Repository navigation
feat(secrets): read the openssl passphrase from Keychain - #6048
Merged
norman-abramovitz merged 1 commit intoOct 23, 2026
Merged
norman-abramovitz merged 1 commit into
norman-abramovitz merged 1 commit into
Conversation
The openssl backend of scripts/secrets.sh always let openssl prompt for the passphrase. With --keychain SERVICE, or STRATOS_SECRETS_KEYCHAIN=SERVICE, it now reads it from the macOS Keychain item with that service and account "passphrase", and hands it to openssl on fd 3, never in argv or the environment. encrypt, decrypt, run-e2e and check all use it; the sops backend is unchanged. The cipher and options are unchanged and openssl takes the first line of the fd as the prompt would, so files stay interchangeable with ones encrypted at the prompt. With neither set, the behaviour is as before. A missing item, or no security command, stops the script with an error instead of falling back to the prompt. docs/secrets-management.md and the script header document the convention: service stratos-e2e-secrets, account passphrase, shared by every --env file unless another service is named. scripts/tests/secrets-keychain.test.mjs drives the script with a fake security command on PATH.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
scripts/secrets.shencrypts and decryptssecrets.yamlwith openssl, which asks for the passphrase every time. Nothing records the passphrase, and losing it makessecrets.yaml.encunreadable. This adds an opt-in macOS Keychain source for the passphrase.How it works
STRATOS_SECRETS_KEYCHAIN=<service>sets the source, and--keychain <service>overrides it. This follows the script's existing flag and variable pairs (--env/E2E_ENV,--backend/STRATOS_SECRETS_BACKEND). The account is alwayspassphrase, so--env NAMEcan use its own service.encrypt,decryptandrun-e2eall go through oneopenssl_encwrapper. With a service set, the passphrase reaches openssl through a file descriptor (-pass fd:3 3< <(security find-generic-password … -w)). It never appears in argv or an exported variable.securitycommand (Linux) also stops it. Neither case falls back to the prompt.checkreports whether the item exists. The sops backend is unchanged.docs/secrets-management.mdgains a Keychain section, a row in the variables table and two troubleshooting rows.Tests
scripts/tests/secrets-keychain.test.mjsruns under bun with a fakesecurityfirst on PATH; the real Keychain is never touched. It checks:--keychaindecrypts with a plain openssl passphrase;run-e2epasses the decrypted content on;securitycommand fails loudly.The tests failed against the script before this change and pass after it. With the original script put back, all 6 fail again.
make check gate: passed (4514 tests passed, 1 skipped).Release note:
changelog.d/0024-secrets-keychain.md.AI disclosure (RFC-0047): prepared with AI coding assistance; reviewed by the author.