$ git clone -q https://github.com/biox/pa.git
$ cd pa/contrib
$ ls -1 -p
pa-bemenu
pa-completion.bash
pa-completion.fish
pa-dmenu
pa-fuzzel
pa-pass
pa-rekey
pa-rofi
pa-ssg
pa-urn
pa-wmenu
$ nl -b a -s ' ' -w 3 pa-rekey
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
#!/bin/sh
#
# rotate keys and reencrypt passwords
#
# Reuse identities file: export PA_IDENTITIES=~/.local/share/pa/identities
# Reuse recipients file: export PA_RECIPIENTS=~/.local/share/pa/recipients

die() {
    printf '%s: %s.\n' "$(basename "$0")" "$1" >&2
    exit 1
}

age=$(command -v age || command -v rage) ||
    die "age not found, install per https://age-encryption.org"

age_keygen=$(command -v age-keygen || command -v rage-keygen) ||
    die "age-keygen not found, install per https://age-encryption.org"

# Restrict permissions of any new files to only the current user.
umask 077

basedir=${XDG_DATA_HOME:=$HOME/.local/share}/pa
: "${PA_DIR:=$basedir/passwords}"

realstore=$(realpath "$PA_DIR") ||
    die "couldn't get path to password directory"

tmpdir=$basedir/tmp

mkdir "$tmpdir" ||
    die "couldn't create temporary directory"

trap 'rm -rf "$tmpdir"; exit' EXIT
trap 'rm -rf "$tmpdir"; trap - INT; kill -s INT 0' INT

cp -Rp "$realstore" "$tmpdir/passwords" ||
    die "couldn't copy password directory"

# Remove git repository for forward secrecy.
rm -rf "$tmpdir/passwords/.git"

[ "$PA_IDENTITIES" ] && cp "$PA_IDENTITIES" "$tmpdir/identities"
[ "$PA_RECIPIENTS" ] && cp "$PA_RECIPIENTS" "$tmpdir/recipients"

$age_keygen >>"$tmpdir/identities" 2>/dev/null
$age_keygen -y "$tmpdir/identities" >>"$tmpdir/recipients" 2>/dev/null

pa l | while read -r name; do
    pa s "$name" |
        $age -R "$tmpdir/recipients" -o "$tmpdir/passwords/$name.age" ||
        die "couldn't encrypt $name.age"
done

trap - INT EXIT

rm -rf "$realstore" ||
    die "couldn't remove password directory"

mv "$tmpdir/passwords" "$realstore"
mv "$tmpdir/identities" "$(realpath "$basedir/identities")"
mv "$tmpdir/recipients" "$(realpath "$basedir/recipients")"
rmdir "$tmpdir"

# Recreate git repository if needed.
pa l >/dev/null