SCTL is not End2End encryption, instead SCTL is more of an envelope, in which you store secrets until they are needed, and those secrets should only remain available in plain text while the operation that needs them is active.
It's becoming more apparent that our windows users dont have a full posix environment around to do things like | base64 to copy and port a value around between their developer work station and a remote system as windows line endings and copy/paste from the cli can be a bit wonky.
Some ergonomics around this would be to add a --no-decode flag to sctl readwhich would not do the implied base64 decode, spitting out the compressed value for expansion on a remote system.
This is a fine stop-gap to help support the workflow i think.
It's becoming more apparent that our windows users dont have a full posix environment around to do things like
| base64
to copy and port a value around between their developer work station and a remote system as windows line endings and copy/paste from the cli can be a bit wonky.Some ergonomics around this would be to add a
--no-decode
flag tosctl read
which would not do the implied base64 decode, spitting out the compressed value for expansion on a remote system.This is a fine stop-gap to help support the workflow i think.