py-secretcrypt
Utility for keeping your secrets encrypted. Also has a Go version.
For example, you have the following configuration file
MY_SECRET=VerySecretValue!
but you can’t include that file in VCS because then your secret value would be exposed.
With secretcrypt, you can encrypt your secret using your AWS KMS master key aliased MyKey:
$ encrypt-secret kms alias/MyKey
Enter plaintext: VerySecretValue! # enter
kms:region=us-east-1:CiC/SXeuXDGRADRIjc0qcE... # shortened for brevity
# --- or --
$ echo "VerySecretValue!" | encrypt-secret kms alias/MyKey
kms:region=us-east-1:CiC/SXeuXDGRADRIjc0qcE... # shortened for brevity
# only use piping when scripting, otherwise your secrets will be stored
# in your shell's history!use that secret in my config file
from secretcrypt import Secret
MY_SECRET=Secret('kms:region=us-east-1:CiC/SXeuXDGRADRIjc0qcE...') # shortened for brevityand get the plaintext like
print MY_SECRET.get()
# VerySecretValue!If you are using very sensitive secrets, you can ensure the plaintext is not kept in memory and is only encrypted on demand by using a stricter version:
from secretcrypt import StrictSecret
MY_SECRET=StrictSecret('kms:region=us-east-1:CiC/SXeuXDGRADRIjc0qcE...') # shortened for brevityand get the plaintext like
print MY_SECRET.decrypt()
# VerySecretValue!KMS
The KMS option uses AWS Key Management Service. When encrypting and decrypting KMS secrets, you need to provide which AWS region the is to be or was encrypted on, but it defaults to us-east-1.
So if you use a custom region, you must provide it to secretcrypt:
encrypt-secret kms --region us-west-1 alias/MyKeyLocal encryption
This mode is meant for local and/or offline development usage. It generates a local key in your %USER_DATA_DIR% (see appdirs), so that the key cannot be accidentally committed to CVS.
It then uses that key to symmetrically encrypt and decrypt your secrets.
Password encryption - interactive only
The password encryption mode should not be used in your application - it is meant for easily sharing secrets among developers. It interactively prompts the user for a password when encrypting the secret. When decrypting, it prompts for the password again.
History
1.0.4 (2020-09-21)
fixed reraise error in decrypt module
1.0.3 (2017-11-02)
reverted scrypt parameter changes
1.0.2 (2017-10-31)
changed scrypt parameters
1.0.1 (2017-10-31)
Fixed readme formatting.
1.0.0 (2017-10-31)
added password encryption/decryption
0.9.1 (2017-03-28)
Python3 local module fixed issue with utf-8
unpinned dependencies
0.4 (2016-03-02)
plaintexts are now returned as strings not as bytes
0.3 (2016-03-02)
BREAKING CHANGE: introduced new semantics for Secret and a new StrictSecret
1 maintainer
Metadata
1 maintainer
Release files for secretcrypt 1.0.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| secretcrypt-1.0.4.tar.gz | 10.3 kB | Without provenance | Details |
Release files / secretcrypt-1.0.4.tar.gz
| Download URL | secretcrypt-1.0.4.tar.gz |
|---|---|
| Size | 10.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
02f1058daf3df10d243e9abe17914e16fa28ad73e2215464003067b4f1129e0e
|
|
BLAKE2b-256 checksum How to use checksums |
1b30255f8121b4e0f0f8d129d9a1183cdb2992e1496a70eff2a396ac5bce0ab7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/1.15.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/39.0.1 requests-toolbelt/0.9.1 tqdm/4.49.0 CPython/2.7.17
|
Security for secretcrypt 1.0.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
