cmd/age: passphrase optionnaly supplied from an environment variable

[wj]

The passphrase is now read from the AGE_PASSPHRASE environment variable, as an alternative to being requested interactively.

This enables the following usage patterns:

• automation of the encryption, without having to manage an additional private key file
• provide a less error prone way of supplying a passphrase. Copy-pasting to an echo-less prompt, for example, is often hazardous on some platforms.

[ghost]

Hi,
How exactly is the env var AGE_PASSPHRASE to be supplied? I was trying age -d --AGE_PASSPHRASE but that doesn't seem to work?

Edit: Never mind, figured out.

[jc00ke]

This would be nice to see, as it would allow one to use 1Password Secret reference syntax for shared passphrases.

[gaby]

This would be great for automation/CI!

@FiloSottile

[apprehensions]

#346 (comment)

[clach04]

#346 (comment)

Cross-referencing related/duplicated discussion/PR topics:

• UX: Make age take a passphrase from a non-terminal source #275 "UX: Make age take a passphrase from a non-terminal source"
  • Add --passphrase-fd option. #276 "Add --passphrase-fd option."
• Read passphrase from AGE_PASSPHRASE env var if available #346 "Read passphrase from AGE_PASSPHRASE env var if available"
• cmd/age: passphrase optionnaly supplied from an environment variable #520 "cmd/age: passphrase optionnaly supplied from an environment variable"

[clach04]

Thanks @wj 🙏 , you saved me a few hours. When I get a few minutes I'll be building this and giving it a go 😀