7 +21,10 @@ mod util;
 fn main() -> Fido2LuksResult<()> {
     match run_cli() {
         Err(e) => {
+            #[cfg(debug_assertions)]
             eprintln!("{:?}", e);
+            #[cfg(not(debug_assertions))]
+            eprintln!("{}", e);
             exit(e.exit_code())
         }
         _ => exit(0),