[wiki] Add a postmortem documenting sshyp's flaws

.github/workflows/codeql-analysis.yml

@@ -1,72 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ "main" ]
-  schedule:
-    - cron: '34 22 * * 5'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'python' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
-        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        
-        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
-
-        
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-    #   If the Autobuild fails above, remove it and uncomment the following three lines. 
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
-
-    # - run: |
-    #   echo "Run, Build Application using script"
-    #   ./location_of_script_within_repo/buildscript.sh
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2

.gitignore

@@ -1 +1,2 @@
-*
+/output
+/port-jobs/working

README.md

@@ -2,13 +2,10 @@
 
 [![release](https://img.shields.io/github/v/release/rwinkhart/sshyp)](https://github.com/rwinkhart/sshyp/releases)
 ![python](https://img.shields.io/badge/python-3.8--3.12-yellow)
-[![downloads](https://img.shields.io/github/downloads/rwinkhart/sshyp/total)](https://github.com/rwinkhart/sshyp/releases)
-
-[![CodeQL](https://github.com/rwinkhart/sshyp/actions/workflows/codeql-analysis.yml/badge.svg?branch=main)](https://github.com/rwinkhart/sshyp/actions/workflows/codeql-analysis.yml)
 
 pronounced as: 'sheep', 'shēp'
 
-sshyp is a very simple self-hosted, synchronized password manager for UNIX(-like) systems (currently Haiku/FreeBSD/Linux).
+sshyp is a self-hosted, synchronized password manager for UNIX(-like) systems (currently Haiku/FreeBSD/Linux). It has been succeeded by [MUTN](https://github.com/rwinkhart/MUTN) due to its many [flaws](https://github.com/rwinkhart/sshyp/blob/main/wiki/postmortem.md).
 
 sshyp is compatible with entries created by pass/password-store, as its original goal was to be like pass/password-store, but far more user-friendly to synchronize with a self-hosted server.
 
@@ -17,28 +14,14 @@ sshyp makes use of a custom sftp wrapper, called sshync (ssh+sync), to reliably
 The name "sshyp" is a combination of its synchronization library, "sshync", and "passwords".
 
 # WARNING
-It is your responsibility to assess the security and stability of "sshyp" before using it and ensure it meets your needs.
-I am not responsible for any data loss or breaches of your information resulting from the use of "sshyp".
-"sshyp" is a new project that is constantly being updated, and though safety and security are priorities, they cannot be guaranteed.
-
-Always check the [known bugs](https://github.com/rwinkhart/sshyp/wiki/Known-Bugs) list before updating or installing sshyp.
-
-# Mission Statement
-sshyp aims to make it as simple as possible to manage passwords and notes via CLI across multiple devices in a secure, self-hosted fashion.
-
-What sshyp can do:
-
-- securely manage a collection of encrypted passwords and notes via CLI
-- generate new, secure passwords to the user's choice in length and complexity
-- securely sync said passwords and notes seamlessly between devices (or just manage them offline)
-- utilize [extensions](https://github.com/rwinkhart/sshyp-labs) to interact with your entries is additional ways (such as generating TOTP keys or managing your entries in a GUI)
-- everything above with entries created by pass/password-store!
-- everything above on Haiku, FreeBSD, Linux, and Termux!
+It is your responsibility to assess the security and stability of sshyp and to ensure it meets your needs before using it.
+I am not responsible for any data loss or breaches of your information resulting from the use of sshyp.
+sshyp has not been extensively tested by the public; safety and security are priorities, but they cannot be guaranteed.
 
 # Installation
-**Important:** *Shell completions (both Bash and ZSH) may require additional configuration on some distributions - please see [this page](https://github.com/rwinkhart/sshyp/wiki/Completions) of the wiki for support.*
+**Important:** *Shell completions (both Bash and ZSH) may require additional configuration on some distributions - please see [this page](https://github.com/rwinkhart/sshyp/blob/main/wiki/completions.md) of the wiki for support.*
 
-Please see the [installation guide](https://github.com/rwinkhart/sshyp/wiki/Installation) in the sshyp wiki for directions specific to your distribution/OS.
+Please see the [installation guide](https://github.com/rwinkhart/sshyp/blob/main/wiki/install.md) in the sshyp wiki for directions specific to your distribution/OS.
 
 Pre-built packages exist for Haiku, FreeBSD, Alpine Linux, Debian/Ubuntu Linux, Fedora Linux, Termux, and WSL. These can be downloaded from the releases page.
 
@@ -74,13 +57,29 @@ Please note that decrypting and reading entries is disabled on server devices fo
 
 All available options can be found with `sshyp help`, or alternatively, in the man page.
 
-# Roadmap
-Short-term Goals:
+# Roadmap (successor)
 
-- implement a method for tracking how long it has been since a password has been changed (password aging)
-- find and fix more bugs
+[MUTN](https://github.com/rwinkhart/MUTN) has been developed as a direct successor to sshyp. It is not yet at release v1.0.0, therefore breaking changes will be made.
 
-Long-term Goals:
+If you're interested in migrating to MUTN early, please see the [migration guide](https://github.com/rwinkhart/libmutton/blob/main/wiki/migration.md).
 
-- migrate from gpg to a better-suited utility focused on symmetric cipher encryption
-- seize the thrones, shear the humans
+Some key differences are:
+- Modularity/Maintainability
+    - MUTN is based off of [libmutton](https://github.com/rwinkhart/libmutton), enabling third-party clients
+    - Due to the modularity of the code, there will be no more "extension" support
+        - sshyp-mfa functionality is built into the successor
+    - Server and client code are now two completely separate projects
+        - This greatly simplifies the code and makes it easier to maintain
+        - This also means that third-party clients do not need to maintain separate server code
+- Stability
+    - sshyp has a track record of making breaking changes in most of its updates
+        - This will not be the case with MUTN (starting with release v1.0.0)
+- Efficiency
+    - MUTN is written in a compiled language (Go)
+        - This means that encryption and SSH-sync can be done natively in Go rather than relying on GnuPG/OpenSSH (this is possible with Python, but it would require users to install third-party libraries)
+    - MUTN makes small tweaks to the design established by sshyp to make user interactions less frustrating
+- Platform support
+    - MUTN was built from the ground-up to support both UNIX-like platforms AND Windows
+        - Unfortunately, using Go means dropping Haiku support, as newer versions of Go do not (yet) support Haiku
+
+From this point forward, sshyp will only receive minimal support (as needed) and transitional updates.

commit.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
 sed -i 's/[[:space:]]*$//' ./lib/* ./port-jobs/* ./package.sh
-git add -f extra lib/sshyp.py lib/sshync.py lib/stweak.py lib/clipclear.py port-jobs share LICENSE README.md package.sh commit.sh .gitignore
-git commit -m "$1"
+git commit -am "$1"
 git push

extra/changelog-archive/2024

@@ -1,3 +1,25 @@
+sshyp v1.5.3
+01/08/2024
+
+the fortified flock update - patch three
+
+this release is a quick hot-fix for some bugs that were noticed after the release of v1.5.2
+
+fixes/optimizations:
+
+- fixed a regression with the entry list causing entries not part of a subdirectory to appear 
+in-line with the entry list header
+- fixed extension group ownership under FreeBSD
+    ^ the "wheel" group is now used where previously the non-existent "root" group was used
+- fixed notes sometimes being appended in the wrong position after editing an incomplete entry
+- addressed flake8 suggestions (slight optimization)
+- removed unnecessary empty variable declarations
+    ^ these were previously included to silence PyCharm's PEP8 warnings
+    ^ the project is now primarily developed in VSCodium with the flake8 linter
+    ^ the only change to flake8 defaults in the line length limit (79->120)
+
+<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
+
 sshyp v1.5.2
 01/07/2024
 

extra/manpage

@@ -1,4 +1,4 @@
-.TH sshyp 1 "07 January 2024" "v1.5.2" "sshyp man page"
+.TH sshyp 1 "08 January 2024" "v1.5.3" "sshyp man page"
 .SH NAME
 \fBsshyp\fR - Simple, self-hosted, synchronized password management for UNIX(-like) systems. Alternative to (and compatible with) pass/password-store.
 .SH SYNOPSIS

lib/sshyp.py

@@ -24,6 +24,8 @@ def entry_list_gen(_directory=f"{home}/.local/share/sshyp/"):
         _color_alternator = 1
         if _ran:
             print(f"\n\n\u001b[38;5;7;48;5;8m{_root.replace(f'{home}/.local/share/sshyp', '', 1)}/\u001b[0m")
+        elif _root == f"{home}/.local/share/sshyp/" and len(_files) > 0:
+            print("\n\n\u001b[38;5;7;48;5;8m/\u001b[0m")
         _char_counter = 0
         for _filename in sorted(_files):
             if _color_alternator > 0:
@@ -50,7 +52,7 @@ def entry_reader(_decrypted_entry):
     if pass_show:
         _entry_password = f'\u001b[38;5;10m{_decrypted_entry[0]}\u001b[0m'
     else:
-        _entry_password = f'\u001b[38;5;3mend command in "--show" or "-s" to view\u001b[0m'
+        _entry_password = '\u001b[38;5;3mend command in "--show" or "-s" to view\u001b[0m'
     print()
     for _num in range(len(_decrypted_entry)):
         try:
@@ -67,7 +69,7 @@ def entry_reader(_decrypted_entry):
                 print('\u001b[38;5;7;48;5;8mnotes:\u001b[0m\n' + _decrypted_entry[_num])
             if _notes_flag == 1:
                 try:
-                    _line_test = _decrypted_entry[_num + 1]
+                    _ = _decrypted_entry[_num + 1]
                 except IndexError:
                     print()
         except IndexError:
@@ -136,17 +138,15 @@ def edit_note(_note_lines, _exit_on_match=False):
     return _new_note
 
 
-# encrypts an entry and cleans up the temporary files
+# encrypts an entry
 def encrypt(_entry_data, _entry_dir, _gpg_id):
     _bytes_data = '\n'.join(_entry_data).rstrip().encode()
     _encrypted_data = run(('gpg', '-qr', str(_gpg_id), '-e'), input=_bytes_data, stdout=PIPE).stdout
     open(_entry_dir + '.gpg', 'wb').write(_encrypted_data)
 
 
-# decrypts an entry to a temporary directory
+# decrypts an entry and returns its contents
 def decrypt(_entry_dir, _quick_verify=None, _quick_pass=None):
-    _contents = None
-
     # check quick-unlock status, fetch passphrase
     if _quick_verify:
         _quick_pass = whitelist_verify(port, username_ssh, ip, client_device_id, identity)
@@ -251,13 +251,14 @@ def target_type_check(_target_name, _expected_type=True, _error=False):
         s_exit(2)
 
 
-# ensures an edited entry is optimized for best compatibility
-def line_edit(_lines, _edit_data, _edit_line):
+# ensures an entry has enough lines to complete an edit and optionally carries out the edit
+def line_edit(_lines, _edit_line, _edit_data=None):
     # ensure enough lines are present for edited field
     while len(_lines) < _edit_line + 1:
         _lines.append('')
-    # write the edited field
-    _lines[_edit_line] = _edit_data.rstrip()
+    if _edit_data is not None:
+        # write the edited field
+        _lines[_edit_line] = _edit_data.rstrip()
     return _lines
 
 
@@ -296,7 +297,7 @@ def print_info():
  }}-}}-*]{4 * ' '}`..'..'{9 * ' '}\u001b[0m♥♥♥\u001b[0m{9 * ' '}`..'..'{6 * ' '}|
 {4 * ' '}◎-◎{4 * ' '}//{3 * ' '}\\\\{10 * ' '}\u001b[38;5;9m♥\u001b[0m{10 * ' '}//{3 * ' '}\\\\{5 * ' '}/|\\""")
         print(f"{_border}{_blank}\n\u001b[38;5;7;48;5;8m\\\u001b[38;5;15;48;5;15m{18 * ' '}\u001b[38;5;15;48;5;8msshyp "
-              f"version 1.5.2\u001b[38;5;15;48;5;15m{18 * ' '}\u001b[38;5;7;48;5;8m/\u001b[0m")
+              f"version 1.5.3\u001b[38;5;15;48;5;15m{18 * ' '}\u001b[38;5;7;48;5;8m/\u001b[0m")
         print(f"\u001b[38;5;7;48;5;8m\\\u001b[38;5;15;48;5;15m{14 * ' '}\u001b[38;5;15;48;5;8mthe fortified flock"
               f" update\u001b[38;5;15;48;5;15m{15 * ' '}\u001b[38;5;7;48;5;8m/\u001b[0m\n{_blank}")
         print(f"\u001b[38;5;7;48;5;8m\\\u001b[38;5;15;48;5;15m{9 * ' '}\u001b[38;5;15;48;5;8mcopyright 2021-2024 ",
@@ -471,9 +472,6 @@ def rename():
 
 # edits the contents of an entry
 def edit():
-    # set to avoid PEP8 warnings
-    _detail, _edit_line = None, None
-
     # ensure the edit target is an entry
     target_type_check(entry_name, True, True)
 
@@ -486,10 +484,10 @@ def edit():
         _detail, _edit_line = str(input('\nurl: ')), 2
     if arguments[2] in ('note', '-n'):
         _old_lines = decrypt(directory + entry_name, _quick_verify=quick_unlock_enabled)
-        _new_lines = _old_lines[0:3] + edit_note(_old_lines[3:], True).split('\n')
+        # pass 2 as _edit_line to simulate a full entry minus notes so that notes are appended correctly
+        _new_lines = line_edit(_old_lines[0:3], 2) + edit_note(_old_lines[3:], True).split('\n')
     else:
-        _new_lines = line_edit(decrypt(directory + entry_name, _quick_verify=quick_unlock_enabled), _detail,
-                               _edit_line)
+        _new_lines = line_edit(decrypt(directory + entry_name, _quick_verify=quick_unlock_enabled), _edit_line, _detail)
     print('\n\u001b[1mentry preview:\u001b[0m')
     entry_reader(_new_lines)
     encrypt(_new_lines, directory + entry_name, gpg_id)
@@ -497,13 +495,11 @@ def edit():
 
 # generates a password for a new or an existing entry
 def gen():
-    # set to avoid PEP8 warnings
-    _username, _url, _notes = None, None, None
     # gen update
     if arg_count == 3 and arguments[2] in ('update', '-u'):
         # ensure the gen update target is an entry
         target_type_check(entry_name, True, True)
-        _new_lines = line_edit(decrypt(directory + entry_name, _quick_verify=quick_unlock_enabled), pass_gen(), 0)
+        _new_lines = line_edit(decrypt(directory + entry_name, _quick_verify=quick_unlock_enabled), 0, pass_gen())
     # gen
     else:
         # make sure the gen target does not already exist
@@ -614,9 +610,6 @@ if __name__ == "__main__":
         # set default states
         ssh_error, success_flag, sync_flag, silent_sync, pass_show = False, False, False, False, False
 
-        # set to avoid PEP8 warnings
-        arg_start, device_type, offline_mode_enabled = None, None, None
-
         # retrieve typed argument
         arguments = argv[1:]
         arg_count = len(arguments)

lib/stweak.py

@@ -142,9 +142,9 @@ def gpg_config():
     if _gpg_id_sel == len(_named_uid_list) - 1:
         if not isfile(f"{home}/.config/sshyp/gpg-gen"):
             open(f"{home}/.config/sshyp/gpg-gen", 'w').writelines([
-                'Key-Type: 1\n', 'Key-Length: 4096\n', 'Key-Usage: sign encrypt\n', 'Name-Real: sshyp\n',
-                'Name-Comment: gpg-sshyp\n', 'Name-Email: github.com/rwinkhart/sshyp\n',
-                'Expire-Date: 0'])
+                'Key-Type: eddsa\n', 'Key-Curve: ed25519\n', 'Key-Usage: sign\n', 'Subkey-Type: ecdh\n',
+                'Subkey-Curve: cv25519\n', 'Subkey-Usage: encrypt\n', 'Name-Real: sshyp\n',
+                'Name-Comment: gpg-sshyp\n', 'Name-Email: github.com/rwinkhart/sshyp\n', 'Expire-Date: 0'])
         curses_radio(['okay'], 'gpg key generation may take some time (especially on slower devices)\n\nselect "okay" '
                                'to start\n\ndo not terminate this process!')
         try:
@@ -478,8 +478,8 @@ def extension_downloader():
     if _choice == 1:
         # download extension files to temporary directory
         _exe_dir, _ini_dir = f"{gettempdir()}/sshyp_exe", f"{gettempdir()}/sshyp_ini"
-        _ext_exe = urlretrieve(_pointer.get(_selected, 'exe'), _exe_dir)
-        _ext_ini = urlretrieve(_pointer.get(_selected, 'ini'), _ini_dir)
+        urlretrieve(_pointer.get(_selected, 'exe'), _exe_dir)
+        urlretrieve(_pointer.get(_selected, 'ini'), _ini_dir)
         # set permissions under active user
         chmod(_exe_dir, 0o755)
         chmod(_ini_dir, 0o644)
@@ -718,7 +718,12 @@ def wrapped_entry(_gm_device_type, _gm_top_message='configuration options:'):
                 # install with privilege escalation (outside of curses)
                 from tempfile import gettempdir
                 _exe_dir, _ini_dir = f"{gettempdir()}/sshyp_exe", f"{gettempdir()}/sshyp_ini"
-                run((_escalator, 'chown', 'root:root', _exe_dir, _ini_dir))
+                # PORT START TWEAK-EXT-CHOWN
+                if uname()[0] == 'FreeBSD':
+                    run((_escalator, 'chown', 'root:wheel', _exe_dir, _ini_dir))
+                else:
+                    run((_escalator, 'chown', 'root:root', _exe_dir, _ini_dir))
+                # PORT END TWEAK-EXT-CHOWN
                 run((_escalator, 'mv', _exe_dir, f"/usr/lib/sshyp/{_ext_name}"))
                 run((_escalator, 'mv', _ini_dir, f"/usr/lib/sshyp/extensions/{_ext_name}.ini"))
             else:

package.sh

@@ -21,6 +21,7 @@ _create_generic_linux() {
     cd port-jobs
     ./CLIPTOOL.py LINUX
     ./CLIPBOARD.py LINUX
+    ./CHOWN.py
     ./UNAME.py LINUX
     ./COMMENTS.py ALL
     ./BLANKS.py
@@ -158,6 +159,7 @@ urls {
     ./RMEXTMAN.py
     ./CLIPTOOL.py
     ./CLIPBOARD.py HAIKU
+    ./CHOWN.py
     ./UNAME.py TMP
     ./COMMENTS.py ALL
     ./BLANKS.py
@@ -200,6 +202,7 @@ _create_deb() {
         ./CLIPBOARD.py WSL
         special=WSL-ONLY-DEBIAN
     fi
+    ./CHOWN.py
     ./UNAME.py LINUX
     ./COMMENTS.py ALL
     ./BLANKS.py
@@ -253,6 +256,7 @@ _create_termux() {
     ./RMEXTMAN.py
     ./CLIPTOOL.py
     ./CLIPBOARD.py TERMUX
+    ./CHOWN.py
     ./UNAME.py TERMUX
     ./COMMENTS.py ALL
     ./BLANKS.py
@@ -326,6 +330,7 @@ cp -r %%{_sourcedir}/usr %%{buildroot}
     cd port-jobs
     ./CLIPTOOL.py LINUX
     ./CLIPBOARD.py LINUX
+    ./CHOWN.py
     ./UNAME.py LINUX
     ./COMMENTS.py ALL
     ./BLANKS.py
@@ -390,6 +395,7 @@ printf "/usr/bin/sshyp
     cd port-jobs
     ./CLIPTOOL.py LINUX
     ./CLIPBOARD.py BSD
+    ./CHOWN.py BSD
     ./UNAME.py TMP
     ./COMMENTS.py ALL
     ./BLANKS.py

port-jobs/CHOWN.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+import re
+from sys import argv
+
+# read arguments
+arguments = argv[1:]
+
+# define PORT target
+string1 = '# PORT START TWEAK-EXT-CHOWN'
+string2 = '# PORT END TWEAK-EXT-CHOWN'
+
+# define replacement text depending on arguments
+if len(arguments) > 0 and arguments[0] == 'BSD':
+    replacement = "run((_escalator, 'chown', 'root:wheel', _exe_dir, _ini_dir))"
+else:
+    replacement = "run((_escalator, 'chown', 'root:root', _exe_dir, _ini_dir))"
+
+# read input file
+text = open('working/stweak.py', 'r').read()
+
+# compile regex and modify text
+regex = re.compile(f"{string1}.*?{string2}", re.DOTALL)
+
+# find and replace the defined PORT target
+new_text = re.sub(regex, replacement, text)
+
+# write updated text
+open('working/stweak.py', 'w').write(new_text)

wiki/bugs.md

@@ -0,0 +1,4 @@
+## Known Bugs
+No bugs are currently documented within sshyp, but this is due to a lack of current testing (bugs most certainly exist).
+
+Development and testing efforts have been re-focused on [MUTN](https://github.com/rwinkhart/MUTN) and [libmutton](https://github.com/rwinkhart/libmutton).

wiki/clipboard.md

@@ -0,0 +1,13 @@
+## Clipboard Troubleshooting
+### Clipboard managers can break sshyp
+***
+The intended way for sshyp to interact with the system clipboard is for it to clear it 30 seconds after copying a field. **Unfortunately, this does not work by default on all systems due to the prevalence of clipboard managers.**
+
+Clipboard managers save a history of what has been copied to the clipboard, which is already a big enough issue on its own for people who copy sensitive information to their clipboard. Some **clipboard managers simply will not allow the clipboard to be empty** and will replace its contents with the last copied item if you attempt to clear it. One such naughty clipboard manager is **KDE Klipper**, which comes **packaged into KDE Plasma** and is typically **enabled by default** on most distributions. Due to this behavior, **KDE Klipper breaks sshyp's clipboard clearing functionality** and should not be left enabled.
+
+It is likely other popular clipboard managers exhibit this behavior. I noticed it with KDE Klipper, which is what prompted me to create this wiki page. **Clipboard managers should not be enabled by default in any environment** or distribution due to their **potential security implications**.
+### Termux cannot clear the clipboard from the background
+
+***
+
+If using the Termux (Android) version of sshyp, the clipboard may not successfully be cleared after the 30 second timeout period if Termux is not actively in the foreground when the sleep timer expires. This is an unfortunate side-effect of running on Android and cannot be easily fixed. Due to Termux being at the bottom of the platform support priority list, I will not be investing time into working around this.

wiki/completions.md

@@ -0,0 +1,26 @@
+## Shell Completions Troubleshooting
+ZSH completions not working? Make sure your ~/.zshrc contains the following:
+```
+autoload -Uz compinit && compinit
+```
+...and then restart your shell.
+***
+Bash completions not working? Install your distribution's 'bash-completion' package or source the completion script manually.
+
+For most environments, this would mean adding the following to your ~/.bashrc:
+```
+source /usr/share/bash-completion/completions/sshyp
+```
+Note that this directory is different on FreeBSD and Haiku.
+
+FreeBSD:
+```
+source /usr/local/share/bash-completion/completions/sshyp
+```
+Haiku:
+```
+source /system/data/bash-completion/completions/sshyp
+```
+...and then restart your shell.
+
+*Please note that Bash completions are slightly more limited than ZSH completions, and as such, new entries will not be auto-completed until the completions script is re-sourced.*

wiki/install.md

@@ -0,0 +1,15 @@
+**Note:** [Shell completions may require additional configuration to work](https://github.com/rwinkhart/sshyp/blob/main/wiki/completions.md).
+
+[Haiku](https://github.com/rwinkhart/sshyp/blob/main/wiki/installationGuides/haiku.md)
+
+[FreeBSD](https://github.com/rwinkhart/sshyp/blob/main/wiki/installationGuides/freebsd.md)
+
+[Alpine Linux](https://github.com/rwinkhart/sshyp/blob/main/wiki/installationGuides/alpine.md)
+
+[Arch Linux](https://github.com/rwinkhart/sshyp/blob/main/wiki/installationGuides/arch.md)
+
+[Debian/Ubuntu Linux (or WSL)](https://github.com/rwinkhart/sshyp/blob/main/wiki/installationGuides/debian.md)
+
+[Fedora Linux](https://github.com/rwinkhart/sshyp/blob/main/wiki/installationGuides/fedora.md)
+
+[Termux (Android)](https://github.com/rwinkhart/sshyp/blob/main/wiki/installationGuides/termux.md)

wiki/installationGuides/alpine.md

@@ -0,0 +1,11 @@
+## Installation (Alpine Linux)
+The Alpine Linux package is actively tested on the latest stable release of Alpine Linux.
+***
+1. Download the *.apk file from the [latest tagged release of sshyp](https://github.com/rwinkhart/sshyp/releases)
+
+2. Run `doas apk add --allow-untrusted <path/to/*.apk`
+
+3. sshyp is now installed - run `sshyp init` to get started!
+***
+
+Creating a package from an APKBUILD? Just use `abuild -r` in the same directory as the APKBUILD.

wiki/installationGuides/arch.md

@@ -0,0 +1,10 @@
+## Installation (Arch Linux)
+The Arch package is actively tested on up-to-date installations of Arch and Artix Linux.
+***
+The easiest method of installation is via the AUR. Search for "sshyp" using your favorite AUR helper or run:
+```
+git clone https://aur.archlinux.org/sshyp.git
+cd sshyp
+makepkg -si
+```
+sshyp is now installed - run `sshyp init` to get started!

wiki/installationGuides/debian.md

@@ -0,0 +1,12 @@
+## Installation (Debian/Ubuntu)
+The Debian/Ubuntu package is actively tested on Debian 12 (standard) and Ubuntu 22.04 (WSL).
+
+_OpenSSH warning:_ Sync support requires OpenSSH >= 8.7, meaning **Debian 12 (Bookworm)** is the minimum supported version.
+***
+1. Download the *.deb file from the [latest tagged release of sshyp](https://github.com/rwinkhart/sshyp/releases)
+
+   ^ do not download the version ending in *_termux.deb by mistake!
+
+2. Run `sudo dpkg -i <path/to/*.deb>; sudo apt install -f`
+
+3. sshyp is now installed - run `sshyp init` to get started!

wiki/installationGuides/fedora.md

@@ -0,0 +1,10 @@
+## Installation (Fedora)
+The Fedora package is actively tested on the latest version of Fedora Linux.
+
+This package may be install-able on other Red Hat-based distributions, but it is only tested with the latest version of Fedora.
+***
+1. Download the *.rpm file from the [latest tagged release of sshyp](https://github.com/rwinkhart/sshyp/releases)
+
+2. Run `sudo dnf localinstall <path/to/*.rpm>`
+
+3. sshyp is now installed - run `sshyp init` to get started!

wiki/installationGuides/freebsd.md

@@ -0,0 +1,10 @@
+## Installation (FreeBSD)
+The FreeBSD package is actively tested on the latest version of FreeBSD 14 and should be fully functional on at least FreeBSD 13+.
+***
+1. Download the *.pkg file from the [latest tagged release of sshyp](https://github.com/rwinkhart/sshyp/releases)
+
+2. Run `sudo pkg add <path/to/*.pkg>`
+
+   ^ the install may fail if you are missing any dependencies - please install the dependencies reported by the package manager and try again
+
+3. sshyp is now installed - run `sshyp init` to get started!

wiki/installationGuides/haiku.md

@@ -0,0 +1,14 @@
+## Installation (Haiku)
+**Missing features:** For security and technical reasons, the Haiku version of sshyp cannot be used as a server (it only functions as a client). Additionally, the Haiku package does not support the extension management system, so extensions still must be installed as separate packages.
+
+Please note that sshyp for Haiku is targeting release R1 Beta 4 (64-bit). Previous releases have significant show-stopping bugs, while stability on the nightly releases cannot be guaranteed.
+***
+1. Download the *.hpkg file from the [latest tagged release of sshyp](https://github.com/rwinkhart/sshyp/releases)
+
+2. Open the downloaded file and click "Install sshyp" in the top right of the window
+
+   **or**
+
+   Run `pkgman install <path/to/*.hpkg>`
+
+3. sshyp is now installed - run `sshyp init` to get started!

wiki/installationGuides/termux.md

@@ -0,0 +1,16 @@
+## Installation (Termux)
+**Missing features:** For technical reasons, the Termux version of sshyp cannot be used as a server (it only functions as a client). Additionally, the Termux package does not support the extension management system, so extensions still must be installed as separate packages.
+
+The Termux package is minimally tested. Attempts to maintain compatibility are made and it should be fully functional on the latest versions of Termux+Termux:API (F-Droid versions), but newer features are more likely to be broken than on other platforms.
+***
+1. Install the Termux application from [F-Droid](https://f-droid.org/en/packages/com.termux/)
+
+2. Install the Termux API from [F-Droid](https://f-droid.org/en/packages/com.termux.api/) (for clipboard support)
+
+3. From within Termux, run `curl -L <github/link/to/latest/*_termux.deb> -o sshyp.deb`
+
+   ^ copy the required download link from the [latest tagged release of sshyp](https://github.com/rwinkhart/sshyp/releases)
+
+4. From within Termux, run `dpkg -i sshyp.deb; pkg install -f`
+
+5. sshyp is now installed - run `sshyp init` to get started!

wiki/postmortem.md

@@ -0,0 +1,27 @@
+## Postmortem
+### Reflecting on the Flaws of sshyp
+Due to being my introduction to the world of programming, sshyp contains many flaws that have been addressed with the creation of [MUTN](https://github.com/rwinkhart/MUTN).
+
+Many of these flaws are the result of a lack of direction for the project.
+In the beginning, sshyp was actually called "rpass" and was meant to be a simple wrapper for pass/password-store with rsync integration for synchronization.
+I quickly ran into issues using rsync and pivoted to using sftp, thus necessitating the rebrand to "sshyp".
+sshyp grew to become its own standalone password manager with no relation to pass/password-store (except for entry import compatibility).
+
+In terms of technical flaws resulting from a lack of experience, here is a non-exhaustive list:
+- Port jobs are unnecessarily complex and difficult to maintain; they made working on the project into a chore
+- Extensions are unnecessarily complex and their functionality is better left to third-party clients
+    - Delegating functionality to extensions meant poor integration with the entry format, help menus, and shell completions
+- Due to sshyp being a program with no underlying library, third-party clients are not very feasible
+    - Not having a library with the goal of change stability led to breaking changes in nearly every release of sshyp
+- Python was a poor choice for my personal desire of portability, as dependencies must be independently installed on each system
+    - This led to me avoiding all non-standard libraries, which meant relying on system binaries for things like GPG and SSH
+        - This meant taking into account the versions of these binaries shipped by each distribution
+        - Because of this, sshyp was tied to OpenSSH (no support for other SSH implementations)
+        - This also meant launching separate SSH processes for each item being synchronized, making sshyp's synchronization _very_ slow
+- Dynamically typed languages are a poor choice for beginners, as they allow for poor programming practices that create bugs
+    - With sshyp, I attempted to "save memory" by re-using variables for multiple purposes
+    - sshyp also checks variable types, rather than values, as a shortcut for determining a function's exit status
+- sshyp combined the client and server into one package, resulting in lots of unreadable spaghetti code (especially with argument parsing)
+- sshyp was designed in a way where it would be very difficult to port to non-UNIX-like platforms (it would basically necessitate a complete rewrite)
+
+Developing [the successor to sshyp](https://github.com/rwinkhart/MUTN) forced me to confront these flaws and make a better product. It also allowed me the chance to re-consider each design decision; I found a better way of doing nearly everything.

wiki/usage.md

@@ -0,0 +1,6 @@
+## Usage
+**Note:** [Shell completions may require additional configuration to work](https://github.com/rwinkhart/sshyp/blob/main/wiki/completions.md).
+
+Read the man page with `man sshyp`, or [preview it on GitHub](https://github.com/rwinkhart/sshyp/blob/main/extra/manpage).
+
+Please note that the version of the man page on GitHub may not be accurate to the version of sshyp you have installed, as the git version is kept up to date with the source, rather than the latest tagged release.