# Pass License Management

A thoughtful, durable solution for managing software licenses and sensitive text data using the Unix philosophy.

## Overview

Pass (the standard Unix password manager) uses GPG encryption to securely store licenses, API keys, and other sensitive information. Everything is stored as GPG-encrypted files in `~/.password-store/`, making it version-controllable and portable.

## Initial Setup

Pass is already configured with your GPG key. If you need to reinitialize:
```bash
pass init YOUR-GPG-KEY-ID
```

## Daily Workflow

### Adding New Licenses

**Method 1: Using the helper script (recommended)**
```bash
new-license "AppName"
# Opens BBEdit with the license template
```

**Method 2: Direct entry**
```bash
pass edit licenses/AppName
# Opens BBEdit with a blank file
```

**Method 3: Quick single-line entry**
```bash
echo "LICENSE-KEY-HERE" | pass insert licenses/AppName
```

### Viewing Licenses

```bash
# List all licenses
pass ls licenses/

# View specific license
pass show licenses/BBEdit

# Copy license key to clipboard (first line only)
pass -c licenses/BBEdit

# Copy specific line to clipboard (e.g., line 2)
pass show licenses/BBEdit | sed -n '2p' | pbcopy
```

### Searching Licenses

```bash
# Search across all stored data
pass grep "adobe"
pass grep "scanner"
```

### Editing Existing Licenses

```bash
pass edit licenses/AppName
# Opens in BBEdit for editing
```

### Removing Licenses

```bash
# Remove single license
pass rm licenses/AppName

# Remove with confirmation prompt
pass rm -i licenses/AppName
```

## Organization Structure

Recommended hierarchy for different types of sensitive data:

```
~/.password-store/
├── licenses/
│   ├── adobe/
│   │   ├── photoshop
│   │   └── illustrator
│   ├── microsoft/
│   │   └── office
│   ├── BBEdit
│   ├── VueScan
│   └── Bartender
├── api-keys/
│   ├── github
│   ├── openai
│   └── stripe
└── servers/
    ├── production
    └── staging
```

Create subdirectories as needed:
```bash
pass insert licenses/adobe/photoshop
pass insert api-keys/github
```

## License Template

The template at `~/dotfiles/pass-templates/license-template.txt` contains:
```
Application: APPLICATION_NAME
License Key: LICENSE_KEY_HERE
Email: REGISTERED_EMAIL
Name: REGISTERED_NAME
Purchase Date: YYYY-MM-DD
Purchase Price: $AMOUNT
Vendor: VENDOR_NAME
Notes: Any additional notes about the license
```

## Integration with Notes.app

For redundancy, you can keep copies in Notes.app:
1. Create a "Software Licenses" folder in Notes
2. Create secure notes (lock icon) for each license
3. This provides iCloud sync and an additional backup

## Backup Strategy

Your Pass data is backed up in three ways:
1. **Encrypted in dotfiles backup**: `~/dotfiles/backups/complete/all_secrets_*.tar.gz.gpg`
2. **Version controlled**: Can add `~/.password-store/` to git
3. **Manual backup**: `tar -czf pass-backup.tar.gz ~/.password-store/`

## Advanced Usage

### Generate passwords
```bash
pass generate accounts/example.com 20
```

### Git integration
```bash
cd ~/.password-store
git init
git add .
git commit -m "Initial pass store"
```

### Multiple line clipboard
```bash
# Copy email from license entry
pass show licenses/BBEdit | grep "Email:" | cut -d' ' -f2 | pbcopy
```

### Temporary display (clears after 45 seconds)
```bash
pass show -c licenses/BBEdit
```

## Troubleshooting

**BBEdit doesn't wait**: Ensure `EDITOR="bbedit -w"` is set in your shell

**GPG key issues**: Check with `gpg --list-secret-keys`

**Can't decrypt**: Ensure GPG agent is running: `gpgconf --launch gpg-agent`

## Security Notes

- All data is encrypted with your GPG key
- Temporary files are created in secure locations and cleaned up
- Clipboard is cleared after 45 seconds when using `-c`
- Never commit `.password-store/` to public repositories

## Prime Directive Alignment

This solution embodies μέτρον (measure and proportion):
- **Durable**: Plain text files, GPG encryption, Unix philosophy
- **Thoughtful**: Organized structure, templates for consistency
- **Portable**: Works on any system with GPG and pass
- **Secure**: Industry-standard encryption, no proprietary formats