21–30 of 43 posts
The more general version of this is probably sops[1]. (A general problem with these kinds of “wrap GPG” tools is that you end up with “mystery meat” encryption/signatures: your tool’s security margin is at the mercy of GPG’s opaque and historically not very good defaults.) [1]: https://github.com/getsops/sops
AWS_SECRET_ACCESS_KEY=$(gpg -d ~/.secrets/aws/key.asc)
type of deal. its annoying to put in a password every time i open a new tmux pane but hey, better than plain text.
Unless you're good at actually maintaining your gpg keychain and need other people to access this, I really wouldn't bother with gpg. There are way better and simpler options. Age has a simpler interface and SSH key support https://github.com/FiloSottile/age ejson2env has the environment variable integration and ejson has multiple backends https://github.com/Shopify/ejson2env direnv can support any cli secrets manage…
The more general version of this is probably sops[1]. (A general problem with these kinds of “wrap GPG” tools is that you end up with “mystery meat” encryption/signatures: your tool’s security margin is at the mercy of GPG’s opaque and historically not very good defaults.) [1]: https://github.com/getsops/sops
Unless you're good at actually maintaining your gpg keychain and need other people to access this, I really wouldn't bother with gpg. There are way better and simpler options. Age has a simpler interface and SSH key support https://github.com/FiloSottile/age ejson2env has the environment variable integration and ejson has multiple backends https://github.com/Shopify/ejson2env direnv can support any cli secrets manage…
The tool is just pulling one encryption key from your local GPG keyring. What's to maintain?
I promise this happens all the time to people for lots of stupid reasons.
I store my secrets in gpg encrypted files and inject them into my environment in my shell rc file. AWS_SECRET_ACCESS_KEY=$(gpg -d ~/.secrets/aws/key.asc) type of deal. its annoying to put in a password every time i open a new tmux pane but hey, better than plain text.
The more general version of this is probably sops[1]. (A general problem with these kinds of “wrap GPG” tools is that you end up with “mystery meat” encryption/signatures: your tool’s security margin is at the mercy of GPG’s opaque and historically not very good defaults.) [1]: https://github.com/getsops/sops
This is 13 lines of Bash plus GPG which is available ~everywhere and a pretty lowish level Linux dependency. SOPS is +20KLOC of Go with support for cloud KMS etc etc. I think you got your mystery meat analogy backwards.
(I also wouldn’t call GPG a low level dependency.)
Earlier quoted context omitted.
The tool is just pulling one encryption key from your local GPG keyring. What's to maintain?
What happens when you have multiple matching keys? What happens when your key expires? What happens when the output format changes? What happens when the key expires and it's attached to a hardware device? Gpg can fail in ways which do not tell you anything about the real underlying issue. I promise this happens all the time to people for lots of stupid reasons.
Use keyid instead.
> What happens when your key expires?
GPG will refuse to use it for encryption. Create a new encryption key.
> What happens when the output format changes?
N/A here (?)
> What happens when the key expires and it's attached to a hardware device?
You got me.
Earlier quoted context omitted.
This is 13 lines of Bash plus GPG which is available ~everywhere and a pretty lowish level Linux dependency. SOPS is +20KLOC of Go with support for cloud KMS etc etc. I think you got your mystery meat analogy backwards.
The mystery meat in question is GPG, not sops or this. (I also wouldn’t call GPG a low level dependency.)
Unless you're good at actually maintaining your gpg keychain and need other people to access this, I really wouldn't bother with gpg. There are way better and simpler options. Age has a simpler interface and SSH key support https://github.com/FiloSottile/age ejson2env has the environment variable integration and ejson has multiple backends https://github.com/Shopify/ejson2env direnv can support any cli secrets manage…
ejson2env sounds nice. Don't like the syntax of `eval $(...)`, but it does THE thing that most don't - it encrypts the secrets at rest!
Also, I have multiple logins for some services (company account vs company's client account), so separating concerns is cool. And having the "context" name in the PS1 helps avoid issuing the wrong command on the wrong account - you can even add emojis to the name for maximum discernability.