dotsecenv

dotsecenv: safe environment secrets

A complete Go CLI application for securely managing environment secrets with GPG-based encryption, multi-user support, and FIPS 186-5 compliant algorithm defaults.

Quick Start

Store your first secret

# After installation (see below)
dotsecenv init config
dotsecenv init vault -v ~/.local/share/dotsecenv/vault
dotsecenv login <YOUR GPG FINGERPRINT> # gpg --list-public-keys
echo "xyz" | dotsecenv secret store TEST_SECRET
# Subsequently, you can decrypt secrets
# as long as you hold the corresponding secret key in GPG agent
dotsecenv secret get TEST_SECRET # should output "xyz"

Installation

Install Script (recommended)

The universal install script (install.sh) is the fastest way to install dotsecenv on macOS and Linux. It auto-detects your platform, downloads the correct binary, verifies checksums and GPG signatures, and installs shell completions, man pages, the shell plugin, and the Terraform credentials helper automatically.

Usage

# Piped (simplest)
curl -fsSL https://get.dotsecenv.com/install.sh | bash

# Piped with CLI flags
curl -fsSL https://get.dotsecenv.com/install.sh | bash -s -- [OPTIONS]

# Piped with environment variables
VERSION=v1.2.3 curl -fsSL https://get.dotsecenv.com/install.sh | bash

# Downloaded and run locally
curl -fsSL https://get.dotsecenv.com/install.sh -o install.sh
chmod +x install.sh
./install.sh --version v1.2.3

The script works with either curl or wget.

Options

Every setting can be configured via a CLI flag or an environment variable. Precedence order: CLI flags > environment variables > defaults.

Setting	CLI Flag	Env Var	Default	Description
Version	--version VERSION	VERSION	latest	Version to install (e.g., v1.2.3)
Install directory	--install-dir DIR	INSTALL_DIR	~/.local/bin	Binary install path
System-wide install	--system	SYSTEM_INSTALL	0 (no)	Install to system paths (/usr/local/bin on macOS, /usr/local/bin on Linux) instead of user-level paths
Shell plugin	--[no-]install-shell-plugin	INSTALL_SHELL_PLUGIN	1 (yes)	Install the shell plugin for zsh/bash/fish
Completions	--[no-]install-completions	INSTALL_COMPLETIONS	1 (yes)	Install shell completions for bash, zsh, and fish
Man pages	--[no-]install-man-pages	INSTALL_MAN_PAGES	1 (yes)	Install man pages
TF credentials helper	--[no-]install-tf-credentials-helper	INSTALL_TF_CREDENTIALS_HELPER	1 (yes)	Install the Terraform credentials helper
Verification	--[no-]verify	VERIFY	1 (yes)	Verify SHA-256 checksums and GPG signatures
Help	-h, --help	—	—	Show help and exit

What the Installer Does