Display notice on terminal open if something is wrong

[daviddavo]

I recently migrated from yadm, and I had a small line in my .zshrc that displayed a message in red when the repository was in a dirty state or with unsynced changes.

I know that I could just change yadm <subcommands> with chezmoi git <subcommands>, but is there anything else I should take into account? For example, I know that in chezmoi running chezmoi git pull is not enough, you have to run chezmoi apply. Is it possible to detect when the git repository is synced but chezmoi apply has not been run?

[halostatue]

You can pull and apply in one command with chezmoi update and can check for state correctness with chezmoi verify.

I would recommend against running chezmoi verify in a shell prompt or even on shell launch (unless you have a way of delaying the check to once every 24 hours or so) because chezmoi verify takes quite a bit of time to run, and will trigger biometric authentication or password manager passwords as chezmoi pulls data from external sources (git repos, password managers, etc.) for chezmoi verify, chezmoi apply, chezmoi merge, chezmoi merge-all, and chezmoi diff (perhaps others), and it wouldn’t be clear why that’s happening.

[Lockszmith-GH]

I track changes on my prompt (via oh-my-posh) with the following code:

type -t chezmoi 2>&1 >/dev/null \
&& printf "%s" "$(chezmoi status 2>/dev/null | wc -l)" "," "$(chezmoi git -- status --short | wc -l)"

It shows 2 numbers. First number is the number of lines chezmoi status outputs, the 2nd is the number of changes git reports on the repo.

This helps me not forget if there are pending changes I have not committed yet.
That together with an alias for editing my chezmio managed files, helps me keep track of that.

I'll add links to threads about this when I started figuring out how to do this best, maybe it will help.

[Lockszmith-GH]

@halostatue - an alternative would be to do what I did with externals, having the secrets in a parallel chezmoi environment.

[halostatue]

Yeah, that wouldn’t really be ideal as about ⅓ of my overall templates are using 1Password for configuration retrieval. The problem with --refresh-secrets=never is that it hides real changes. If I change an AWS credential set in 1Password, a change should be recognized when I run chezmoi apply or show as a diff when I run chezmoi diff. Granted, my .chemzoi.toml.tmpl is way too complex, suggesting that I need to push that complex configuration itself into 1Password as a document (or documents) so that it can be parsed and executed that way and then my chezmoi.toml is a thin configuration pointing to those documents for processing.

That would not, however, at all help this situation, and I don’t think that there is a meaningful way for chezmoi verify or chezmoi status to happen silently in the background.

You could do something like this (untested Fish 3.4+ script; I don’t remember how to do this in zsh):

function __check_chezmoi_status --on-variable PWD
  set --local checkfile $HOME/.cache/chezmoi/statuscheck
  set --local check false

  if test -f $checkfile
    if test (math 'abs('(date +%s) - (path mtime $checkfile)')') -gt 86400
      set check true
    end
  else
    set check true
  end

  touch $checkfile

  if $check
    echo "Checking chezmoi state for unapplied changes... (you may be prompted for credentials)"
    chezmoi verify || echo "chezmoi state is out of date"
  end
end

Basically, every time $PWD updates (on cd), see if the last time that $checkfile was touched. If it was more than 24 hours ago, run chezmoi verify after prompting and print a message if it is out of date.

The equivalent in zsh would be to add it to a preexec function and in bash would be to hook it into prompt display somehow, but I stopped using both shells as login shells years ago.

[twpayne]

Similar to --refresh-externals=never wouldn't it be possible to implement a 'skip' mechanism for secrets?

Not easily. Secrets are retrieved by template functions in templates. To know if the secret-retrieving template function is used, chezmoi has to execute the template, by which time it is too late.

What you could do is use a $NO_SECRETS environment variable in combination with your .chezmoiignore file and ignore files that you know contain secrets when it is set, i.e. put something like the following in your .chezmoiignore:

{{ if env "NO_SECRETS" }}
.file_with_secret
{{ end }}

This will cause chezmoi to ignore .file_with_secret when the $NO_SECRETS environment variable is set.

Fundamentally, the problem here is that your password manager is painful to use. My suggestion is that, rather than adding complicated logic to chezmoi to work around your painful password manager, you should use a more user-friendly password manager instead.

[halostatue]

FWIW, @twpayne, it’s not that password managers are painful, it’s that what was requested was specifically to run a check in the background as part of a prompt check (similar to the various git information collections in prompts).

Just as when you run curl foo | bash - you would be suspicious if you saw a Password: prompt, I would be suspicious if, randomly, I got the 1Password biometric authentication request. I’m trying to discourage such a thing without a visible tag because it sort of requests elevated privileges "at random".

[daviddavo]

Yes, I can configure my password manager so it keeps the session open for a week if I wanted to. But I don't really want to keep my session open very long (just 1 minute)...

I will use the "check if 24 hours passed" approach, but asking if I want to open the DB now or later (just as oh-my-zsh does if there is an update)