add -d/--decrypt option to decrypt a file to stdout

[whentze]

See #154 (comment) for some discussion.

The implementation is not super pretty, but works. Feel free to pick on the style.
I also replaced one of the EDITOR=cat invocations in the integration test with usage of this option.

Speaking of which, that test takes forever to run for me, it seems to wait for 5 minutes for sshd to time out. Is that expected? Maybe something related to missing entropy?

[ryantm]

Speaking of which, that test takes forever to run for me, it seems to wait for 5 minutes for sshd to time out. Is that expected? Maybe something related to missing entropy?

$ time nix flake check

real  0m13.916s
user  0m10.053s
sys 0m2.026s

[ryantm]

looks reasonable to me, thanks!

[ryantm]

There is a subtle problem with this! It leaves the CLEARTEXT_DIR around after the program exits. We should fix this because it is a security issue in my opinion.

[n8henrie]

@ryantm I have been wondering / worrying about this possibility (leaving behind a decrypted temp file) as complexity grows.

What would you think about adding a trap "rm -f \"$TEMPFILE\"" EXIT or equivalent right after the creation of the tempfile, as a little extra insurance?

[ryantm]

We should add tests for it.

[whentze]

Oh damn, good catch! Will fix.

[n8henrie]

This PR adds a bash-style [[ test, as opposed to the POSIX-style that has been exclusively used so far.

@ryantm Do you have a strong preference for keeping the POSIX-style? I don't imagine nix will move away from bash anytime soon, and going to the former is a little easier to use in some cases and would quiet another shellcheck warning (that I silenced in #160, I don't think this lint is enabled by default).

[ryantm]

I'm okay with using Bash style tests if needed.

[whentze]

@n8henrie I didn't add the bash-style tests, only moved them around. They're already on main: https://github.com/ryantm/agenix/blob/main/pkgs/agenix.sh#L120

[whentze]

We should add tests for it.

Done, and as you said, the secret indeed stays around. Next up, I will make that test pass :)

[whentze]

Done, and the test passes now.

[ryantm]

looks good now! I rebased it on main, squashed it down to one commit, copied the CLI help output to the readme, changed the capitalization of the help output slightly