{"id":20697672,"url":"https://github.com/opennti/nti.recipes.passwords","last_synced_at":"2026-05-27T06:32:10.995Z","repository":{"id":57447169,"uuid":"93669266","full_name":"OpenNTI/nti.recipes.passwords","owner":"OpenNTI","description":"A zc.buildout recipe for securely storing passwords in version control","archived":false,"fork":false,"pushed_at":"2023-04-24T18:05:54.000Z","size":54,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":11,"default_branch":"master","last_synced_at":"2025-12-25T18:29:34.115Z","etag":null,"topics":["buildout","encryption","passwords","python","version-control"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/OpenNTI.png","metadata":{"files":{"readme":"README.rst","changelog":"CHANGES.rst","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2017-06-07T18:56:52.000Z","updated_at":"2023-04-24T16:24:26.000Z","dependencies_parsed_at":"2023-07-18T00:52:36.889Z","dependency_job_id":null,"html_url":"https://github.com/OpenNTI/nti.recipes.passwords","commit_stats":null,"previous_names":["nextthought/nti.recipes.passwords"],"tags_count":12,"template":false,"template_full_name":null,"purl":"pkg:github/OpenNTI/nti.recipes.passwords","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenNTI%2Fnti.recipes.passwords","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenNTI%2Fnti.recipes.passwords/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenNTI%2Fnti.recipes.passwords/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenNTI%2Fnti.recipes.passwords/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/OpenNTI","download_url":"https://codeload.github.com/OpenNTI/nti.recipes.passwords/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenNTI%2Fnti.recipes.passwords/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33554780,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-27T02:00:06.184Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["buildout","encryption","passwords","python","version-control"],"created_at":"2024-11-17T00:19:23.754Z","updated_at":"2026-05-27T06:32:10.969Z","avatar_url":"https://github.com/OpenNTI.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"=======================\n nti.recipes.passwords\n=======================\n\n.. image:: https://travis-ci.org/NextThought/nti.recipes.passwords.svg?branch=master\n    :target: https://travis-ci.org/NextThought/nti.recipes.passwords\n\n.. image:: https://coveralls.io/repos/github/NextThought/nti.recipes.passwords/badge.svg?branch=master\n    :target: https://coveralls.io/github/NextThought/nti.recipes.passwords?branch=master\n\nThis is a ``zc.buildout`` recipe for `securely storing encrypted files\nin version control\n\u003chttps://johnresig.com/blog/keeping-passwords-in-source-control/\u003e`_,\nbut decrypting them when buildout is run. The output can either be a\ndecrypted file on disk, or a set of values in a buildout part for use\nby other parts.\n\nLets look at an example using a buildout part. Decrypted values are\ncommonly used by other parts. Here, we're setting environment\nvariables in the entry point scripts buildout generates::\n\n  [passwords]\n  recipe = nti.recipes.passwords\n  file = prod_passwords.pass.cast5\n\n  # Declare the variables in the password file\n  # for convenience\n  aws_secret_access_key =\n\n  [boto]\n  aws_access_key_id = MYAWSACCESSKEY\n\n  [eggs]\n  eggs = my.eggs\n         boto\n\n  # Let scripts know how they should contact\n  # It's important to only put the Boto keys in the environment\n  # if they are defined, as they take highest precedence\n  initialization +=\n      if \"${boto:aws_access_key_id}\": os.environ['AWS_ACCESS_KEY_ID'] = \"${boto:aws_access_key_id}\"\n      if \"${passwords:aws_secret_access_key}\": os.environ['AWS_SECRET_ACCESS_KEY'] = \"${passwords:aws_secret_access_key}\"\n\n\nThey can also be used in templates for new files::\n\n  [backup-scripts]\n  recipe = z3c.recipe.filetemplate\n  source-directory = templates\n  dest-directory = ${buildout:root-directory}\n  files = ascript\n\nWhere ``templates/ascript.in`` might look like this::\n\n  #!${deployment:bin-directory}/python\n\n  import subprocess\n  cmd = [\n      '${deployment:bin-directory}/s3put',\n      '--access_key', '${boto:aws_access_key_id}',\n      '--secret_key', '${passwords:aws_secret_access_key}',\n      ...\n  ]\n\n  subprocess.check_call(cmd)\n\nCreating The Encrypted Data\n===========================\n\nThe encrypted file is a standard ConfigParser (``ini``) file.\nContinuing our example, it might look something like this::\n\n  [passwords]\n  aws_secret_access_key = MYSECRETKEY\n\nNote that the name of the section in the ini file matches the name of\nthe section in the buildout configuration. You can have multiple\nsections in one ini file, each corresponding to a different section in\nthe buildout configuration.\n\nYou'll encrypt the file using openssl::\n\n  openssl cast5-cbc -e -in prod_passwords.pass -out prod_passwords.pass.cast5\n\nThe file ``prod_passwords.pass.cast5`` is then checked into version\ncontrol and distributed securely with the buildout configuration. (The\nfile ``prod_passwords.pass`` is **not** checked into version control.)\n\nThe ``.cast5`` extension is mandatory.\n\nDecrypting The Encrypted Data\n=============================\n\nThe first time buildout is run, or when the encrypted data's\nmodification time or checksum changes, you will be interactively\nprompted to enter the password to decrypt the file. This means that\nfor that first run, buildout must be run in the foreground with TTY\naccess.\n\nDecrypting Files\n================\n\nTo produce a decrypted file on disk, rather than a set of values in a\nbuildout part, use the ``nti.recipes.passwords:decryptFile`` recipe.\nIt functions the same as the default recipe, with the addition of a\n``output-file`` setting. The input data can be in any file format::\n\n  [file]\n  recipe = nti.recipes.passwords:decryptFile\n  file = sensitivedata.bin.cast5\n  output-file = ${deployment:etc-directory}/sensitivedata.bin\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopennti%2Fnti.recipes.passwords","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopennti%2Fnti.recipes.passwords","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopennti%2Fnti.recipes.passwords/lists"}