{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/562","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/562/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/562/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/562/events","html_url":"https://github.com/hashicorp/vault/issues/562","id":102374007,"number":562,"title":"GPG public keys as -key-shares for init?","user":{"login":"yawn","id":18242,"avatar_url":"https://avatars.githubusercontent.com/u/18242?v=3","gravatar_id":"","url":"https://api.github.com/users/yawn","html_url":"https://github.com/yawn","followers_url":"https://api.github.com/users/yawn/followers","following_url":"https://api.github.com/users/yawn/following{/other_user}","gists_url":"https://api.github.com/users/yawn/gists{/gist_id}","starred_url":"https://api.github.com/users/yawn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yawn/subscriptions","organizations_url":"https://api.github.com/users/yawn/orgs","repos_url":"https://api.github.com/users/yawn/repos","events_url":"https://api.github.com/users/yawn/events{/privacy}","received_events_url":"https://api.github.com/users/yawn/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/vault/labels/accepted","name":"accepted","color":"009800"},{"url":"https://api.github.com/repos/hashicorp/vault/labels/core","name":"core","color":"000000"},{"url":"https://api.github.com/repos/hashicorp/vault/labels/thinking","name":"thinking","color":"c7def8"}],"state":"closed","locked":false,"assignee":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/hashicorp/vault/milestones/2","html_url":"https://github.com/hashicorp/vault/milestones/0.3.0","labels_url":"https://api.github.com/repos/hashicorp/vault/milestones/2/labels","id":1263163,"number":2,"title":"0.3.0","description":"","creator":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":2,"state":"open","created_at":"2015-08-19T19:01:40Z","updated_at":"2015-08-25T23:41:21Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2015-08-21T12:55:15Z","updated_at":"2015-08-26T14:38:16Z","closed_at":"2015-08-25T23:41:21Z","body":"With GPG support being available in Golang I'd like to start a discussion about the following feature request for `vault init`\r\n\r\n* as an alternative to `-key-shares=n` the option `-gpg-shares=keyfile1.pub,keyfile2.pub,keyfile3.pub` can be specified\r\n* the resulting unseal key shards are never available in plain text - instead vault will write encrypted shards to disk (or possibly output them ascii-armored)\r\n\r\nAs an alternative to building this in I'd propose a `format=json` for `init` (unless the current ASCII output is considered \"stable\"). Combined with a script this could automate the process of feeding this data into GPG (with the additional possible benefit of an associated keychain).\r\n\r\nIf there is some interest in this I can probably provide a first PR. "},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/135043100","html_url":"https://github.com/hashicorp/vault/issues/562#issuecomment-135043100","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/562","id":135043100,"user":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"created_at":"2015-08-26T14:38:16Z","updated_at":"2015-08-26T14:38:16Z","body":"> The output format of init is not explicitly documented as stable which makes it difficult to build tooling around the current Key n: <hexdump>-style output. Since the keys do not contain sensitive material anymore I'd strongly advise to write them to disc, using a filename convention. Example: using yawn.pub for sealing would result in yawn.shard\r\n\r\nA problem there is if the keys cannot be written (for instance, directory permissions permit reading but not writing). Then you have an initialized Vault but no unseal keys.\r\n\r\n> create a stable output format in JSON instead of hexdumping to stdout (an additional option could be a format suitable for piping into mail)\r\n\r\nMany Vault commands already support output in JSON. These don't, but I think that is a reasonable future request. I would probably still prefer the output to be a hexdump, though, to keep parity with the console output.\r\n\r\n> In both cases it would be convenient to include the email address from the public key metadata (if present) to make it even easier to further automate the process - if we keep the outputs in the same order the keys were supplied in this should not create matching problems\r\n\r\nEmail addresses are optional, not required. If they exist they could be put into JSON as a nicety, but since ordering is kept I don't think this is really much of a benefit so far as automatic tooling goes...why do a lookup on email address when you can simply iterate over the list of keys you just submitted?\r\n\r\n> Another thing is the actual payload of the encryption: currently the key is encrypted as binary payload. I would advise to encode it as hexencoded; sure it's twice the size it could be but that should not matter at all in this context and avoids another round of encoding to the (expected) hexdump format.\r\n\r\nThat's a good idea; I'll make that change shortly.\r\n\r\n"}}