[HN Gopher] Shell-secrets - GPG-encrypted environment variables
       ___________________________________________________________________
        
       Shell-secrets - GPG-encrypted environment variables
        
       Author : mgarciaisaia
       Score  : 29 points
       Date   : 2025-04-17 19:39 UTC (3 hours ago)
        
 (HTM) web link (github.com)
 (TXT) w3m dump (github.com)
        
       | woodruffw wrote:
       | The more general version of this is probably sops[1].
       | 
       | (A general problem with these kinds of "wrap GPG" tools is that
       | you end up with "mystery meat" encryption/signatures: your tool's
       | security margin is at the mercy of GPG's opaque and historically
       | not very good defaults.)
       | 
       | [1]: https://github.com/getsops/sops
        
       | pluto_modadic wrote:
       | for a newer password manager...
       | https://github.com/FiloSottile/passage
        
       | bitbasher wrote:
       | Couldn't you just use pass and have something like this in your
       | bash script/env:
       | 
       | export SOME_SECRET="$(pass show some/secret)"
        
         | Piraty wrote:
         | this in a credentials file to source before doing some
         | operation? sure. I usually do: ` ( . ./credentials &&
         | ./the_thing ) ` so the secrets are only in the subshell and
         | don't linger in my shell session forever.
         | 
         | but don't put that in <shell>rc , as it a) will be visible for
         | all other (child) processes of your shell b) will spawn
         | pinentry everytime the agent's cache ttl expires
        
       | ognarb wrote:
       | I like the idea. GPG encryption are super helful when sharing
       | secrets.
       | 
       | Disclaimer: I work on some UI for GPG as my day job.
        
       | hnlmorg wrote:
       | Coincidentally I've written something similar to this too.
       | 
       | My main takeaway was that GPG isn't nearly as user friendly as it
       | needs to be.
        
         | mmh0000 wrote:
         | Highly true. Yet. If you complain or even offer patches (which
         | will, always, without fail, be rejected).
         | 
         | You'll get told off by the GPG devs with something along the
         | lines of "encryption is supposed to be hard".
        
           | 9dev wrote:
           | How hard would it be to devise an easy to use wrapper on top
           | of GPG, kind of porcelain-like?
        
             | thayne wrote:
             | You may be interested in https://sequoia-pgp.org/
             | 
             | It isn't exactly a wrapper, but it has an easier to use
             | interface (as well as a more gpg compatible interface).
        
       ___________________________________________________________________
       (page generated 2025-04-17 23:00 UTC)