Shell-secrets – GPG-encrypted environment variables
1–10 of 43 posts
Re: Shell-secrets – GPG-encrypted environment variables
#2The more general version of this is probably sops[1].
(A general problem with these kinds of “wrap GPG” tools is that you end up with “mystery meat” encryption/signatures: your tool’s security margin is at the mercy of GPG’s opaque and historically not very good defaults.)
Re: Shell-secrets – GPG-encrypted environment variables
#3for a newer password manager... https://github.com/FiloSottile/passage
Re: Shell-secrets – GPG-encrypted environment variables
#4Couldn't you just use pass and have something like this in your bash script/env:
export SOME_SECRET="$(pass show some/secret)"
Re: Shell-secrets – GPG-encrypted environment variables
#5I like the idea. GPG encryption are super helful when sharing secrets.
Disclaimer: I work on some UI for GPG as my day job.
Re: Shell-secrets – GPG-encrypted environment variables
#6Couldn't you just use pass and have something like this in your bash script/env: export SOME_SECRET="$(pass show some/secret)"
this in a credentials file to source before doing some operation? sure.
I usually do: ` ( . ./credentials && ./the_thing ) ` so the secrets are only in the subshell and don't linger in my shell session forever.
but don't put that in rc , as it a) will be visible for all other (child) processes of your shell b) will spawn pinentry everytime the agent's cache ttl expires
Re: Shell-secrets – GPG-encrypted environment variables
#7Coincidentally I’ve written something similar to this too.
My main takeaway was that GPG isn’t nearly as user friendly as it needs to be.
Re: Shell-secrets – GPG-encrypted environment variables
#8Coincidentally I’ve written something similar to this too. My main takeaway was that GPG isn’t nearly as user friendly as it needs to be.
Highly true. Yet. If you complain or even offer patches (which will, always, without fail, be rejected).
You'll get told off by the GPG devs with something along the lines of "encryption is supposed to be hard".
Re: Shell-secrets – GPG-encrypted environment variables
#9Coincidentally I’ve written something similar to this too. My main takeaway was that GPG isn’t nearly as user friendly as it needs to be.
Highly true. Yet. If you complain or even offer patches (which will, always, without fail, be rejected). You'll get told off by the GPG devs with something along the lines of "encryption is supposed to be hard".
How hard would it be to devise an easy to use wrapper on top of GPG, kind of porcelain-like?
Re: Shell-secrets – GPG-encrypted environment variables
#10Earlier quoted context omitted.
Highly true. Yet. If you complain or even offer patches (which will, always, without fail, be rejected). You'll get told off by the GPG devs with something along the lines of "encryption is supposed to be hard".
How hard would it be to devise an easy to use wrapper on top of GPG, kind of porcelain-like?
You may be interested in https://sequoia-pgp.org/
It isn't exactly a wrapper, but it has an easier to use interface (as well as a more gpg compatible interface).