Code Monkey home page Code Monkey logo

envchain's Introduction

envchain - set environment variables with macOS keychain or D-Bus secret service

What?

Secrets for common computing environments, such as AWS_SECRET_ACCESS_KEY, are set with environment variables.

A common practice is to set them in shell's intialization files such as .bashrc and .zshrc.

Putting these secrets on disk in this way is a grave risk.

envchain allows you to secure credential environment variables to your secure vault, and set to environment variables only when you called explicitly.

Currently, envchain supports macOS keychain and D-Bus secret service (gnome-keyring) as a vault.

Don't give any credentials implicitly!

Requirement (macOS)

  • macOS
    • Confirmed to work on OS X 10.11 (El Capitan), macOS 10.12 (Sierra).
    • OS X 10.7 (Lion) or later is required, but not confirmed

Requirement (Linux)

  • readline
  • libsecret
  • D-Bus Secret Service
    • GNOME keyring
    • KeePassXC

Installation

From Source

$ make

$ sudo make install
(or)
$ cp ./envchain ~/bin/

Homebrew (OS X)

brew install envchain

Usage

Saving variables

Environment variables are set within a specified namespace. You can set variables in a single command:

envchain --set NAMESPACE ENV [ENV ..]

You will be prompted to enter the values for each variable. For example, we can set two variables... AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY here, within a namespace called aws:

$ envchain --set aws AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
aws.AWS_ACCESS_KEY_ID: my-access-key
aws.AWS_SECRET_ACCESS_KEY: secret

Here we define a single new variable within a different namespace:

$ envchain --set hubot HUBOT_HIPCHAT_PASSWORD
hubot.HUBOT_HIPCHAT_PASSWORD: xxxx

These will all appear as application passwords with envchain-NAMESPACE in the data store (Keychain in macOS, gnome-keyring in common Linux distros).

Execute commands with defined variables

$ env | grep AWS_ || echo "No AWS_ env vars"
No AWS_ env vars
$ envchain aws env | grep AWS_
AWS_ACCESS_KEY_ID=my-access-key
AWS_SECRET_ACCESS_KEY=secret
$ envchain aws s3cmd blah blah blah
โ‹ฎ
$ envchain hubot env | grep AWS_ || echo "No AWS_ env vars for hubot"
No AWS_ env vars for hubot
$ envchain hubot env | grep HUBOT_
HUBOT_HIPCHAT_PASSWORD: xxxx

You may specify multiple namespaces at once, with separating by commas:

$ envchain aws,hubot env | grep 'AWS_\|HUBOT_'
AWS_ACCESS_KEY_ID=my-access-key
AWS_SECRET_ACCESS_KEY=secret
HUBOT_HIPCHAT_PASSWORD: xxxx

More options

--list

List namespaces that have been created

$ envchain --list
aws
hubot

--noecho

Do not echo user input

$ envchain --set --noecho foo BAR
foo.BAR (noecho):

--require-passphrase

Always ask for keychain passphrase

$ envchain --set --require-passphrase name

--no-require-passphrase

Do not ask for keychain passphrase

$ envchain --set --no-require-passphrase name

Sponsor

Buy Me a Coffee at ko-fi.com

Screenshot

OS X Keychain

Seahorse (gnome-keyring)

Author

License

MIT License

envchain's People

Contributors

banzaiman avatar eagletmt avatar gardar avatar gfx avatar guycall avatar k0kubun avatar mikepea avatar nobu avatar sorah avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

envchain's Issues

Execute with multiple namespaces

It would be useful to execute a command with multiple namespaces, something like:

envchain --env=aws --env=some_other_env my_command

multiline variable support

I'd like to store multiline secrets (e.g. - ~/.ssh/id_rsa) to envchain. Unfortunately, running this doesn't work:

cat ~/.ssh/id_rsa | envchain -s foo my_private_key

my_private_key only stores the top line

-----BEGIN OPENSSH PRIVATE KEY-----

envchain --list reports include dupe

Background

I am using envchain from a while ago, but recently I am experiencing issues with the namespaces.
The AWS_ACCESS_KEY_ID , AWS_SECRET_ACCESS_KEY secrets are not getting updated on both namespaces (nonprod and prod), the problem is that when I check for the available namespaces I am seeing duplications:
Note: Namespaces 'test', 'nonprod1' and 'prod1' I set them for testing purposes.

$envchain --list                                                                                                                                               ok | 14:32:03
prod
nonprod
prod1
nonprod
prod1
prod
nonprod
nonprod1
prod
nonprod1
prod
test
prod1

Problem

I already tried a couple things:

  1. Uninstalling envchain to have a clean installation and set the namespaces again, but it keeps carrying the old and bad namespaces.

brew uninstall envchain

As well, I checked for any residual files but nothing is prompting.

brew list envchain                                           ok | 14:52:10
Error: No such keg: /usr/local/Cellar/envchain

And there is no configuration in the shell in my '.zshrc' related to envchain.

 ~  brew uninstall envchain                                                                  ok | 15:03:50

Error: No such keg: /usr/local/Cellar/envchain
 ~  brew install envchain                                                                 1 err | 15:04:01

==> Downloading https://formulae.brew.sh/api/formula.jws.json
##################################################################################################### 100.0%
==> Downloading https://formulae.brew.sh/api/cask.jws.json
##################################################################################################### 100.0%
==> Downloading https://ghcr.io/v2/homebrew/core/envchain/manifests/1.0.1
Already downloaded: /Users/gerardojammal/Library/Caches/Homebrew/downloads/5b1f306f33edaf81010971e94a0fab349073eb178d43d3fb3d32097ae9010a96--envchain-1.0.1.bottle_manifest.json
==> Fetching envchain
==> Downloading https://ghcr.io/v2/homebrew/core/envchain/blobs/sha256:747395bd5b5f304844923251c84df54fb23e5
Already downloaded: /Users/gerardojammal/Library/Caches/Homebrew/downloads/002013d2304cbfc4311081ed3e1bef12813a2e3739ce327af5e311f6c911328c--envchain--1.0.1.ventura.bottle.tar.gz
==> Pouring envchain--1.0.1.ventura.bottle.tar.gz
๐Ÿบ  /usr/local/Cellar/envchain/1.0.1: 5 files, 42.7KB
==> Running `brew cleanup envchain`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
 ~  envchain --list                                                                     ok | 5s | 15:04:12
test
prod
nonprod1
prod
nonprod1
prod
prod1
nonprod
prod1
nonprod
prod1
nonprod
prod1
prod
  1. Tried to upgrade to the latest version in order to use --unset option but seem like the version available for Homebrew is not getting the latest release that includes that option.

Any help is more than welcome =D

Thanks!

envchain --list without namespace contains duplicate entries

When I run envchain --list, it seems to contain duplicate entries based on the number of environment variables set in the namespace. For example:

$ envchain
envchain version 1.0.1
...
$ envchain --set test ENV1 ENV2
test.ENV1: hello
test.ENV2: world
$ envchain --list
test
test

Usage with direnv?

I was wondering what would be the best way to use envchain with direnv? Basically, I'd like to hide some values in my .envrc files and was wondering if this would now be possible with envchain.

execvp failed: No such file or directory

Hello,

Thanks for you work :-) However, envchain sometimes fails unexcpetedly. For instance:

$ envchain ns eval "echo 1"
#=> execvp failed: No such file or directory

It fails for any namespace.

Passing multiline values into `--set`

Background

I want to use envchain within our mobile team to store the App Store Connect API key credentials, which consist of an issuer id, key id and .p8 key file.

For simplicity and security, we already hold the .p8 file contents in secrets on Bitrise and since we need to run some operations locally, it feels like it would be appropriate to do this as well using envchain.

Problem

The problem that I faced however was that I couldn't get the multiline string to work with envchain --set.

If i try pasting it, only the first line is accepted. I also tried something like the following:

$ cat /path/to/key.p8 | envchain --set asc APP_STORE_CONNECT_API_KEY_KEY

But the same issue, only the first line is written.

Workaround

I can open the Keychain Access app and paste the multiline string in there, but it would be great if this could be avoided.

I'm sorry that I can't open a Pull Request directly for this, I am not very good with C ๐Ÿ˜„

Setting variables from script programmatically

Hello, thanks for the cool project!

I'd like to set variables from a script, in a fashion similar to:

# do some stuff to get/generate values
envchain -s foo BAR <<VALUE_HERE>>

From the readme this doesn't seem to be possible, but I was wandering if I'm missing something.

I could write a little wrapper that replies to envchain prompts, but it seems a bit too hackish!

Thanks

list saved namespaces

Is it possible to add listing to the app?
I'm using it every day and have no knowledge of C/C++.
There are times I forget saved name of the namespace and need to restore it somehow...

Thanks

New Version?

This tool is super helpful! I install it through Homebrew, which references the most recent build, 1.0.1. Would it be possible to create a new release to get easier access to --unset?

How do we get values to pass to commands as flags?

If I have to pass a key as an argument to a command (like my-command --key=<key>) how do I write the command to get the value that's been set with envchain?

For example, my-command doesn't use a defined environment variable, so using envchain myNamespace my-command won't work since it requires me to pass the API key through the --key flag argument.

I've tried echoing out the value after getting it from envchain myNamespace env with various methods, but all of them return an empty string. If I use grep to look for the variable, it shows me that it's set, but I can't find any simple methods (such as echoing it directly or in a sub-command) that will get the value to let me pass it in the command's arguments.

So far, I've tried these without success:

envchain myNamespace my-command --key $MY_API_KEY
my-command --key $(envchain myNamespace env | echo $MY_API_KEY)

The only one I've gotten to work uses eval, and I'm hoping there's a better way:

export eval $(envchain myNamespace env | grep MY_API_KEY) && my-command --key $MY_API_KEY

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.