decrypt -- can we provide passphrase non-interactively?

[laur89]

This FAQ instructs us to create a script that decrypts the key at first init:

chezmoi age decrypt --output "${HOME}/.config/chezmoi/key.txt" --passphrase "{{ .chezmoi.sourceDir }}/key.txt.age"

Is it possible to provide a passphrase in some way, preferably via env var, to aide non-interactive system bootstrapping?
In my case the passphrase can be automatically retrieved from a password manager and be made available as an env var prior to chezmoi execution.

[twpayne]

No. If you're providing the passphrase then you're also decrypting the key. If you need the decrypted key then you can copy that in directly.

[laur89]

Cheers, I'll work around it. Out of curiosity, couldn't something like the pinentry setting be used to automatically provide the passphrase?

[twpayne]

The pinentry setting is to allow the user to choose the program that prompts for their passphrase. The user still has to enter their passphrase manually.

Fundamentally, providing the passphrase automatically is the same as providing the private key automatically. Unless I'm missing something?

[laur89]

Fundamentally, correct. In my current setup producing a keyfile itself is a bit cumbersome, but can be worked around.