# Environment variables meet macOS Keychain and gnome-keyring


# envchain - set environment variables with macOS keychain or D-Bus secret service

## What?

Secrets for common computing environments, such as `AWS_SECRET_ACCESS_KEY`, are set with environment variables.

A common practice is to set them in shell's intialization files such as `.bashrc` and `.zshrc`.

Putting these secrets on disk in this way is a grave risk.

`envchain` allows you to secure credential environment variables to your secure vault, and set to environment variables only when you called explicitly.

Currently, `envchain` supports macOS keychain and D-Bus secret service (gnome-keyring) as a vault.

Don't give any credentials implicitly!

## Requirement (macOS)

* macOS
    
    * Confirmed to work on OS X 10.11 (El Capitan), macOS 10.12 (Sierra).
        
    * OS X 10.7 (Lion) or later is required, but not confirmed
        

## Requirement (Linux)

* readline
    
* libsecret
    
* D-Bus Secret Service
    
    * GNOME keyring
        
    * KeePassXC
        

## Installation

### From Source

```basic
$ make

$ sudo make install
(or)
$ cp ./envchain ~/bin/
```

### Homebrew (OS X)

```basic
brew install envchain
```

## Usage

### Saving variables

Environment variables are set within a specified *namespace.* You can set variables in a single command:

```basic
envchain --set NAMESPACE ENV [ENV ..]
```

You will be prompted to enter the values for each variable. For example, we can set two variables... `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` here, within a namespace called `aws`:

```basic
$ envchain --set aws AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
aws.AWS_ACCESS_KEY_ID: my-access-key
aws.AWS_SECRET_ACCESS_KEY: secret
```

Here we define a single new variable within a different namespace:

```basic
$ envchain --set hubot HUBOT_HIPCHAT_PASSWORD
hubot.HUBOT_HIPCHAT_PASSWORD: xxxx
```

These will all appear as application passwords with `envchain-NAMESPACE` in the data store (Keychain in macOS, gnome-keyring in common Linux distros).

### Execute commands with defined variables

```basic
$ env | grep AWS_ || echo "No AWS_ env vars"
No AWS_ env vars
$ envchain aws env | grep AWS_
AWS_ACCESS_KEY_ID=my-access-key
AWS_SECRET_ACCESS_KEY=secret
$ envchain aws s3cmd blah blah blah
⋮
```

```basic
$ envchain hubot env | grep AWS_ || echo "No AWS_ env vars for hubot"
No AWS_ env vars for hubot
$ envchain hubot env | grep HUBOT_
HUBOT_HIPCHAT_PASSWORD: xxxx
```

You may specify multiple namespaces at once, with separating by commas:

```basic
$ envchain aws,hubot env | grep 'AWS_\|HUBOT_'
AWS_ACCESS_KEY_ID=my-access-key
AWS_SECRET_ACCESS_KEY=secret
HUBOT_HIPCHAT_PASSWORD: xxxx
```

### More options

#### `--list`

List namespaces that have been created

```basic
$ envchain --list
aws
hubot
```

#### `--noecho`

Do not echo user input

```basic
$ envchain --set --noecho foo BAR
foo.BAR (noecho):
```

#### `--require-passphrase`

Always ask for keychain passphrase

```basic
$ envchain --set --require-passphrase name
```

#### `--no-require-passphrase`

Do not ask for keychain passphrase

```basic
$ envchain --set --no-require-passphrase name
```

## Sponsor

[![Buy Me a Coffee at ko-fi.com](https://camo.githubusercontent.com/421c7c603a86e1785a16cbefcb34d9d73ddfa2c821501729b09aafdf0024e1ed/68747470733a2f2f63646e2e6b6f2d66692e636f6d2f63646e2f6b6f6669332e706e673f763d33 align="center")](https://ko-fi.com/J3J8CKMUU)

### Screenshot

#### OS X Keychain

[![](https://camo.githubusercontent.com/7aaf913c705ab14ed4f912f5b780cefa40b71c79e7c27bb9958cceec2d0f8a99/687474703a2f2f696d672e736f7261682e6a702f32303134303531395f3036303134375f64717762685f32303134303531395f3036303134345f73317a6b755f4b6579636861696e5f4163636573732e706e67 align="left")](https://camo.githubusercontent.com/7aaf913c705ab14ed4f912f5b780cefa40b71c79e7c27bb9958cceec2d0f8a99/687474703a2f2f696d672e736f7261682e6a702f32303134303531395f3036303134375f64717762685f32303134303531395f3036303134345f73317a6b755f4b6579636861696e5f4163636573732e706e67)

#### Seahorse (gnome-keyring)

[![](https://camo.githubusercontent.com/f8f40c970e796dbbd9e527c7cad5293e1e624cae1ad419db63057c972071f29c/68747470733a2f2f696d672e736f7261682e6a702f323031362d30362d30385f31392d34362d31305f666639633434342e706e67 align="center")](https://camo.githubusercontent.com/f8f40c970e796dbbd9e527c7cad5293e1e624cae1ad419db63057c972071f29c/68747470733a2f2f696d672e736f7261682e6a702f323031362d30362d30385f31392d34362d31305f666639633434342e706e67)