COMMAND-LINE GUIDE: ENCRYPTED TARBALLS ON MACOS & LINUX
=====================================================

PART 1: QUICK START (GNUPG / GPG) -- RECOMMENDED
------------------------------------------------
GnuPG is the preferred tool for file encryption due to its dedicated cryptographic architecture, built-in integrity checking, and secure interactive passphrase prompts.

1. Create & Encrypt:
   tar -czf - /path/to/target | gpg -c --cipher-algo AES256 > archive.tgz.gpg

2. Unpack & Decrypt:
   gpg -d archive.tgz.gpg | tar -xzf -


PART 2: COMPLETE INFORMATION & OPENSSL ALTERNATIVE
--------------------------------------------------
Why OpenSSL is Still Viable:
- Ubiquity: OpenSSL is pre-installed on virtually every Linux distribution and macOS installation by default.
- Compatibility: Ideal for lightweight scripts or quick server-to-server data transfers.

1. OpenSSL: Create & Encrypt:
   tar -czf - /path/to/target | openssl enc -aes-256-cbc -salt -pbkdf2 -out archive.tgz.enc

2. OpenSSL: Unpack & Decrypt:
   openssl enc -d -aes-256-cbc -pbkdf2 -in archive.tgz.enc | tar -xzf -


SECURITY BEST PRACTICES: COMMAND-LINE VS. PASSWORD FILES
--------------------------------------------------------
- Avoid Command-Line Arguments: Never pass passwords directly in the command (e.g., --passphrase mypassword) as they can be viewed via 'ps aux' or shell history.
- Use a Secure Password File: Store the password in a file with strict permissions (chmod 600) and pass via redirection:
  * OpenSSL: openssl enc -aes-256-cbc -pbkdf2 -pass file:pass.txt -in ...
  * GPG: gpg --passphrase-fd 0 --batch --decrypt archive.tgz.gpg < pass.txt | tar -xzf -