ob-core: fix bug when source block is at bob
[org-mode.git] / lisp / org-crypt.el
blobd41e80a8c48c7744c6cd22dd883d9320e860918c
1 ;;; org-crypt.el --- Public key encryption for org-mode entries
3 ;; Copyright (C) 2007-2016 Free Software Foundation, Inc.
5 ;; Emacs Lisp Archive Entry
6 ;; Filename: org-crypt.el
7 ;; Keywords: org-mode
8 ;; Author: John Wiegley <johnw@gnu.org>
9 ;; Maintainer: Peter Jones <pjones@pmade.com>
10 ;; Description: Adds public key encryption to org-mode buffers
11 ;; URL: http://www.newartisans.com/software/emacs.html
12 ;; Compatibility: Emacs22
14 ;; This file is part of GNU Emacs.
16 ;; GNU Emacs is free software: you can redistribute it and/or modify
17 ;; it under the terms of the GNU General Public License as published by
18 ;; the Free Software Foundation, either version 3 of the License, or
19 ;; (at your option) any later version.
21 ;; GNU Emacs is distributed in the hope that it will be useful,
22 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
23 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 ;; GNU General Public License for more details.
26 ;; You should have received a copy of the GNU General Public License
27 ;; along with GNU Emacs. If not, see <http://www.gnu.org/licenses/>.
29 ;;; Commentary:
31 ;; Right now this is just a set of functions to play with. It depends
32 ;; on the epg library. Here's how you would use it:
34 ;; 1. To mark an entry for encryption, tag the heading with "crypt".
35 ;; You can change the tag to any complex tag matching string by
36 ;; setting the `org-crypt-tag-matcher' variable.
38 ;; 2. Set the encryption key to use in the `org-crypt-key' variable,
39 ;; or use `M-x org-set-property' to set the property CRYPTKEY to
40 ;; any address in your public keyring. The text of the entry (but
41 ;; not its properties or headline) will be encrypted for this user.
42 ;; For them to read it, the corresponding secret key must be
43 ;; located in the secret key ring of the account where you try to
44 ;; decrypt it. This makes it possible to leave secure notes that
45 ;; only the intended recipient can read in a shared-org-mode-files
46 ;; scenario.
47 ;; If the key is not set, org-crypt will default to symmetric encryption.
49 ;; 3. To later decrypt an entry, use `org-decrypt-entries' or
50 ;; `org-decrypt-entry'. It might be useful to bind this to a key,
51 ;; like C-c C-/. I hope that in the future, C-c C-r can be might
52 ;; overloaded to also decrypt an entry if it's encrypted, since
53 ;; that fits nicely with the meaning of "reveal".
55 ;; 4. To automatically encrypt all necessary entries when saving a
56 ;; file, call `org-crypt-use-before-save-magic' after loading
57 ;; org-crypt.el.
59 ;;; Thanks:
61 ;; - Carsten Dominik
62 ;; - Vitaly Ostanin
64 (require 'org)
66 ;;; Code:
68 (declare-function epg-decrypt-string "epg" (context cipher))
69 (declare-function epg-list-keys "epg" (context &optional name mode))
70 (declare-function epg-make-context "epg"
71 (&optional protocol armor textmode include-certs
72 cipher-algorithm digest-algorithm
73 compress-algorithm))
74 (declare-function epg-encrypt-string "epg"
75 (context plain recipients &optional sign always-trust))
76 (defvar epg-context)
79 (defgroup org-crypt nil
80 "Org Crypt."
81 :tag "Org Crypt"
82 :group 'org)
84 (defcustom org-crypt-tag-matcher "crypt"
85 "The tag matcher used to find headings whose contents should be encrypted.
87 See the \"Match syntax\" section of the org manual for more details."
88 :type 'string
89 :group 'org-crypt)
91 (defcustom org-crypt-key ""
92 "The default key to use when encrypting the contents of a heading.
94 This setting can also be overridden in the CRYPTKEY property."
95 :type 'string
96 :group 'org-crypt)
98 (defcustom org-crypt-disable-auto-save 'ask
99 "What org-decrypt should do if `auto-save-mode' is enabled.
101 t : Disable auto-save-mode for the current buffer
102 prior to decrypting an entry.
104 nil : Leave auto-save-mode enabled.
105 This may cause data to be written to disk unencrypted!
107 `ask' : Ask user whether or not to disable auto-save-mode
108 for the current buffer.
110 `encrypt': Leave auto-save-mode enabled for the current buffer,
111 but automatically re-encrypt all decrypted entries
112 *before* auto-saving.
113 NOTE: This only works for entries which have a tag
114 that matches `org-crypt-tag-matcher'."
115 :group 'org-crypt
116 :version "24.1"
117 :type '(choice (const :tag "Always" t)
118 (const :tag "Never" nil)
119 (const :tag "Ask" ask)
120 (const :tag "Encrypt" encrypt)))
122 (defun org-crypt-check-auto-save ()
123 "Check whether auto-save-mode is enabled for the current buffer.
125 `auto-save-mode' may cause leakage when decrypting entries, so
126 check whether it's enabled, and decide what to do about it.
128 See `org-crypt-disable-auto-save'."
129 (when buffer-auto-save-file-name
130 (cond
131 ((or
132 (eq org-crypt-disable-auto-save t)
133 (and
134 (eq org-crypt-disable-auto-save 'ask)
135 (y-or-n-p "org-decrypt: auto-save-mode may cause leakage. Disable it for current buffer? ")))
136 (message "org-decrypt: Disabling auto-save-mode for %s"
137 (or (buffer-file-name) (current-buffer)))
138 ;; The argument to auto-save-mode has to be "-1", since
139 ;; giving a "nil" argument toggles instead of disabling.
140 (auto-save-mode -1))
141 ((eq org-crypt-disable-auto-save nil)
142 (message "org-decrypt: Decrypting entry with auto-save-mode enabled. This may cause leakage."))
143 ((eq org-crypt-disable-auto-save 'encrypt)
144 (message "org-decrypt: Enabling re-encryption on auto-save.")
145 (org-add-hook 'auto-save-hook
146 (lambda ()
147 (message "org-crypt: Re-encrypting all decrypted entries due to auto-save.")
148 (org-encrypt-entries))
149 nil t))
150 (t nil))))
152 (defun org-crypt-key-for-heading ()
153 "Return the encryption key for the current heading."
154 (save-excursion
155 (org-back-to-heading t)
156 (or (org-entry-get nil "CRYPTKEY" 'selective)
157 org-crypt-key
158 (and (boundp 'epa-file-encrypt-to) epa-file-encrypt-to)
159 (message "No crypt key set, using symmetric encryption."))))
161 (defun org-encrypt-string (str crypt-key)
162 "Return STR encrypted with CRYPT-KEY."
163 ;; Text and key have to be identical, otherwise we re-crypt.
164 (if (and (string= crypt-key (get-text-property 0 'org-crypt-key str))
165 (string= (sha1 str) (get-text-property 0 'org-crypt-checksum str)))
166 (get-text-property 0 'org-crypt-text str)
167 (set (make-local-variable 'epg-context) (epg-make-context nil t t))
168 (epg-encrypt-string epg-context str (epg-list-keys epg-context crypt-key))))
170 (defun org-encrypt-entry ()
171 "Encrypt the content of the current headline."
172 (interactive)
173 (require 'epg)
174 (save-excursion
175 (org-back-to-heading t)
176 (set (make-local-variable 'epg-context) (epg-make-context nil t t))
177 (let ((start-heading (point)))
178 (forward-line)
179 (when (not (looking-at "-----BEGIN PGP MESSAGE-----"))
180 (let ((folded (outline-invisible-p))
181 (crypt-key (org-crypt-key-for-heading))
182 (beg (point))
183 end encrypted-text)
184 (goto-char start-heading)
185 (org-end-of-subtree t t)
186 (org-back-over-empty-lines)
187 (setq end (point)
188 encrypted-text
189 (org-encrypt-string (buffer-substring beg end) crypt-key))
190 (delete-region beg end)
191 (insert encrypted-text)
192 (when folded
193 (goto-char start-heading)
194 (outline-hide-subtree))
195 nil)))))
197 (defun org-decrypt-entry ()
198 "Decrypt the content of the current headline."
199 (interactive)
200 (require 'epg)
201 (unless (org-before-first-heading-p)
202 (save-excursion
203 (org-back-to-heading t)
204 (let ((heading-point (point))
205 (heading-was-invisible-p
206 (save-excursion
207 (outline-end-of-heading)
208 (outline-invisible-p))))
209 (forward-line)
210 (when (looking-at "-----BEGIN PGP MESSAGE-----")
211 (org-crypt-check-auto-save)
212 (set (make-local-variable 'epg-context) (epg-make-context nil t t))
213 (let* ((end (save-excursion
214 (search-forward "-----END PGP MESSAGE-----")
215 (forward-line)
216 (point)))
217 (encrypted-text (buffer-substring-no-properties (point) end))
218 (decrypted-text
219 (decode-coding-string
220 (epg-decrypt-string
221 epg-context
222 encrypted-text)
223 'utf-8)))
224 ;; Delete region starting just before point, because the
225 ;; outline property starts at the \n of the heading.
226 (delete-region (1- (point)) end)
227 ;; Store a checksum of the decrypted and the encrypted
228 ;; text value. This allows reusing the same encrypted text
229 ;; if the text does not change, and therefore avoid a
230 ;; re-encryption process.
231 (insert "\n" (propertize decrypted-text
232 'org-crypt-checksum (sha1 decrypted-text)
233 'org-crypt-key (org-crypt-key-for-heading)
234 'org-crypt-text encrypted-text))
235 (when heading-was-invisible-p
236 (goto-char heading-point)
237 (org-flag-subtree t))
238 nil))))))
240 (defun org-encrypt-entries ()
241 "Encrypt all top-level entries in the current buffer."
242 (interactive)
243 (let (todo-only)
244 (org-scan-tags
245 'org-encrypt-entry
246 (cdr (org-make-tags-matcher org-crypt-tag-matcher))
247 todo-only)))
249 (defun org-decrypt-entries ()
250 "Decrypt all entries in the current buffer."
251 (interactive)
252 (let (todo-only)
253 (org-scan-tags
254 'org-decrypt-entry
255 (cdr (org-make-tags-matcher org-crypt-tag-matcher))
256 todo-only)))
258 (defun org-at-encrypted-entry-p ()
259 "Is the current entry encrypted?"
260 (unless (org-before-first-heading-p)
261 (save-excursion
262 (org-back-to-heading t)
263 (search-forward "-----BEGIN PGP MESSAGE-----"
264 (save-excursion (outline-next-heading)) t))))
266 (defun org-crypt-use-before-save-magic ()
267 "Add a hook to automatically encrypt entries before a file is saved to disk."
268 (add-hook
269 'org-mode-hook
270 (lambda () (org-add-hook 'before-save-hook 'org-encrypt-entries nil t))))
272 (add-hook 'org-reveal-start-hook 'org-decrypt-entry)
274 (provide 'org-crypt)
276 ;;; org-crypt.el ends here