cmd/age: passphrase optionnaly supplied from an environment variable

FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

https://age-encryption.org

BSD 3-Clause "New" or "Revised" License

15.75k stars 475 forks source link

Open wj opened 10 months ago

wj commented 10 months ago

The passphrase is now read from the AGE_PASSPHRASE environment variable, as an alternative to being requested interactively.

This enables the following usage patterns:

automation of the encryption, without having to manage an additional private key file
provide a less error prone way of supplying a passphrase. Copy-pasting to an echo-less prompt, for example, is often hazardous on some platforms.

ghost commented 5 months ago

Hi, How exactly is the env var AGE_PASSPHRASE to be supplied? I was trying age -d --AGE_PASSPHRASE but that doesn't seem to work?

Edit: Never mind, figured out.

jc00ke commented 4 months ago

This would be nice to see, as it would allow one to use 1Password Secret reference syntax for shared passphrases.

gaby commented 1 month ago

This would be great for automation/CI!

@FiloSottile