Loading secret content in .profile when initializing bash/zsh

Question

I want to include an environment variable with a secret Api key during shell initialization. But I do not want that environment variable to be exposed in a plain text file.

So, I was wondering if there is a built-in mechanism or script to do this.

I was thinking on a encrypted git repository using git-crypt. And when initializing (on .profile) decrypt it, source it and then encrypt it back to make unreadable to other users.

So...where will you store the key used to decrypt your secret file? — larsks
– larsks, Commented Aug 31, 2016 at 16:07
Encryption/decryption would be made using GPG keys with a passphrase. The passphrase will be entered once per session (using gnome-keyring or a gpg-agent). Similar as you do when using SSH keys with Github. — Gonzalo Matheu
– Gonzalo Matheu, Commented Aug 31, 2016 at 16:19

Gonzalo Matheu · Accepted Answer · 2016-09-05 12:07:37Z

A couple of sh functions and using gpg made it:

SECRETS_FILE=~/.secrets.sh [email protected] profile_decrypt (){ gpg -d ${SECRETS_FILE}.asc > ${SECRETS_FILE} # Decrypt file rm ${SECRETS_FILE}.asc } profile_encrypt () { gpg -ea -r ${GPG_ID} ${SECRETS_FILE} # Encrypt file using ascii output rm ${SECRETS_FILE} } profile_decrypt source $SECRETS_FILE profile_encrypt

Where ~/.secrets.sh contains:

export API_KEY=<SECRET API KEY>

Including this functions on .profile decrypts, exports variables and encrypts them back everytime the terminal is loaded.

I've just made a shell plugin with this feature: github.com/gmatheu/shell-plugins/blob/master/…

Collectives™ on Stack Overflow

Loading secret content in .profile when initializing bash/zsh

1 Answer 1

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Related