3 files changed, 0 insertions, 199 deletions
diff --git a/modules/scripts/gpg-backup/completion.zsh b/modules/scripts/gpg-backup/completion.zsh
deleted file mode 100644
index f47bbe8..0000000
--- a/modules/scripts/gpg-backup/completion.zsh
+++ /dev/null
@@ -1,23 +0,0 @@
-#compdef gpg-backup
-
-_arguments \
-  '1: :->cmds' \
-  '*::arg:->args'
-
-case $state in
-  cmds)
-    local -a commands
-    commands=(
-      'export:Export all GPG keys to a passphrase-protected file'
-      'import:Import GPG keys from a backup file'
-    )
-    _describe 'command' commands
-    ;;
-  args)
-    case $words[1] in
-      export|import)
-        _files
-        ;;
-    esac
-    ;;
-esac
diff --git a/modules/scripts/gpg-backup/default.nix b/modules/scripts/gpg-backup/default.nix
deleted file mode 100644
index b97aad8..0000000
--- a/modules/scripts/gpg-backup/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "gpg-backup";
-    path = ./script.sh;
-    description = "Export/import all GPG keys as a single passphrase-protected file with maximum S2K iteration count\nUsage: gpg-backup export filename.gpg | gpg-backup import filename.gpg";
-    deps = [
-      pkgs.bash
-      pkgs.gnupg
-      pkgs.gnutar
-      pkgs.coreutils
-      pkgs.findutils
-    ];
-    completion.zsh = builtins.readFile ./completion.zsh;
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig;
-}
diff --git a/modules/scripts/gpg-backup/script.sh b/modules/scripts/gpg-backup/script.sh
deleted file mode 100644
index 57c216b..0000000
--- a/modules/scripts/gpg-backup/script.sh
+++ /dev/null
@@ -1,149 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-WORKDIR="$(mktemp -d)"
-
-cleanup() {
-  if [[ -d "$WORKDIR" ]]; then
-    find "$WORKDIR" -type f -exec shred -u -z {} \; 2>/dev/null || true
-    rm -rf "$WORKDIR"
-  fi
-}
-trap cleanup EXIT
-
-usage() {
-  echo "Usage:"
-  echo "  $0 export <filename>   Export all GPG keys to an encrypted file"
-  echo "  $0 import <filename>   Decrypt and import keys from a backup file"
-  exit 1
-}
-
-do_export() {
-  local outfile="$1"
-
-  if [[ -e "$outfile" ]]; then
-    echo "!! Refusing to overwrite existing file: $outfile" >&2
-    exit 1
-  fi
-
-  echo "==> Exporting public keys..."
-  gpg --export --armor > "$WORKDIR/public-keys.asc"
-
-  echo "==> Exporting secret keys..."
-  gpg --export-secret-keys --armor > "$WORKDIR/secret-keys.asc"
-
-  echo "==> Exporting secret subkeys (if any)..."
-  gpg --export-secret-subkeys --armor > "$WORKDIR/secret-subkeys.asc" || true
-
-  echo "==> Exporting owner trust database..."
-  gpg --export-ownertrust > "$WORKDIR/ownertrust.txt"
-
-  echo "==> Exporting revocation certificates..."
-  mkdir -p "$WORKDIR/revocation-certs"
-  if [[ -d "$HOME/.gnupg/openpgp-revocs.d" ]]; then
-    cp "$HOME"/.gnupg/openpgp-revocs.d/*.rev "$WORKDIR/revocation-certs/" 2>/dev/null || true
-  fi
-
-  echo "==> Bundling everything into a single archive..."
-  tar -C "$WORKDIR" -cf "$WORKDIR/gpg-full-backup.tar" \
-    public-keys.asc \
-    secret-keys.asc \
-    secret-subkeys.asc \
-    ownertrust.txt \
-    revocation-certs
-
-  echo "==> Encrypting with GPG (AES256, SHA512, max S2K iteration count)..."
-  echo "  You will be prompted for a passphrase — use a strong one."
-  gpg --symmetric \
-    --cipher-algo AES256 \
-    --digest-algo SHA512 \
-    --s2k-mode 3 \
-    --s2k-digest-algo SHA512 \
-    --s2k-count 65011712 \
-    --output "$outfile" \
-    "$WORKDIR/gpg-full-backup.tar"
-
-  echo "==> Verifying: attempting decryption to confirm it works..."
-  if gpg --decrypt "$outfile" > "$WORKDIR/verify.tar" 2>/dev/null; then
-    if cmp -s "$WORKDIR/gpg-full-backup.tar" "$WORKDIR/verify.tar"; then
-      echo "==> Verification succeeded: backup decrypts correctly."
-    else
-      echo "!! WARNING: decrypted content does not match original. Investigate before trusting this backup." >&2
-      exit 1
-    fi
-  else
-    echo "!! WARNING: decryption test failed." >&2
-    exit 1
-  fi
-
-  echo
-  echo "==> Done."
-  echo "  Encrypted backup: $outfile"
-  echo "  Store this file somewhere safe (offline media, encrypted drive)."
-  echo "  The S2K iteration count only helps if your passphrase itself"
-  echo "  has real entropy (e.g. a long diceware passphrase)."
-}
-
-do_import() {
-  local infile="$1"
-
-  if [[ ! -f "$infile" ]]; then
-    echo "!! File not found: $infile" >&2
-    exit 1
-  fi
-
-  echo "==> Decrypting $infile ..."
-  echo "  You will be prompted for the backup's passphrase."
-  echo "  Note: this may take a while due to the high S2K iteration count."
-  gpg --decrypt "$infile" > "$WORKDIR/gpg-full-backup.tar"
-
-  echo "==> Extracting archive..."
-  tar -C "$WORKDIR" -xf "$WORKDIR/gpg-full-backup.tar"
-
-  echo "==> Importing public keys..."
-  gpg --import "$WORKDIR/public-keys.asc"
-
-  echo "==> Importing secret keys..."
-  gpg --import "$WORKDIR/secret-keys.asc"
-
-  if [[ -s "$WORKDIR/secret-subkeys.asc" ]]; then
-    echo "==> Importing secret subkeys..."
-    gpg --import "$WORKDIR/secret-subkeys.asc" || true
-  fi
-
-  if [[ -f "$WORKDIR/ownertrust.txt" ]]; then
-    echo "==> Importing owner trust database..."
-    gpg --import-ownertrust "$WORKDIR/ownertrust.txt"
-  fi
-
-  if [[ -d "$WORKDIR/revocation-certs" ]] && [[ -n "$(ls -A "$WORKDIR/revocation-certs" 2>/dev/null)" ]]; then
-    echo "==> Restoring revocation certificates..."
-    mkdir -p "$HOME/.gnupg/openpgp-revocs.d"
-    cp "$WORKDIR"/revocation-certs/*.rev "$HOME/.gnupg/openpgp-revocs.d/" 2>/dev/null || true
-  fi
-
-  echo
-  echo "==> Done. Keys imported into your GPG keyring."
-  echo "  Run 'gpg --list-secret-keys' to confirm."
-}
-
-# Main
-
-if [[ $# -ne 2 ]]; then
-  usage
-fi
-
-command="$1"
-filename="$2"
-
-case "$command" in
-  export)
-    do_export "$filename"
-    ;;
-  import)
-    do_import "$filename"
-    ;;
-  *)
-    usage
-    ;;
-esac