From 395eed25a9d879391558026bb90cd3acb9afdacf Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 5 Nov 2026 10:22:12 +0100 Subject: content: write HardenedPass getting-started pages Concepts, install, creating a store from zero and connecting the app, in both languages, with screenshots from the test store. Still drafts. Co-Authored-By: Claude Opus 5.5 --- content/en/hardenedpass/getting-started/_index.md | 10 +-- .../hardenedpass/getting-started/concepts/index.md | 68 ++++++++++++++++- .../hardenedpass/getting-started/connect/index.md | 81 +++++++++++++++++++- .../getting-started/connect/pgp-import.png | Bin 0 -> 106999 bytes .../getting-started/connect/repository.png | Bin 0 -> 99383 bytes .../getting-started/connect/ssh-key.png | Bin 0 -> 56540 bytes .../getting-started/connect/store-list.png | Bin 0 -> 58810 bytes .../getting-started/connect/welcome.png | Bin 0 -> 95692 bytes .../getting-started/create-store/index.md | 70 ++++++++++++++++- .../hardenedpass/getting-started/install/index.md | 60 ++++++++++++++- content/it/hardenedpass/getting-started/_index.md | 10 +-- .../hardenedpass/getting-started/concepts/index.md | 70 ++++++++++++++++- .../hardenedpass/getting-started/connect/index.md | 83 ++++++++++++++++++++- .../getting-started/connect/pgp-import.png | Bin 0 -> 121295 bytes .../getting-started/connect/repository.png | Bin 0 -> 109852 bytes .../getting-started/connect/ssh-key.png | Bin 0 -> 68259 bytes .../getting-started/connect/store-list.png | Bin 0 -> 58552 bytes .../getting-started/connect/welcome.png | Bin 0 -> 95117 bytes .../getting-started/create-store/index.md | 71 +++++++++++++++++- .../hardenedpass/getting-started/install/index.md | 60 ++++++++++++++- 20 files changed, 539 insertions(+), 44 deletions(-) create mode 100644 content/en/hardenedpass/getting-started/connect/pgp-import.png create mode 100644 content/en/hardenedpass/getting-started/connect/repository.png create mode 100644 content/en/hardenedpass/getting-started/connect/ssh-key.png create mode 100644 content/en/hardenedpass/getting-started/connect/store-list.png create mode 100644 content/en/hardenedpass/getting-started/connect/welcome.png create mode 100644 content/it/hardenedpass/getting-started/connect/pgp-import.png create mode 100644 content/it/hardenedpass/getting-started/connect/repository.png create mode 100644 content/it/hardenedpass/getting-started/connect/ssh-key.png create mode 100644 content/it/hardenedpass/getting-started/connect/store-list.png create mode 100644 content/it/hardenedpass/getting-started/connect/welcome.png diff --git a/content/en/hardenedpass/getting-started/_index.md b/content/en/hardenedpass/getting-started/_index.md index f825040..6aecc2d 100644 --- a/content/en/hardenedpass/getting-started/_index.md +++ b/content/en/hardenedpass/getting-started/_index.md @@ -1,13 +1,11 @@ +++ title = "Getting started" date = 2026-11-05T00:00:00Z -description = "" +description = "Start here: what pass is, how to install HardenedPass, how to make a password store and connect the app to it." weight = 10 draft = true +++ -Placeholder. - -## First heading - -Text. +Read these pages in order if you have never used `pass`. If you already have a store +in a git repository, install the app and go straight to +[Connect the app]({{< relref "/hardenedpass/getting-started/connect" >}}). diff --git a/content/en/hardenedpass/getting-started/concepts/index.md b/content/en/hardenedpass/getting-started/concepts/index.md index 063dde1..0e4f6c9 100644 --- a/content/en/hardenedpass/getting-started/concepts/index.md +++ b/content/en/hardenedpass/getting-started/concepts/index.md @@ -1,13 +1,73 @@ +++ title = "Concepts" date = 2026-11-05T00:00:00Z -description = "" +description = "The three things HardenedPass is built on, in plain words: pass stores passwords as files, OpenPGP encrypts them, git syncs them." weight = 10 draft = true +++ -Placeholder. +HardenedPass is built on three tools. You do not need to master any of them, but +knowing what each one does makes the rest of these pages easy to follow. -## First heading +## pass: one file per password -Text. +[pass](https://www.passwordstore.org/) is a password manager for Unix systems. It has +no database. Each password is a small encrypted file, and folders group them. That +folder tree is called the **store**. + +``` +store/ +├── .gpg-id +├── example.org.gpg +├── otp/ +│ └── example.com.gpg +└── work/ + └── mail.example.org.gpg +``` + +Once decrypted, an entry is plain text. The first line is the password, and anything +below it is extra information: + +``` +hunter2 +username: alice +url: https://example.org +``` + +HardenedPass reads those lines and shows them as separate fields. Any program that +understands `pass` can open the same store, so your passwords are never locked into +this app. + +## OpenPGP: the lock on each file + +Every entry is encrypted with [OpenPGP](https://www.gnupg.org/), using a **key pair**: + +- The **public key** locks files. It is not secret. +- The **private key** unlocks them. It never leaves your devices. +- The **passphrase** protects the private key, so a copy of the key file alone is + useless to whoever finds it. + +The `.gpg-id` file at the top of the store says which keys entries are encrypted for. + +{{< callout type="danger" title="Back up your private key" >}} +If you lose the private key or forget its passphrase, nobody can decrypt your store. +There is no reset. Keep a copy somewhere safe and offline. +{{< /callout >}} + +## git: sync and history + +[Git](https://git-scm.com/) tracks every change to the store and copies it between +devices through a **remote**, a repository on a server. You change an entry on the +phone, the app records the change and sends it to the remote, and your other devices +fetch it from there. Old versions stay in the history, so a mistake can be undone. + +The server only holds encrypted files, but it can read their **names**. Whoever runs +it can see that you have an entry called `example.org`. Use a private repository, on a +server you trust. + +## How it fits together + +1. On a computer you make a key pair, a store and a remote. +2. On the phone, HardenedPass clones the store from the remote. +3. You import the private key into the app. +4. The app decrypts entries when you open them, and syncs changes through git. diff --git a/content/en/hardenedpass/getting-started/connect/index.md b/content/en/hardenedpass/getting-started/connect/index.md index 067ec6a..87ca4f7 100644 --- a/content/en/hardenedpass/getting-started/connect/index.md +++ b/content/en/hardenedpass/getting-started/connect/index.md @@ -1,13 +1,86 @@ +++ title = "Connect the app" date = 2026-11-05T00:00:00Z -description = "" +description = "How to connect HardenedPass to your store: clone the repository, set up an SSH key or password, import your OpenPGP private key." weight = 40 draft = true +++ -Placeholder. +You need the address of your repository and the file with your private key. If you +have neither, start with [Create a store]({{< relref "/hardenedpass/getting-started/create-store" >}}). -## First heading +## Clone the store -Text. +Open the app and tap **Clone Remote Repo**. + +{{< image src="welcome.png" alt="Welcome screen with the buttons Clone Remote Repo, Create Local Repo and Settings." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +Type the address of your repository in **Repository URL** and choose how to log in +under **Authentication Mode**. + +{{< image src="repository.png" alt="Repository information screen with the URL filled in and SSH key selected as authentication mode." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +These address forms all work: + +| Form | Example | +|---|---| +| SSH, short | `git@git.example.org:store.git` | +| SSH, with a port | `ssh://git@git.example.org:2222/srv/git/store.git` | +| HTTPS | `https://git.example.org/you/store.git` | + +The app warns you about addresses that would not work well: a custom port without +`ssh://`, a port on an HTTPS address, which is not supported, and `git://`, which has +no encryption. + +### With an SSH key + +Tap **Manage** next to the SSH key line. + +{{< image src="ssh-key.png" alt="SSH key screen with the buttons Import SSH key and Generate SSH key pair." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +- **Import SSH key** reads a private key you already have, from a file. +- **Generate SSH key pair** makes a new key on the phone. Ed25519 is the best choice + unless your server is old. **Protect with screen lock credential** makes the app + ask for your screen lock each time it uses the key. + +After generating, the app shows the public key. Add it to your git server, in the +same place you would add a key for a computer. Then go back and tap **Clone**. + +### With a password + +Choose **Password** and tap **Clone**. The app asks for the password when it connects, +and **Remember password** stores it encrypted on the phone. Many hosting services want +an access token here rather than your account password. + +### The server's identity + +On the first SSH connection the app saves the server's host key without asking, and +checks it on every connection after that. If the key changes, syncing stops with an +error. If you know why it changed, tap **Clear saved host key** on the repository +screen. If you do not, stop and find out first: someone could be impersonating your +server. + +## Import your private key + +Once the clone is done, the app shows which key the store is encrypted for, under +**Store recipients**. + +{{< image src="pgp-import.png" alt="Import PGP key screen listing the store's recipient key ID, with an Import PGP key button." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +Tap **Import PGP key** and pick your key file. The app shows the ID of the imported +key: check that it matches. You can tap **Later** to skip this, but no entry can be +opened until a matching key is imported. + +The list of entries opens, and you are done. + +{{< image src="store-list.png" alt="The store list, showing the folders otp and work and the entry example.org." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +Delete the key file from the phone's storage now, as +[Create a store]({{< relref "/hardenedpass/getting-started/create-store" >}}) explains. +The first time you open an entry, the app asks for the key's passphrase. + +## A store without a server + +**Create Local Repo** makes a store that lives only on the phone. Import your private +key, then tap it in the list to create the store for that key. You still need a key +made on a computer, and without a remote nothing protects you if the phone is lost. diff --git a/content/en/hardenedpass/getting-started/connect/pgp-import.png b/content/en/hardenedpass/getting-started/connect/pgp-import.png new file mode 100644 index 0000000..2b01266 Binary files /dev/null and b/content/en/hardenedpass/getting-started/connect/pgp-import.png differ diff --git a/content/en/hardenedpass/getting-started/connect/repository.png b/content/en/hardenedpass/getting-started/connect/repository.png new file mode 100644 index 0000000..7c2494a Binary files /dev/null and b/content/en/hardenedpass/getting-started/connect/repository.png differ diff --git a/content/en/hardenedpass/getting-started/connect/ssh-key.png b/content/en/hardenedpass/getting-started/connect/ssh-key.png new file mode 100644 index 0000000..d4d5887 Binary files /dev/null and b/content/en/hardenedpass/getting-started/connect/ssh-key.png differ diff --git a/content/en/hardenedpass/getting-started/connect/store-list.png b/content/en/hardenedpass/getting-started/connect/store-list.png new file mode 100644 index 0000000..dc99393 Binary files /dev/null and b/content/en/hardenedpass/getting-started/connect/store-list.png differ diff --git a/content/en/hardenedpass/getting-started/connect/welcome.png b/content/en/hardenedpass/getting-started/connect/welcome.png new file mode 100644 index 0000000..b32915a Binary files /dev/null and b/content/en/hardenedpass/getting-started/connect/welcome.png differ diff --git a/content/en/hardenedpass/getting-started/create-store/index.md b/content/en/hardenedpass/getting-started/create-store/index.md index 205e035..378123a 100644 --- a/content/en/hardenedpass/getting-started/create-store/index.md +++ b/content/en/hardenedpass/getting-started/create-store/index.md @@ -1,13 +1,75 @@ +++ title = "Create a store" date = 2026-11-05T00:00:00Z -description = "" +description = "How to create a password store from zero on a computer: make an OpenPGP key, initialize pass, add a private git remote and export the key." weight = 30 draft = true +++ -Placeholder. +If you already have a store in a git repository, skip to +[Connect the app]({{< relref "/hardenedpass/getting-started/connect" >}}). -## First heading +HardenedPass cannot generate OpenPGP keys, so you need a computer for this part, with +[GnuPG](https://www.gnupg.org/), [pass](https://www.passwordstore.org/) and +[git](https://git-scm.com/) installed. Most Linux distributions package all three. -Text. +## Make a key pair + +```bash +gpg --full-generate-key +``` + +Accept the default key type, enter your name and an address, and choose a strong +passphrase. You will type it often, so pick one you can remember. + +## Create the store + +Use the address you gave the key: + +```bash +pass init you@example.org +pass git init +``` + +The first command creates the store in `~/.password-store` and writes `.gpg-id`. The +second turns it into a git repository. + +Add a first entry so that you have something to test with. `-m` lets you type several +lines; finish with Ctrl+D: + +```bash +pass insert -m example.org +``` + +``` +hunter2 +username: alice +``` + +## Add a remote + +Create an **empty, private** repository on a git server you can reach over SSH or +HTTPS. A hosting service works, and so does a server of your own. Then connect the +store to it and send it there: + +```bash +pass git remote add origin git@git.example.org:store.git +pass git push -u origin HEAD +``` + +## Export the private key + +The phone needs a copy of the private key: + +```bash +gpg --armor --export-secret-keys you@example.org > private-key.asc +``` + +{{< callout type="warning" title="Handle this file with care" >}} +Move `private-key.asc` to the phone over USB, not through email or a cloud drive. +Delete every copy from the phone's storage and from the computer once the app has +imported it. The app keeps its own. +{{< /callout >}} + +Also keep a backup of the key offline, for example on an encrypted USB stick. See +[Concepts]({{< relref "/hardenedpass/getting-started/concepts" >}}) for why. diff --git a/content/en/hardenedpass/getting-started/install/index.md b/content/en/hardenedpass/getting-started/install/index.md index 116df07..627261e 100644 --- a/content/en/hardenedpass/getting-started/install/index.md +++ b/content/en/hardenedpass/getting-started/install/index.md @@ -1,13 +1,65 @@ +++ title = "Install" date = 2026-11-05T00:00:00Z -description = "" +description = "How to download the HardenedPass APK from GitHub Releases, verify its checksum and signing certificate, install it and update it." weight = 20 draft = true +++ -Placeholder. +HardenedPass needs Android 8 or newer and works without Google Play Services. It is +not on an app store: you install the APK from the project's releases. -## First heading +## Download -Text. +Open the [latest release](https://github.com/danixland/HardenedPass/releases/latest) +and download both files: + +- `HardenedPass_vX.Y.Z.apk`, the app +- `HardenedPass_vX.Y.Z.apk.sha256`, its checksum + +## Verify the download + +This step needs a computer, and it is worth doing: a password manager is a bad thing +to install from a tampered file. + +Check that the file arrived intact: + +```bash +sha256sum -c HardenedPass_vX.Y.Z.apk.sha256 +``` + +The output must end in `OK`. + +Then check who signed it. `apksigner` is part of the Android SDK build tools: + +```bash +apksigner verify --print-certs HardenedPass_vX.Y.Z.apk +``` + +The `certificate SHA-256 digest` line must read: + +``` +725016669e482f9ac371dee8df19a2a1b34fa76d1af05b2a23784725b1b49c83 +``` + +If either check fails, do not install the file. + +## Install + +Copy the APK to the phone and open it from the file manager. Android asks you to allow +installs from that app the first time. Allow it, install, then turn the permission off +again if you prefer. + +HardenedPass has its own application ID, so it installs next to Android Password Store +instead of replacing it. The two share no data: to move over, set HardenedPass up +as described in [Connect the app]({{< relref "/hardenedpass/getting-started/connect" >}}). + +## Update + +The app does not check for updates. To follow new versions, watch the +[releases page](https://github.com/danixland/HardenedPass/releases) or its +[Atom feed](https://github.com/danixland/HardenedPass/releases.atom). + +To update, verify the new APK the same way and install it over the old one. Your store +and keys stay in place. Android refuses an update signed with a different key, which +is one more check on top of yours. diff --git a/content/it/hardenedpass/getting-started/_index.md b/content/it/hardenedpass/getting-started/_index.md index 6d4333b..d1ba975 100644 --- a/content/it/hardenedpass/getting-started/_index.md +++ b/content/it/hardenedpass/getting-started/_index.md @@ -1,13 +1,11 @@ +++ title = "Per iniziare" date = 2026-11-05T00:00:00Z -description = "" +description = "Da qui si parte: cos'è pass, come installare HardenedPass, come creare un archivio di password e collegarci l'app." weight = 10 draft = true +++ -Placeholder. - -## First heading - -Text. +Leggi queste pagine in ordine se non hai mai usato `pass`. Se hai già un archivio in un +repository git, installa l'app e vai direttamente a +[Collega l'app]({{< relref "/hardenedpass/getting-started/connect" >}}). diff --git a/content/it/hardenedpass/getting-started/concepts/index.md b/content/it/hardenedpass/getting-started/concepts/index.md index dbd6fe3..34334ab 100644 --- a/content/it/hardenedpass/getting-started/concepts/index.md +++ b/content/it/hardenedpass/getting-started/concepts/index.md @@ -1,13 +1,75 @@ +++ title = "Concetti" date = 2026-11-05T00:00:00Z -description = "" +description = "Le tre cose su cui si basa HardenedPass, in parole semplici: pass salva le password come file, OpenPGP le cifra, git le sincronizza." weight = 10 draft = true +++ -Placeholder. +HardenedPass si basa su tre strumenti. Non serve padroneggiarli, ma sapere cosa fa +ciascuno rende facili da seguire tutte le altre pagine. -## First heading +## pass: un file per ogni password -Text. +[pass](https://www.passwordstore.org/) è un gestore di password per sistemi Unix. Non +ha un database: ogni password è un piccolo file cifrato, e le cartelle le raggruppano. +Questo albero di cartelle si chiama **archivio**. + +``` +store/ +├── .gpg-id +├── example.org.gpg +├── otp/ +│ └── example.com.gpg +└── work/ + └── mail.example.org.gpg +``` + +Una volta decifrata, una voce è testo semplice. La prima riga è la password, tutto +quello che sta sotto sono informazioni aggiuntive: + +``` +hunter2 +username: alice +url: https://example.org +``` + +HardenedPass legge queste righe e le mostra come campi separati. Qualsiasi programma +che capisce `pass` può aprire lo stesso archivio, quindi le tue password non restano +mai bloccate dentro questa app. + +## OpenPGP: il lucchetto su ogni file + +Ogni voce è cifrata con [OpenPGP](https://www.gnupg.org/), usando una **coppia di +chiavi**: + +- La **chiave pubblica** chiude i file. Non è segreta. +- La **chiave privata** li apre. Non lascia mai i tuoi dispositivi. +- La **passphrase** protegge la chiave privata: una copia del file della chiave, da + sola, non serve a nulla a chi la trova. + +Il file `.gpg-id`, in cima all'archivio, dice per quali chiavi sono cifrate le voci. + +{{< callout type="danger" title="Fai un backup della chiave privata" >}} +Se perdi la chiave privata o dimentichi la sua passphrase, nessuno potrà più decifrare +il tuo archivio. Non esiste un reset. Tienine una copia in un posto sicuro e offline. +{{< /callout >}} + +## git: sincronizzazione e cronologia + +[Git](https://git-scm.com/) registra ogni modifica all'archivio e la copia tra i +dispositivi attraverso un **remote**, cioè un repository su un server. Modifichi una +voce sul telefono, l'app registra la modifica e la invia al remote, e gli altri +dispositivi la scaricano da lì. Le vecchie versioni restano nella cronologia, quindi un +errore si può annullare. + +Il server contiene solo file cifrati, ma ne può leggere i **nomi**. Chi lo gestisce può +vedere che hai una voce chiamata `example.org`. Usa un repository privato, su un server +di cui ti fidi. + +## Come si incastra il tutto + +1. Su un computer crei una coppia di chiavi, un archivio e un remote. +2. Sul telefono, HardenedPass clona l'archivio dal remote. +3. Importi la chiave privata nell'app. +4. L'app decifra le voci quando le apri e sincronizza le modifiche con git. diff --git a/content/it/hardenedpass/getting-started/connect/index.md b/content/it/hardenedpass/getting-started/connect/index.md index d6006ca..d7c6e35 100644 --- a/content/it/hardenedpass/getting-started/connect/index.md +++ b/content/it/hardenedpass/getting-started/connect/index.md @@ -1,13 +1,88 @@ +++ title = "Collega l'app" date = 2026-11-05T00:00:00Z -description = "" +description = "Come collegare HardenedPass al tuo archivio: clona il repository, configura una chiave SSH o una password, importa la tua chiave privata OpenPGP." weight = 40 draft = true +++ -Placeholder. +Ti servono l'indirizzo del repository e il file con la tua chiave privata. Se non hai né +l'uno né l'altro, parti da [Crea un archivio]({{< relref "/hardenedpass/getting-started/create-store" >}}). -## First heading +## Clona l'archivio -Text. +Apri l'app e tocca **Clona repo remoto**. + +{{< image src="welcome.png" alt="Schermata di benvenuto con i pulsanti Clona repo remoto, Crea repo locale e Impostazioni." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +Scrivi l'indirizzo del repository in **URL del repository** e scegli come accedere in +**Modalità di Autenticazione**. + +{{< image src="repository.png" alt="Schermata Informazioni del repository con l'URL compilato e Chiave SSH selezionata come modalità di autenticazione." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +Funzionano tutte queste forme di indirizzo: + +| Forma | Esempio | +|---|---| +| SSH, breve | `git@git.example.org:store.git` | +| SSH, con porta | `ssh://git@git.example.org:2222/srv/git/store.git` | +| HTTPS | `https://git.example.org/you/store.git` | + +L'app ti avvisa degli indirizzi che non funzionerebbero bene: una porta personalizzata +senza `ssh://`, una porta su un indirizzo HTTPS, che non è supportata, e `git://`, che +non ha cifratura. + +### Con una chiave SSH + +Tocca **Gestisci** accanto alla riga Chiave SSH. + +{{< image src="ssh-key.png" alt="Schermata Chiave SSH con i pulsanti Importa chiave SSH e Genera coppia di chiavi SSH." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +- **Importa chiave SSH** legge da un file una chiave privata che hai già. +- **Genera coppia di chiavi SSH** crea una nuova chiave sul telefono. Ed25519 è la + scelta migliore, a meno che il server non sia vecchio. **Proteggi con credenziali di + blocco schermo** fa chiedere all'app il blocco schermo ogni volta che usa la chiave. + +Dopo la generazione l'app mostra la chiave pubblica. Aggiungila al tuo server git, nello +stesso punto in cui aggiungeresti la chiave di un computer. Poi torna indietro e tocca +**Clona**. + +### Con una password + +Scegli **Password** e tocca **Clona**. L'app chiede la password quando si connette, e +**Ricorda password** la salva cifrata sul telefono. Molti servizi di hosting vogliono qui +un token di accesso invece della password dell'account. + +### L'identità del server + +Alla prima connessione SSH l'app salva la chiave host del server senza chiedere nulla, e +la controlla a ogni connessione successiva. Se la chiave cambia, la sincronizzazione si +ferma con un errore. Se sai perché è cambiata, tocca **Cancella la chiave host salvata** +nella schermata del repository. Se non lo sai, fermati e scoprilo prima: qualcuno +potrebbe spacciarsi per il tuo server. + +## Importa la chiave privata + +Finita la clonazione, l'app mostra per quale chiave è cifrato l'archivio, sotto +**Destinatari dell'archivio**. + +{{< image src="pgp-import.png" alt="Schermata Importa chiave PGP con l'ID della chiave destinataria dell'archivio e il pulsante Importa chiave PGP." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +Tocca **Importa chiave PGP** e scegli il file della chiave. L'app mostra l'ID della +chiave importata: controlla che corrisponda. Puoi toccare **Più tardi** per saltare il +passo, ma nessuna voce si potrà aprire finché non importi la chiave giusta. + +Si apre l'elenco delle voci, e hai finito. + +{{< image src="store-list.png" alt="L'elenco dell'archivio, con le cartelle otp e work e la voce example.org." class="max-w-sm mx-auto rounded-lg border border-border" />}} + +Ora cancella il file della chiave dalla memoria del telefono, come spiegato in +[Crea un archivio]({{< relref "/hardenedpass/getting-started/create-store" >}}). +La prima volta che apri una voce, l'app chiede la passphrase della chiave. + +## Un archivio senza server + +**Crea repo locale** crea un archivio che vive solo sul telefono. Importa la chiave +privata, poi toccala nell'elenco per creare l'archivio per quella chiave. Ti serve +comunque una chiave generata su un computer, e senza un remote nulla ti protegge se perdi +il telefono. diff --git a/content/it/hardenedpass/getting-started/connect/pgp-import.png b/content/it/hardenedpass/getting-started/connect/pgp-import.png new file mode 100644 index 0000000..976bfda Binary files /dev/null and b/content/it/hardenedpass/getting-started/connect/pgp-import.png differ diff --git a/content/it/hardenedpass/getting-started/connect/repository.png b/content/it/hardenedpass/getting-started/connect/repository.png new file mode 100644 index 0000000..d60e51f Binary files /dev/null and b/content/it/hardenedpass/getting-started/connect/repository.png differ diff --git a/content/it/hardenedpass/getting-started/connect/ssh-key.png b/content/it/hardenedpass/getting-started/connect/ssh-key.png new file mode 100644 index 0000000..0baf468 Binary files /dev/null and b/content/it/hardenedpass/getting-started/connect/ssh-key.png differ diff --git a/content/it/hardenedpass/getting-started/connect/store-list.png b/content/it/hardenedpass/getting-started/connect/store-list.png new file mode 100644 index 0000000..006c288 Binary files /dev/null and b/content/it/hardenedpass/getting-started/connect/store-list.png differ diff --git a/content/it/hardenedpass/getting-started/connect/welcome.png b/content/it/hardenedpass/getting-started/connect/welcome.png new file mode 100644 index 0000000..c30fb12 Binary files /dev/null and b/content/it/hardenedpass/getting-started/connect/welcome.png differ diff --git a/content/it/hardenedpass/getting-started/create-store/index.md b/content/it/hardenedpass/getting-started/create-store/index.md index 8e73690..d36e449 100644 --- a/content/it/hardenedpass/getting-started/create-store/index.md +++ b/content/it/hardenedpass/getting-started/create-store/index.md @@ -1,13 +1,76 @@ +++ title = "Crea un archivio" date = 2026-11-05T00:00:00Z -description = "" +description = "Come creare da zero un archivio di password su un computer: genera una chiave OpenPGP, inizializza pass, aggiungi un remote git privato ed esporta la chiave." weight = 30 draft = true +++ -Placeholder. +Se hai già un archivio in un repository git, passa a +[Collega l'app]({{< relref "/hardenedpass/getting-started/connect" >}}). -## First heading +HardenedPass non può generare chiavi OpenPGP, quindi per questa parte serve un computer +con [GnuPG](https://www.gnupg.org/), [pass](https://www.passwordstore.org/) e +[git](https://git-scm.com/) installati. La maggior parte delle distribuzioni Linux li +offre tutti e tre. -Text. +## Crea una coppia di chiavi + +```bash +gpg --full-generate-key +``` + +Accetta il tipo di chiave predefinito, inserisci il tuo nome e un indirizzo e scegli una +passphrase robusta. La digiterai spesso, quindi sceglila in modo da ricordarla. + +## Crea l'archivio + +Usa l'indirizzo che hai dato alla chiave: + +```bash +pass init you@example.org +pass git init +``` + +Il primo comando crea l'archivio in `~/.password-store` e scrive `.gpg-id`. Il secondo +lo trasforma in un repository git. + +Aggiungi una prima voce, così hai qualcosa con cui provare. `-m` permette di scrivere più +righe; si termina con Ctrl+D: + +```bash +pass insert -m example.org +``` + +``` +hunter2 +username: alice +``` + +## Aggiungi un remote + +Crea un repository **vuoto e privato** su un server git raggiungibile via SSH o HTTPS. Va +bene un servizio di hosting, e va bene un server tuo. Poi collegaci l'archivio e +invialo: + +```bash +pass git remote add origin git@git.example.org:store.git +pass git push -u origin HEAD +``` + +## Esporta la chiave privata + +Il telefono ha bisogno di una copia della chiave privata: + +```bash +gpg --armor --export-secret-keys you@example.org > private-key.asc +``` + +{{< callout type="warning" title="Maneggia questo file con cura" >}} +Sposta `private-key.asc` sul telefono via USB, non per email né tramite un cloud. +Cancellane ogni copia dalla memoria del telefono e dal computer non appena l'app l'ha +importato. L'app ne conserva una sua. +{{< /callout >}} + +Tieni anche un backup offline della chiave, per esempio su una chiavetta USB cifrata. +Il perché è in [Concetti]({{< relref "/hardenedpass/getting-started/concepts" >}}). diff --git a/content/it/hardenedpass/getting-started/install/index.md b/content/it/hardenedpass/getting-started/install/index.md index af2787f..9757022 100644 --- a/content/it/hardenedpass/getting-started/install/index.md +++ b/content/it/hardenedpass/getting-started/install/index.md @@ -1,13 +1,65 @@ +++ title = "Installazione" date = 2026-11-05T00:00:00Z -description = "" +description = "Come scaricare l'APK di HardenedPass dalle release su GitHub, verificarne checksum e certificato di firma, installarlo e aggiornarlo." weight = 20 draft = true +++ -Placeholder. +HardenedPass richiede Android 8 o successivo e funziona senza Google Play Services. Non +è su nessuno store: si installa l'APK dalle release del progetto. -## First heading +## Scarica -Text. +Apri l'[ultima release](https://github.com/danixland/HardenedPass/releases/latest) e +scarica entrambi i file: + +- `HardenedPass_vX.Y.Z.apk`, l'app +- `HardenedPass_vX.Y.Z.apk.sha256`, il suo checksum + +## Verifica il download + +Per questo passo serve un computer, e vale la pena farlo: un gestore di password è +l'ultima cosa da installare da un file manomesso. + +Controlla che il file sia arrivato integro: + +```bash +sha256sum -c HardenedPass_vX.Y.Z.apk.sha256 +``` + +L'output deve finire con `OK`. + +Poi controlla chi l'ha firmato. `apksigner` fa parte dei build tools dell'Android SDK: + +```bash +apksigner verify --print-certs HardenedPass_vX.Y.Z.apk +``` + +La riga `certificate SHA-256 digest` deve riportare: + +``` +725016669e482f9ac371dee8df19a2a1b34fa76d1af05b2a23784725b1b49c83 +``` + +Se uno dei due controlli fallisce, non installare il file. + +## Installa + +Copia l'APK sul telefono e aprilo dal file manager. La prima volta Android chiede di +consentire le installazioni da quell'app. Consentile, installa, poi se preferisci +togli di nuovo il permesso. + +HardenedPass ha un suo application ID, quindi si installa accanto ad Android Password +Store invece di sostituirlo. Le due app non condividono dati: per passare a HardenedPass +configuralo come spiegato in [Collega l'app]({{< relref "/hardenedpass/getting-started/connect" >}}). + +## Aggiorna + +L'app non controlla gli aggiornamenti. Per seguire le nuove versioni tieni d'occhio la +[pagina delle release](https://github.com/danixland/HardenedPass/releases) o il suo +[feed Atom](https://github.com/danixland/HardenedPass/releases.atom). + +Per aggiornare, verifica il nuovo APK nello stesso modo e installalo sopra il vecchio. +Archivio e chiavi restano al loro posto. Android rifiuta un aggiornamento firmato con +una chiave diversa, un controllo in più oltre al tuo. -- cgit v1.2.3