Migrate pass(1)

---

We just need the pass directory and the gpg key.

I use a variable so I can find it in the environment.

user@source ~> env | grep -i pass  
PASSWORD_STORE_DIR=~/.local/password-store

Now I can get the gpg key id.

user@source ~> cat ~/.local/password-store/.gpg-id
AA21250888469FBC

And export it.

user@source ~> gpg --output gpg_pub.gpg --armor --export AA21250888469FBC
user@source ~> gpg --output gpg_sec.gpg --armor --export-secret-key AA21250888469FBC

Now I move everything to the destination computer.

[user@dest ~]$ rsync -a source:~/.local/password-store ~/
[user@dest ~]$ mv ~/password-store ~/.password-store
[user@dest ~]$ rsync source:~/gpg_pub.gpg /tmp/
[user@dest ~]$ rsync source:~/gpg_sec.gpg /tmp/

Import the keys.

[user@dest ~]$ gpg --import /tmp/gpg_pub.gpg
gpg: WARNING: unsafe permissions on homedir '~/.gnupg'
gpg: key AA21250888469FBC: public key "Description goes here" imported
gpg: Total number processed: 1
gpg:               imported: 1

[user@dest ~]$ gpg --allow-secret-key-import --import /tmp/gpg_sec.gpg
gpg: WARNING: unsafe permissions on homedir '~/.gnupg'
gpg: key AA21250888469FBC: "Description goes here" not changed
gpg: key AA21250888469FBC: secret key imported
gpg: Total number processed: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1
gpg:   secret keys imported: 1

Fix the permissions on ~/.gnupg.

[user@dest ~]$ chmod 700 ~/.gnupg

Trust it.

[user@dest ~]$ gpg --edit-key AA21250888469FBC
gpg (GnuPG) 2.3.3; Copyright (C) 2021 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

sec  rsa4096/AA21250888469FBC
     created: 2022-08-15  expires: never       usage: SC  
     trust: full          validity: unknown
ssb  rsa4096/45953417AD843B57
     created: 2022-08-15  expires: never       usage: E   
[ unknown] (1). Description goes here

gpg> trust
sec  rsa4096/AA21250888469FBC
     created: 2022-08-15  expires: never       usage: SC  
     trust: full          validity: unknown
ssb  rsa4096/45953417AD843B57
     created: 2022-08-15  expires: never       usage: E   
[ unknown] (1). Description goes here

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

sec  rsa4096/AA21250888469FBC
     created: 2022-08-15  expires: never       usage: SC  
     trust: ultimate      validity: unknown
ssb  rsa4096/45953417AD843B57
     created: 2022-08-15  expires: never       usage: E   
[ unknown] (1). Description goes here
Please note that the shown key validity is not necessarily correct
unless you restart the program.

And test it.

[user@dest ~]$ pass list
Password Store
├── Here
│   └── Are
└── Some
    └── Passwords
[user@dest ~]$ pass Here/Are 
P@$$w0rdG03sH3r3
[user@dest ~]$ pass insert Some/New
Enter password for Some/New: ********
Retype password for Some/New: ********
[master dff76e4] Add given password for Some/New to store.
 Committer: user <user@dest>
[user@dest ~]$ pass list
Password Store
├── Here
│   └── Are
└── Some
    ├── New
    └── Passwords