encpass.sh

For those interested in pass for use in shell script based contexts, you may also find encpass.sh (https://github.com/plyint/encpass.sh) useful. This is a simple tool I wrote (a while ago now) to encrypt/decrypt secrets and store them in a manner very similar to pass, except it uses OpenSSL instead of GPG. Since it is also just a shell script and it's only real dependency is OpenSSL, then it can be used in a wide array of environments where installing additional software may not be an option. It also has hooks in the code to write your own extensions, which can be used to add features or utilize an entirely different backend instead of OpenSSL. Check out the Keybase extension as an example. (https://github.com/plyint/encpass.sh/blob/master/extensions/...)

The difficulties mentioned in the article with passing secrets on the command line is one of the reasons why we wrote encpass.sh (https://github.com/plyint/encpass.sh). We had a similar need for a lightweight solution for managing secrets for simple shell scripts on our local workstations and in restricted environments. Bonus, it can be easily customized with extension scripts to adapt functions for your own specific needs. See our keybase extension for an example -> https://github.com/plyint/encpass.sh/blob/master/extensions/...

We made an extension for encpass.sh (similar in some ways to pass) that stores secrets in Keybase (https://github.com/plyint/encpass.sh/blob/master/extensions/...) if that sort of thing is of interest to you. Outside of personal secrets, it can be used as a sort of low cost stand in for shared secrets that you might use something like Vault for in a team environment.

Yes, I think so. In the vein of simplicity, we created a lightweight secret management script called encpass.sh (https://github.com/plyint/encpass.sh) Our use case initially was to have a simple and relatively secure way to handle secrets within shell scripts. By simple I mean does not require a lot of external dependencies and likely may already have its requirements installed on a machine. encpass.sh only needs a POSIX compliant shell and uses OpenSSL. This is nice for restrictive computing environments (think big enterprise IT) where you may not be able to control the software that is installed on the machine. The implementation turned out to be so useful and easily adaptable that we created an extension to it for Keybase (https://github.com/plyint/encpass.sh/blob/master/extensions/...) and have a whole workflow built around using

As a small dev team we needed something similar to passbolt, but that would primarily be used for sharing API keys and other application secrets for our code base. (Although we use it for other passwords as well) A lot of the existing tools are fairly complex to setup and are not tied to identity management systems. (i.e. You have to setup and maintain separate user accounts) Since, we were on Keybase already for employee identity and chat, we created an extension to encpass.sh to use Keybase for our secret storage. (https://github.com/plyint/encpass.sh/blob/master/extensions/...) It has been working really well so far, as when we add someone to a Keybase team, that person immediately has access to that team's secrets. No extra setup required.

I like the idea of combining the header with the help documentation to reduce the number of areas to maintain in smaller scripts. For larger scripts though, I think I'd still prefer to have a separate function, so that the help documentation doesn't overwhelm the initial viewing of the actual code. I also like to feed a heredoc directly into man, which allows you to achieve nicer formatting for the help documentation. Something like this... man -l - << EOF .\" Manpage for encpass.sh. .\" Email contact@plyint.com to correct errors or typos. .TH man 8 "06 March 2020" "1.0" "encpass.sh man page" .SH NAME encpass.sh \- Use encrypted passwords in shell scripts ... EOF See encpass.sh for a working example of this -> https://github.com/plyint/encpass.sh/blob/master/encpass.sh

If you need a simple way to inject secrets into your aviary variables you may find encpass.sh (https://github.com/plyint/encpass.sh) a convenient choice.

Yes, just compute the sha256 checksums and compare. I had been meaning to add a version command to encpass.sh for a while now and just hadn't made time for it. Your comment was the impetus I needed, so I've gone ahead and added support for computing the sha256 checksums of encpass.sh and any extension and also displaying the tag version. I've cut a new release for the version command, v4.1.0. See the release notes here for additional details -> https://github.com/plyint/encpass.sh/releases/tag/v4.1.0

https://github.com/plyint/encpass.sh/blob/93d42340/encpass.s... It uses PBKDF2 with 10,000 iterations if anyone else was wondering. The code is clean, kudos.

This is pretty much why we created encpass.sh(https://github.com/plyint/encpass.sh). It's just a single POSIX compliant shell script whose only real requirement is having OpenSSL installed. Sometimes when you are hacking on a shell script or you have some configuration management pieces you just need a simple way to store and access secrets locally without having to invest in a lot of infrastructure. (Especially if you are working for an employer where you don't even get to have a say in the infra) At Plyint(https://plyint.com), we actually use it to manage team level secrets through Keybase. To make this easier we wrote an extension encpass-keybase.sh(https://github.com/plyint/encpass.sh/blob/master/extensions/...), which uses Keybase's keys, encryption, and git repos.

We also use Keybase. We wrote an extension to our existing lightweight management script, encpass.sh(https://github.com/plyint/encpass.sh), to be able to access/manage our secrets from the CLI and in our infrastructure scripts. The extension is encpass-keybase.sh (https://github.com/plyint/encpass.sh/blob/master/extensions/...) kept in the same repo. The extension makes use of the per-user keys of Keybase. This allows you to manage access permissions using the Keybase GUI client. Once a user is added to the appropriate Keybase team, they will immediately have access to that teams secrets that are stored in the encrypted Git repos. To use it you just need to download the 2 shell scripts to a directory in your path (e.g. /usr/local/bin/) or you can clone the git repo.

One way we use it is for shared team secrets (e.g. API tokens) in infrastructure scripts. https://github.com/plyint/encpass.sh/blob/master/extensions/...

Yes, and yes it is secure. That is to say the data is encrypted and only you and the person(s) you are sending to have access to it. I have used it for credential sharing and use kbfs (Keybase's encrypted file sharing) for a simple secret storage mechanism for shell scripts. I map my encpass (https://github.com/plyint/encpass.sh) directory to kbfs.