Load the encrypted password from a file

This is more secure, because you can restrict the password file to be
only readable by the service user.

1 files changed, 137 insertions, 114 deletions

diff --git a/po/disfluid.pot b/po/disfluid.pot
index a66640f..01c4198 100644
--- a/po/disfluid.pot
+++ b/po/disfluid.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: disfluid SNAPSHOT\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-07-30 12:06+0200\n"
+"POT-Creation-Date: 2021-07-30 21:12+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -969,15 +969,15 @@ msgid "Warning: ~a\n"
 msgstr ""
 
 #: src/scm/webid-oidc/hello-world.scm:48 src/scm/webid-oidc/example-app.scm:116
-#: src/scm/webid-oidc/program.scm:217
+#: src/scm/webid-oidc/program.scm:218
 msgid "command-line|version"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:50 src/scm/webid-oidc/program.scm:221
+#: src/scm/webid-oidc/hello-world.scm:50 src/scm/webid-oidc/program.scm:222
 msgid "command-line|complete-corresponding-source"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:52 src/scm/webid-oidc/program.scm:223
+#: src/scm/webid-oidc/hello-world.scm:52 src/scm/webid-oidc/program.scm:224
 msgid "command-line|help"
 msgstr ""
 
@@ -985,11 +985,11 @@ msgstr ""
 msgid "command-line|port"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:56 src/scm/webid-oidc/program.scm:253
+#: src/scm/webid-oidc/hello-world.scm:56 src/scm/webid-oidc/program.scm:256
 msgid "command-line|log-file"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:58 src/scm/webid-oidc/program.scm:255
+#: src/scm/webid-oidc/hello-world.scm:58 src/scm/webid-oidc/program.scm:258
 msgid "command-line|error-file"
 msgstr ""
 
@@ -1028,7 +1028,7 @@ msgstr ""
 msgid "~a version ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:112 src/scm/webid-oidc/program.scm:609
+#: src/scm/webid-oidc/hello-world.scm:112 src/scm/webid-oidc/program.scm:617
 msgid ""
 "You are legally required to link to the complete corresponding source code.\n"
 msgstr ""
@@ -1147,110 +1147,114 @@ msgstr ""
 msgid "There was an error: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:111
+#: src/scm/webid-oidc/program.scm:112
 #, scheme-format
 msgid "~a: ~a: Internal server error: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:125
+#: src/scm/webid-oidc/program.scm:126
 #, scheme-format
 msgid ""
 "The client locale ~s can’t be approximated by system locale ~s (because ~a), "
 "using C.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:149
+#: src/scm/webid-oidc/program.scm:150
 #, scheme-format
 msgid "~a: ~s ~a ~s ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:151
+#: src/scm/webid-oidc/program.scm:152
 #, scheme-format
 msgid "~a: ~a (~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:155
+#: src/scm/webid-oidc/program.scm:156
 #, scheme-format
 msgid "~a: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:165
+#: src/scm/webid-oidc/program.scm:166
 #, scheme-format
 msgid "(there was an error: ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:219
+#: src/scm/webid-oidc/program.scm:220
 msgid "command-line|describe-project"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:225
+#: src/scm/webid-oidc/program.scm:226
 msgid "command-line|server|port"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:227
+#: src/scm/webid-oidc/program.scm:228
 msgid "command-line|server|server-name"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:229
+#: src/scm/webid-oidc/program.scm:230
 msgid "command-line|server|reverse-proxy|backend-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:231
+#: src/scm/webid-oidc/program.scm:232
 msgid "command-line|server|reverse-proxy|header"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:233
+#: src/scm/webid-oidc/program.scm:234
 msgid "command-line|server|issuer|key-file"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:235
+#: src/scm/webid-oidc/program.scm:236
 msgid "command-line|server|issuer|subject"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:237
+#: src/scm/webid-oidc/program.scm:238
 msgid "command-line|server|issuer|encrypted-password"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:239
+#: src/scm/webid-oidc/program.scm:240
+msgid "command-line|server|issuer|encrypted-password-from-file"
+msgstr ""
+
+#: src/scm/webid-oidc/program.scm:242
 msgid "command-line|server|issuer|jwks-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:241
+#: src/scm/webid-oidc/program.scm:244
 msgid "command-line|server|issuer|authorization-endpoint-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:243
+#: src/scm/webid-oidc/program.scm:246
 msgid "command-line|server|issuer|token-endpoint-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:245
+#: src/scm/webid-oidc/program.scm:248
 msgid "command-line|server|client-id"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:247
+#: src/scm/webid-oidc/program.scm:250
 msgid "command-line|server|redirect-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:249
+#: src/scm/webid-oidc/program.scm:252
 msgid "command-line|server|client-name"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:251
+#: src/scm/webid-oidc/program.scm:254
 msgid "command-line|server|client-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:284
+#: src/scm/webid-oidc/program.scm:288
 #, scheme-format
 msgid "Usage: ~a COMMAND [OPTIONS]...\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:288
+#: src/scm/webid-oidc/program.scm:292
 msgid ""
 "\n"
 "Run the disfluid COMMAND."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:291
+#: src/scm/webid-oidc/program.scm:295
 msgid ""
 "\n"
 "This program is covered by the GNU Affero GPL, version 3 or\n"
@@ -1260,13 +1264,13 @@ msgid ""
 "to all responses."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:298
+#: src/scm/webid-oidc/program.scm:302
 msgid ""
 "\n"
 "Available commands:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:300
+#: src/scm/webid-oidc/program.scm:304
 #, scheme-format
 msgid ""
 "\n"
@@ -1274,12 +1278,12 @@ msgid ""
 "      run an authenticating reverse proxy."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:303 src/scm/webid-oidc/program.scm:491
-#: src/scm/webid-oidc/program.scm:682
+#: src/scm/webid-oidc/program.scm:307 src/scm/webid-oidc/program.scm:499
+#: src/scm/webid-oidc/program.scm:700
 msgid "command-line|command|reverse-proxy"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:304
+#: src/scm/webid-oidc/program.scm:308
 #, scheme-format
 msgid ""
 "\n"
@@ -1287,12 +1291,12 @@ msgid ""
 "      run an identity provider."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:307 src/scm/webid-oidc/program.scm:516
-#: src/scm/webid-oidc/program.scm:704
+#: src/scm/webid-oidc/program.scm:311 src/scm/webid-oidc/program.scm:524
+#: src/scm/webid-oidc/program.scm:722
 msgid "command-line|command|identity-provider"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:308
+#: src/scm/webid-oidc/program.scm:312
 #, scheme-format
 msgid ""
 "\n"
@@ -1300,12 +1304,12 @@ msgid ""
 "      serve the pages for a public application."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:311 src/scm/webid-oidc/program.scm:537
-#: src/scm/webid-oidc/program.scm:748
+#: src/scm/webid-oidc/program.scm:315 src/scm/webid-oidc/program.scm:545
+#: src/scm/webid-oidc/program.scm:766
 msgid "command-line|command|client-service"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:312
+#: src/scm/webid-oidc/program.scm:316
 #, scheme-format
 msgid ""
 "\n"
@@ -1314,18 +1318,18 @@ msgid ""
 "      facility."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:316 src/scm/webid-oidc/program.scm:563
-#: src/scm/webid-oidc/program.scm:777
+#: src/scm/webid-oidc/program.scm:320 src/scm/webid-oidc/program.scm:571
+#: src/scm/webid-oidc/program.scm:795
 msgid "command-line|command|server"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:318
+#: src/scm/webid-oidc/program.scm:322
 msgid ""
 "\n"
 "General options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:320
+#: src/scm/webid-oidc/program.scm:324
 #, scheme-format
 msgid ""
 "\n"
@@ -1334,7 +1338,7 @@ msgid ""
 "      code. For instance, this would be an URI pointing to a tarball."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:325
+#: src/scm/webid-oidc/program.scm:329
 #, scheme-format
 msgid ""
 "\n"
@@ -1342,7 +1346,7 @@ msgid ""
 "      display a short help message and exit."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:329
+#: src/scm/webid-oidc/program.scm:333
 #, scheme-format
 msgid ""
 "\n"
@@ -1350,7 +1354,7 @@ msgid ""
 "      display the version information (~a, released ~a) and exit."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:335
+#: src/scm/webid-oidc/program.scm:339
 #, scheme-format
 msgid ""
 "\n"
@@ -1358,7 +1362,7 @@ msgid ""
 "      describe the project in the DOAP vocabulary and exit."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:339
+#: src/scm/webid-oidc/program.scm:343
 #, scheme-format
 msgid ""
 "\n"
@@ -1366,7 +1370,7 @@ msgid ""
 "      redirect the program standard output to FILE.log."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:343
+#: src/scm/webid-oidc/program.scm:347
 #, scheme-format
 msgid ""
 "\n"
@@ -1374,13 +1378,13 @@ msgid ""
 "      redirect the program errors to FILE.err."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:348
+#: src/scm/webid-oidc/program.scm:352
 msgid ""
 "\n"
 "General server-side options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:350
+#: src/scm/webid-oidc/program.scm:354
 #, scheme-format
 msgid ""
 "\n"
@@ -1388,7 +1392,7 @@ msgid ""
 "      set the server port to bind, 8080 by default."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:354
+#: src/scm/webid-oidc/program.scm:358
 #, scheme-format
 msgid ""
 "\n"
@@ -1396,13 +1400,13 @@ msgid ""
 "      set the public server URI (scheme, userinfo, host, and port)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:359
+#: src/scm/webid-oidc/program.scm:363
 msgid ""
 "\n"
 "Options for the resource server:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:361
+#: src/scm/webid-oidc/program.scm:365
 #, scheme-format
 msgid ""
 "\n"
@@ -1412,7 +1416,7 @@ msgid ""
 "      authentication."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:367
+#: src/scm/webid-oidc/program.scm:371
 #, scheme-format
 msgid ""
 "\n"
@@ -1421,13 +1425,13 @@ msgid ""
 "      reverse-proxy command."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:373
+#: src/scm/webid-oidc/program.scm:377
 msgid ""
 "\n"
 "Options for the identity provider:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:375
+#: src/scm/webid-oidc/program.scm:379
 #, scheme-format
 msgid ""
 "\n"
@@ -1436,7 +1440,7 @@ msgid ""
 "      key is generated. The server does not offer an HTTPS service."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:380
+#: src/scm/webid-oidc/program.scm:384
 #, scheme-format
 msgid ""
 "\n"
@@ -1444,7 +1448,7 @@ msgid ""
 "      set the identity of the subject."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:384
+#: src/scm/webid-oidc/program.scm:388
 #, scheme-format
 msgid ""
 "\n"
@@ -1452,7 +1456,15 @@ msgid ""
 "      set the encrypted password to recognize the user."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:388
+#: src/scm/webid-oidc/program.scm:392
+#, scheme-format
+msgid ""
+"\n"
+"  -W ENCRYPTED_PASSWORD_FILE, --~a=ENCRYPTED_PASSWORD_FILE:\n"
+"      load the user’s encrypted password from ENCRYPTED_PASSWORD_FILE."
+msgstr ""
+
+#: src/scm/webid-oidc/program.scm:396
 #, scheme-format
 msgid ""
 "\n"
@@ -1460,7 +1472,7 @@ msgid ""
 "      set the URI to query the key of the server."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:392
+#: src/scm/webid-oidc/program.scm:400
 #, scheme-format
 msgid ""
 "\n"
@@ -1468,7 +1480,7 @@ msgid ""
 "      set the authorization endpoint of the issuer."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:396
+#: src/scm/webid-oidc/program.scm:404
 #, scheme-format
 msgid ""
 "\n"
@@ -1476,13 +1488,13 @@ msgid ""
 "      set the token endpoint of the issuer."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:401
+#: src/scm/webid-oidc/program.scm:409
 msgid ""
 "\n"
 "Options for the client service:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:403
+#: src/scm/webid-oidc/program.scm:411
 #, scheme-format
 msgid ""
 "\n"
@@ -1491,7 +1503,7 @@ msgid ""
 "      dereferenced to a semantic resource."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:408
+#: src/scm/webid-oidc/program.scm:416
 #, scheme-format
 msgid ""
 "\n"
@@ -1500,7 +1512,7 @@ msgid ""
 "      page is presented with the code to paste in the application."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:413
+#: src/scm/webid-oidc/program.scm:421
 #, scheme-format
 msgid ""
 "\n"
@@ -1508,7 +1520,7 @@ msgid ""
 "      set the user-visible application name (may be misleading...)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:417
+#: src/scm/webid-oidc/program.scm:425
 #, scheme-format
 msgid ""
 "\n"
@@ -1517,13 +1529,13 @@ msgid ""
 "      application (again, may be misleading)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:423
+#: src/scm/webid-oidc/program.scm:431
 msgid ""
 "\n"
 "Environment variables:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:425
+#: src/scm/webid-oidc/program.scm:433
 msgid ""
 "\n"
 "  XML_CATALOG_FILES: the server will fetch resources on the web. By\n"
@@ -1534,23 +1546,23 @@ msgid ""
 "      content-type."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:433 src/scm/webid-oidc/program.scm:440
-#: src/scm/webid-oidc/program.scm:449 src/scm/webid-oidc/program.scm:457
-#: src/scm/webid-oidc/program.scm:465
+#: src/scm/webid-oidc/program.scm:441 src/scm/webid-oidc/program.scm:448
+#: src/scm/webid-oidc/program.scm:457 src/scm/webid-oidc/program.scm:465
+#: src/scm/webid-oidc/program.scm:473
 #, scheme-format
 msgid ""
 "the-environment-variable|\n"
 "      It is currently set to ~s."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:436
+#: src/scm/webid-oidc/program.scm:444
 msgid ""
 "\n"
 "  LANG: set the locale of the user interface (for the server commands,\n"
 "      the user is the system administrator)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:443
+#: src/scm/webid-oidc/program.scm:451
 msgid ""
 "\n"
 "  XDG_DATA_HOME: where the program stores persistent data. The\n"
@@ -1559,7 +1571,7 @@ msgid ""
 "      recommended to set it to /var/lib."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:452
+#: src/scm/webid-oidc/program.scm:460
 msgid ""
 "\n"
 "  XDG_CACHE_HOME: where the program stores and updates the seed file,\n"
@@ -1567,7 +1579,7 @@ msgid ""
 "      time. The seed file will be initialized from /dev/random."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:460
+#: src/scm/webid-oidc/program.scm:468
 msgid ""
 "\n"
 "  HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n"
@@ -1575,13 +1587,13 @@ msgid ""
 "      not used otherwise."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:469
+#: src/scm/webid-oidc/program.scm:477
 msgid ""
 "\n"
 "Running a reverse proxy"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:471
+#: src/scm/webid-oidc/program.scm:479
 msgid ""
 "\n"
 "Suppose that you operate data.provider.com. You want to run an\n"
@@ -1594,7 +1606,7 @@ msgid ""
 "from this reverse proxy."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:481
+#: src/scm/webid-oidc/program.scm:489
 #, scheme-format
 msgid ""
 "\n"
@@ -1608,20 +1620,20 @@ msgid ""
 "      --~a '/var/log/proxy.err'"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:496
+#: src/scm/webid-oidc/program.scm:504
 msgid ""
 "\n"
 "Running an identity provider"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:498
+#: src/scm/webid-oidc/program.scm:506
 msgid ""
 "\n"
 "The identity provider running at webid-oidc-demo.planete-kraus.eu is\n"
 "invoked with the following options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:502
+#: src/scm/webid-oidc/program.scm:510
 #, scheme-format
 msgid ""
 "\n"
@@ -1633,27 +1645,27 @@ msgid ""
 "      --~a 'https://webid-oidc-demo.planete-kraus.eu' \\\n"
 "      --~a '/var/lib/webid-oidc/issuer/key.jwk' \\\n"
 "      --~a 'https://webid-oidc-demo.planete-kraus.eu/profile/card#me' \\\n"
-"      --~a \"$ENCRYPTED_PASSWORD\" \\\n"
+"      --~a '/etc/disfluid/webid-oidc-demo.planete-kraus.eu/password' \\\n"
 "      --~a 'https://webid-oidc-demo.planete-kraus.eu/keys' \\\n"
 "      --~a 'https://webid-oidc-demo.planete-kraus.eu/authorize' \\\n"
 "      --~a 'https://webid-oidc-demo.planete-kraus.eu/token' \\\n"
 "      --~a $PORT"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:522
+#: src/scm/webid-oidc/program.scm:530
 msgid ""
 "\n"
 "Running the public pages for an application"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:524
+#: src/scm/webid-oidc/program.scm:532
 msgid ""
 "\n"
 "The example client application pages for\n"
 "webid-oidc-demo.planete-kraus.eu are served this way:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:528
+#: src/scm/webid-oidc/program.scm:536
 #, scheme-format
 msgid ""
 "\n"
@@ -1669,13 +1681,13 @@ msgid ""
 "      --~a $PORT"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:542
+#: src/scm/webid-oidc/program.scm:550
 msgid ""
 "\n"
 "Running a full server"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:545
+#: src/scm/webid-oidc/program.scm:553
 msgid ""
 "\n"
 "To run the server with identity provider and\n"
@@ -1683,7 +1695,7 @@ msgid ""
 "options for the parts."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:549
+#: src/scm/webid-oidc/program.scm:557
 #, scheme-format
 msgid ""
 "\n"
@@ -1695,21 +1707,21 @@ msgid ""
 "      --~a 'https://data.planete-kraus.eu' \\\n"
 "      --~a '/var/lib/disfluid/server/key.jwk' \\\n"
 "      --~a 'https://data.planete-kraus.eu/vivien#me' \\\n"
-"      --~a '$...alg...$...salt...$...hash...' \\\n"
+"      --~a '/etc/disfluid/data.planete-kraus.eu/password' \\\n"
 "      --~a 'https://data.planete-kraus.eu/keys' \\\n"
 "      --~a 'https://data.planete-kraus.eu/authorize' \\\n"
 "      --~a 'https://data.planete-kraus.eu/token' \\\n"
 "      --~a '...port...'"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:574
+#: src/scm/webid-oidc/program.scm:582
 #, scheme-format
 msgid ""
 "\n"
 "If you find a bug, then please send a report to ~a."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:579
+#: src/scm/webid-oidc/program.scm:587
 #, scheme-format
 msgid ""
 "~a version ~a\n"
@@ -1717,97 +1729,108 @@ msgid ""
 "Rreleased ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:616
+#: src/scm/webid-oidc/program.scm:624
 #, scheme-format
 msgid "The --~a argument must be a number, not ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:622
+#: src/scm/webid-oidc/program.scm:630
 #, scheme-format
 msgid "The --~a argument must be an integer, not ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:628
+#: src/scm/webid-oidc/program.scm:636
 #, scheme-format
 msgid "The --~a argument must be positive, ~s is invalid.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:633
+#: src/scm/webid-oidc/program.scm:641
 #, scheme-format
 msgid "The --~a argument must be less than 65536, ~s is invalid.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:675
+#: src/scm/webid-oidc/program.scm:669
+msgid ""
+"You specified two different passwords: one directly, and one from a file. "
+"Please set only one password.\n"
+msgstr ""
+
+#: src/scm/webid-oidc/program.scm:693
 #, scheme-format
 msgid ""
 "Usage: ~a COMMAND [OPTIONS]...\n"
 "See --~a (-h).\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:685 src/scm/webid-oidc/program.scm:707
-#: src/scm/webid-oidc/program.scm:779
+#: src/scm/webid-oidc/program.scm:703 src/scm/webid-oidc/program.scm:725
+#: src/scm/webid-oidc/program.scm:797
 #, scheme-format
 msgid "You must pass --~a to set the server name.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:689
+#: src/scm/webid-oidc/program.scm:707
 #, scheme-format
 msgid "You must pass --~a to set the backend URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:711 src/scm/webid-oidc/program.scm:783
+#: src/scm/webid-oidc/program.scm:729 src/scm/webid-oidc/program.scm:801
 #, scheme-format
 msgid ""
 "You must pass --~a to set the file where to store the identity provider "
 "key.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:715 src/scm/webid-oidc/program.scm:787
+#: src/scm/webid-oidc/program.scm:733 src/scm/webid-oidc/program.scm:805
 #, scheme-format
 msgid "You must pass --~a to set the subject of the identity provider.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:719 src/scm/webid-oidc/program.scm:791
+#: src/scm/webid-oidc/program.scm:737
 #, scheme-format
-msgid "You must pass --~a to set the subject’s encrypted password.\n"
+msgid "You must pass --~a or --~a to set the subject’s encrypted password.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:723 src/scm/webid-oidc/program.scm:795
+#: src/scm/webid-oidc/program.scm:741 src/scm/webid-oidc/program.scm:813
 #, scheme-format
 msgid "You must pass --~a to set the JWKS URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:727 src/scm/webid-oidc/program.scm:799
+#: src/scm/webid-oidc/program.scm:745 src/scm/webid-oidc/program.scm:817
 #, scheme-format
 msgid "You must pass --~a to set the authorization endpoint URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:731 src/scm/webid-oidc/program.scm:803
+#: src/scm/webid-oidc/program.scm:749 src/scm/webid-oidc/program.scm:821
 #, scheme-format
 msgid "You must pass --~a to set the token endpoint URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:751
+#: src/scm/webid-oidc/program.scm:769
 #, scheme-format
 msgid "You must pass --~a to set the application web ID.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:755
+#: src/scm/webid-oidc/program.scm:773
 #, scheme-format
 msgid "You must pass --~a to set the redirection URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:759
+#: src/scm/webid-oidc/program.scm:777
 #, scheme-format
 msgid "You must pass --~a to set the informative client name.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:763
+#: src/scm/webid-oidc/program.scm:781
 #, scheme-format
 msgid "You must pass --~a to set the informative client URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:850
+#: src/scm/webid-oidc/program.scm:809
+#, scheme-format
+msgid "You must pass --~a to set the subject’s encrypted password.\n"
+msgstr ""
+
+#: src/scm/webid-oidc/program.scm:868
 #, scheme-format
 msgid "Unknown command ~s\n"
 msgstr ""