skarbiec exec

Invocation#

skarbiec exec (--env NAME=<id>:<field> | --env-item PREFIX=<id> | --env-tag <tag> | --env-from <file>) [...] -- <program> [args...]

Purpose#

Give a script, a deploy or a database client its credentials as environment variables, without the values passing through a shell history, a file, a pipe or a terminal.

Required inputs and options#

• One or more --env NAME=<id>:<field>, each putting one text field of one item into one variable; --env-item PREFIX=<id>, putting every non-empty text field of one item into PREFIX_<FIELD> in upper case — a login as DB_USERNAME and DB_PASSWORD; --env-tag <tag>, doing that for every live item carrying the tag, its prefix the item id in upper case with every other character an underscore — prod-db as PROD_DB_PASSWORD — so an item added to the set later goes in too; and --env-from <file>, a file listing NAME=<id>:<field> bindings one a line — blank lines and lines starting with # skipped — so a project commits which variables its programs read and from where; all may be given and repeated. NAME and PREFIX are letters, digits and underscores not starting with a digit, and the field is split off at the last colon. Everything after -- is the program and its arguments, handed on untouched: a --help or --text there belongs to the program. The program is found on PATH as a shell would find it.

Output and state effects#

• Opens every named item and reads every field before anything starts, appends an exec journal record naming the program and each variable with its item and field — never a value — then runs the program with this terminal's standard input, output and error and the variables added to this environment. The program's exit status becomes skarbiec's own, so `skarbiec exec … -- make deploy` stands where `make deploy` stood. Nothing is printed by skarbiec itself. Desktop's item inspector builds the command line for one field as Use in a script.

Refusals#

• No -- or no program after it, no binding, an --env that is not NAME=<id>:<field> or an --env-item that is not PREFIX=<id>, a variable name a shell cannot read and a variable bound twice, across options and files alike, exit 2 naming which; a file line that is not a binding is quoted with the file, a file listing none exits 2, and a file that cannot be read fails naming it. An item that does not exist or will not open fails with its error, an --env-item item holding no text field fails naming it, and a field the item lacks with `<id> has no text field <field> for <NAME>; its fields are: <fields>`; in each case the program is not started. A program that cannot be started fails naming it, and one ended by a signal fails with `<program> was ended by signal <n>`.

Examples#

skarbiec exec --env PGPASSWORD=prod-db:password -- psql -h db.internal -U app skarbiec exec --env AWS_ACCESS_KEY_ID=aws-ci:access_key_id --env AWS_SECRET_ACCESS_KEY=aws-ci:secret_access_key -- terraform apply # deploy.bindings, committed DATABASE_PASSWORD=prod-db:password STRIPE_KEY=stripe:credential skarbiec exec --env-from deploy.bindings -- ./deploy.sh