How to change the key?

[lwb-2021]

password-store can change the key by pass init <key-name>, but I don't know how to change encryption key with passage

[53053]

you can add a new identity, and generate a recipient for that one, and just passage show mypass | pass insert -m mypass on a loop for all *.age (this will re-encrypt for the new recipient), that will probably work just fine.

briefly the steps:

# backup
mv $HOME/.passage/identities $HOME/.passage/identities.old
mv $HOME/.passage/store/.age-recipients $HOME/.passage/store/.age-recipients.old

# new
age-keygen -pq | age -p > $HOME/.passage/identities
age -d $HOME/.passage/identities | age-keygen -y > $HOME/.passage/store/.age-recipients

once that's done, you can use a script like this (in fish, translate to bash or whatever you like):

#!/usr/bin/env fish

set STORE_DIR "$HOME/.passage/store"

set NEW_ID_FILE "$HOME/.passage/identities" # NEW ONE
set -gx PASSAGE_IDENTITIES_FILE "$HOME/.passage/identities.old" # OLD ONE

echo "Enter the passphrase for your NEW PQ identity:"
set -gx PASSAGE_RECIPIENTS (age -d $NEW_ID_FILE | age-keygen -y)

find "$STORE_DIR" -type f -name "*.age" | while read -l file
    set -l rel_path (string replace "$STORE_DIR/" "" $file)
    set -l secret_name (string replace ".age" "" $rel_path)
    
    echo "Re-encrypting: $secret_name"
    passage show "$secret_name" | passage insert -m "$secret_name"
end

set -e PASSAGE_RECIPIENTS
set -e PASSAGE_IDENTITIES_FILE
echo "Done!"