Update syntax for argument to unlock

[AliSoftware]

Note

This PR builds on top of #12

What

• Add a tip in README.md about starting the command with a space to not have the key leak in the user's shell history
  • h/t @iangmaia in Add support for base64:… arg for unlock #10 (comment)
• Update the expected argument for unlock:
  • The base64: prefix (introduced in Add support for base64:… arg for unlock #10) is no longer needed to provide the base64-encoded key during unlock <base64key>, which makes more sense since that's the use case that local developers will use the most (copying the Base64-encoded key from the Secret Store to unlock their local working copy with it)
  • Drop support for reading the binary key from a file. In practice, this use case would be the less used one (and one we wouldn't recommend, as having the binary key around in a file makes it easy to accidentally be committed, or be read by another user on the machine if not properly protected, etc), so it felt not only odd but also sending the wrong signal/suggestion to have it as the default for this unlock argument. Reading from a file is still possible via < shell redirection anyway.

Testing

• Run cargo build --release from this PR's head branch, and add <thisrepo>/target/release/ to your $PATH
• Checkout the head branch of one of the PRs of a repo in which I've already prepared the migration to git-conceal, like [AINFRA-1533] Adopt git-conceal in this repo woocommerce/woocommerce-android#14979 or [AINFRA-1539] [Internal] Migrate from configure_apply to git-conceal pocket-casts-android#4841, so you have a repo on which to test that command on
• Search git-conceal in the Secret Store and copy the base64 decryption key in the clipboard
• Then, from the working copy of such a test repo, run the following commands to test the feature:

# Store the base64 key you copied to your clipboard in an env var
$ export GIT_CONCEAL_KEY=$(pbpaste)
# Test passing the base64 key directly
$ git conceal lock
$ git conceal unlock $(pbpaste)
$ git conceal lock
$ git conceal unlock $GIT_CONCEAL_KEY
# Test passing the env var name
$ git conceal lock
$ git conceal unlock env:GIT_CONCEAL_KEY
# Test passing it via stdin (raw binary)
$ git conceal lock
$ echo "$GIT_CONCEAL_KEY" | base64 -d | git conceal unlock -
$ git conceal lock
$ echo "$GIT_CONCEAL_KEY" | base64 -d >~/git-conceal-key.bin
$ git conceal unlock - < ~/git-conceal-key.bin
$ rm ~/git-conceal-key.bin

[iangmaia]

👍

[iangmaia]

I've tested lock / unlock in PCAndroid, with both a file < redirection and the base64 string 👍

[AliSoftware]

Thanks for the review 👍

FYI: Since this is built on top of #12 itself built on top of #11, I'll probably wait for those other 2 to be reviews/approved/merged to merge that chain of PR in order (as opposed to "polluting" those other PRs' diff with the diff of this PR if I were to merge it now)