`gopass audit` (and possibly others) should ignore symlinks

[sudoforge]

Summary

Some websites use a single sign-on solution under the hood, but don't actually follow any sort of OAuth/SAML/etc workflow. An example of this is Trello, which supports a few different authentication methods, including "Logging in with your Atlassian ID", which redirects you from trello.com to id.atlassian.com, but only after you've entered a UID (in this case, an email) that is tied to an Atlassian ID (in other words, there isn't a "Log in with your Atlassian ID" button).

This means that I need Gopass to know about the username for trello.com, and the password for id.atlassian.com. Some users might create wholly separate entries and just store those pieces of information in each entry, however, managing these separately can become problematic -- for example, I'll need to store the UID in id.atlassian.com as well if I ever want to log in directly on that URI, which can lead to drift and increase the maintenance burden.

Historically, to solve this, I've used symlinks:

$ tree -L1
./some-password-store
├── atlassian.com.gpg
└── trello.com.gpg -> atlassian.com.gpg

One issue that this causes is that gopass audit reports spurious duplicates (false positives):

$ gopass audit
atlassian.com (age: ...)
❌ [warning] duplicates: Duplicates detected. Shared with: {trello.com}

trello.com (age: ...)
❌ [warning] duplicates: Duplicates detected. Shared with: {atlassian.com}

output tuncated for brevity

I cannot think of another use case for symbolic links within a password store (well, at least with gopass, which has first class support for external mounts). It would be great if these symbolic links were ignored, at least with gopass audit.

[dominikschulz]

I think this has been reported before and I've started working on a fix. But it turns out this is more tricky / ugly than I first thought (one example: what if you symlink a dir instead of the leaf files? is the destination in the store or not? are there loops?).

So for the time being I stopped working on the PR. But I do agree that it's a valid request. So if anyone wants to pick it up ...

[sudoforge]

Yeah, dealing with things like this are always more tricky than you'd think. I'll see if I can take a stab at this, I may have some time in the next month or two.