You could call `sendenv` syntactic sugar on top of the first example, allowing you to do things neatly in bulk instead of having to write ad hoc scripts. Additionally once you store a vault, you can send it any number of times Granted, its likely not a very frequent need, but still handy I guess.
Tracking secrets in version control is exactly what I wanted to sidestep by creating this. Sharing environment variables is an ad hoc manual process at my current company (and was the same way in previous workplaces as well).
Ansible or other centralized secret stores felt too heavy for something that should be simple.
The point of trusting the sender is applicable to anything you would send over magic wormhole, but I accept that this solution is more vulnerable given that it writes to rc files directly. I will be adding more validation at the receiver end before writing to rc files, as a response to this criticism.
It really shouldn’t be that way. If the data is meant to be selectively accessed, it should have access controls in place with Authentication, Authorization and Auditing. If its any employees discretion to share the data with another adhoc, I certainly hope the secret is not of great value.
Eliminating the cognitive load of looking up the relevant secret, writing it manually into the RC file, testing whether it works (and starting over if it doesn't, because it's possible the secret is outdated) was one of the goals of creating this.
> If you want them to persist system-wide, use ansible or some other configuration management.
I kind of understand not wanting to give other people the ability to mess with your shell, but why are these read-only?
Also, curious about the choice of Ansible...symlinks are a thing and the setup is really only as complicated as you make it. Building a mansion when you might only "need" a house with 1 or 2 bedrooms seems like an odd decision.
I think 'direnv' is really the way to go here for most cases you want to share environment variables between developer machines, but if you're managing user's shell rc files, then you might as well use proper configuration management, because ad-hoc appending strings to those rc files is the stuff of nightmares.
The thing that really made dotfiles click for me was the switch to zsh in macOS + Armin Briegel's (of Scripting OS X) book, which laid out exactly how the transition was going to work. I'd done some basic things in `.bash_profile`, but this took it to another level entirely.
Tl;dr `zsh-newuser-install` is pretty idiot-proof, but it helps to know what the options are if you've never seen them before.
Is there at least a prompt? I dislike and distrust tools which write to those files on their own. My shell’s startup files are organised how I want, with different sections depending on what’s relevant. It’s the entry point to every terminal session so I know what every line does. I don’t appreciate when a tool decides it’s OK to latch itself to every terminal session in a disorganised manner without permission, especially since those additions are seldom removed when the tool is uninstalled.
Cleaning up after uninstall is also a good idea.
Thanks for the feedback!
It also, just like the eval in the first example, has the downside of requiring you to completely trust the sender since they can send arbitrary code to execute that'll get written to your shell's rc file.
Basically, if you need to share ad-hoc env vars in a single terminal session, the wormhole snippet I posted above is fine.
If you want them to persist, probably use direnv to share them, ideally tracked in version control.
If you want them to persist system-wide, use ansible or some other configuration management.
The middle-ground, of wanting them to persist so much you write them to the shell rc, but not wanting them to be version controlled or configuration managed, seems like the worst of both worlds.