Shell-secrets – GPG-encrypted environment variables • Hacker News Board

Re: Shell-secrets – GPG-encrypted environment variables

#41

Post by FiloSottile » Fri, Apr 18, 2025, 11:15 PM UTC

qyckudnefDi5 wrote: post #40

pluto_modadic wrote: post #3

for a newer password manager... https://github.com/FiloSottile/passage

Looks like FiloSottile may have switched from passage to 1Password: https://bsky.app/profile/filippo.abyssdomain.expert/post/3l5... Would be interesting to get more context why move from storing passwords locally to an online service.

Team sharing with a non-technical person, mostly.

I still have high-value passwords and CLI credentials in passage + age-plugin-yubikey.

Re: Shell-secrets – GPG-encrypted environment variables

#42

Post by XorNot » Sat, Apr 19, 2025, 1:09 AM UTC

viraptor wrote: post #37

XorNot wrote: post #33

Earlier quoted context omitted.

Also.. expired keys aren't unusable. The encryption doesn't stop working. If you have an expired GPG private key it will still decrypt things encrypted with the public key.

They're not unusable, but depending on the gpg wrapper it may look like it. Gpgme is the one I had most issues with raining with fatal errors where gpg on its own only reports a warning. Non of this is impossible to overcome. Yet, I still was sometimes relied on to debug things.

Gonna have to give that a try because it sounds like a very bad interpretation of the expiry mechanism in keys - encryption functionally never expires if you have the key, because you have the key. It's solely an error on the part of the sender to use an expired key, because it might be no longer available.

(admittedly AFAIK encryption is handled by key expiry poorly overall in GPG - the lack of perfect forward secrecy means an expired key which leaks can still decrypt all the old messages if they were intercepted).

Re: Shell-secrets – GPG-encrypted environment variables

#43

Post by akoboldfrying » Sun, Apr 20, 2025, 3:15 AM UTC

ikiris wrote: post #35

theteapot wrote: post #29

Earlier quoted context omitted.

lowish. Meaning if you run a Linux desktop env with a mild amount of software installed it's likely pulled in already.

So is Perl, that doesn’t make it a good argument to use it still for the same reasons.

Perl is horrible, but for one-liners it's strictly less horrible than either sed or awk, which people still use because they are less horrible than pure Bourne shell for some common tasks.