How to Handle Secrets on the Command Line

• envchain

  3 1,139 0.0 C

  Environment variables meet macOS Keychain and gnome-keyring <3

You have envchain to store secrets as ENV variables in your keyring and execute commands:

https://github.com/sorah/envchain

Not really something you would use for production web apps, I think envconsul covers that usecase:

https://github.com/hashicorp/envconsul

• envconsul

  4 1,993 5.9 Go

  Launch a subprocess with environment variables using data from @HashiCorp Consul and Vault.

  

You have envchain to store secrets as ENV variables in your keyring and execute commands:

https://github.com/sorah/envchain

Not really something you would use for production web apps, I think envconsul covers that usecase:

https://github.com/hashicorp/envconsul

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• zsh-secrets

  1 6 0.0 Shell

  Storing GPG encrypted environment variables

• Mosh

  152 12,199 4.6 C++

  Mobile Shell

  

AIX 5.2? That was EOL 2008, it seems hardly worth warning about these days.

https://github.com/mobile-shell/mosh/issues/156#issue-407789...

• sops

  150 15,069 9.2 Go

  Simple and flexible tool for managing secrets

  

Sidenote: I really like the cookie consent form on this site. It's unobtrusive, clear, opt-out by default and the highlighted and only button is "Continue to site". Bravo to https://www.clym.io/

Nice article, covers the basics well. Credential files seem like simplest way to go and are secure enough for most local uses. For anything more involved a secrets manager is probably required. I've been using Linux for a long time and hadn't heard about `keyctl`, thanks for mentioning it. A more flexible solution might be https://github.com/mozilla/sops

• platform-compat

  23 249 1.2 C#

  Discontinued Roslyn analyzer that finds usages of APIs that will throw PlatformNotSupportedException on certain platforms.

  

.NET (and PowerShell) have something similar. Interestingly, Microsoft recommends not using them. https://github.com/dotnet/platform-compat/blob/master/docs/D...

I assume by certs and Windows auth they're implying the OS native stuff versus just passing those around in code, instead

• encpass.sh

  3 587 0.0 Shell

  Lightweight solution for using encrypted passwords in shell scripts

  

The difficulties mentioned in the article with passing secrets on the command line is one of the reasons why we wrote encpass.sh (https://github.com/plyint/encpass.sh). We had a similar need for a lightweight solution for managing secrets for simple shell scripts on our local workstations and in restricted environments. Bonus, it can be easily customized with extension scripts to adapt functions for your own specific needs. See our keybase extension for an example -> https://github.com/plyint/encpass.sh/blob/master/extensions/...

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• ShellCheck

  488 34,934 8.6 Haskell

  ShellCheck, a static analysis tool for shell scripts

• dotfiles

  3 153 5.6 Shell

  Home directory with an absurd amount of tweaks (by kaihendry)

I defer to using AWS SSM to retrieve secrets https://github.com/kaihendry/dotfiles/blob/master/bin/ssm

But yeah, reading secrets of env or ps or the clipboard is a real issue, so I focus on making sure that doesn't leak.

I've made terrible mistakes leading /proc accidentally in my Web app https://github.com/securego/gosec/issues/569

• gosec

  19 7,441 8.8 Go

  Go security checker

  

I defer to using AWS SSM to retrieve secrets https://github.com/kaihendry/dotfiles/blob/master/bin/ssm

But yeah, reading secrets of env or ps or the clipboard is a real issue, so I focus on making sure that doesn't leak.

I've made terrible mistakes leading /proc accidentally in my Web app https://github.com/securego/gosec/issues/569

Suggest a related project