Add --passphrase-fd option.

cmd/age/age.go

@@ -34,7 +34,7 @@ func (f *multiFlag) Set(value string) error {
 
 const usage = `Usage:
     age [--encrypt] (-r RECIPIENT | -R PATH)... [--armor] [-o OUTPUT] [INPUT]
-    age [--encrypt] --passphrase [--armor] [-o OUTPUT] [INPUT]
+    age [--encrypt] --passphrase [--passphrase-fd] [--armor] [-o OUTPUT] [INPUT]
     age --decrypt [-i PATH]... [-o OUTPUT] [INPUT]
 
 Options:
@@ -43,6 +43,7 @@ Options:
     -o, --output OUTPUT         Write the result to the file at path OUTPUT.
     -a, --armor                 Encrypt to a PEM encoded format.
     -p, --passphrase            Encrypt with a passphrase.
+        --passphrase-fd         To be used in conjunction with -p, instructs age to read passphrase from a file descriptor.
     -r, --recipient RECIPIENT   Encrypt to the specified RECIPIENT. Can be repeated.
     -R, --recipients-file PATH  Encrypt to recipients listed at PATH. Can be repeated.
     -i, --identity PATH         Use the identity file at PATH. Can be repeated.
@@ -76,6 +77,9 @@ Example:
 // golang.org/issue/29814 and golang.org/issue/29228.
 var Version string
 
+// Variable that holds --passphrase-fd if specified by the user.
+var passphraseFileDescriptor int
+
 func main() {
 	_log.SetFlags(0)
 	flag.Usage = func() { fmt.Fprintf(os.Stderr, "%s\n", usage) }
@@ -100,6 +104,7 @@ func main() {
 	flag.BoolVar(&encryptFlag, "encrypt", false, "encrypt the input")
 	flag.BoolVar(&passFlag, "p", false, "use a passphrase")
 	flag.BoolVar(&passFlag, "passphrase", false, "use a passphrase")
+	flag.IntVar(&passphraseFileDescriptor, "passphrase-fd", -1, "read passphrase from file descriptor")
 	flag.StringVar(&outFlag, "o", "", "output to `FILE` (default stdout)")
 	flag.StringVar(&outFlag, "output", "", "output to `FILE` (default stdout)")
 	flag.BoolVar(&armorFlag, "a", false, "generate an armored file")
@@ -214,7 +219,7 @@ func main() {
 	case decryptFlag:
 		decrypt(identityFlags, in, out)
 	case passFlag:
-		pass, err := passphrasePromptForEncryption()
+		pass, err := getPassphraseForEncryption()
 		if err != nil {
 			logFatalf("Error: %v", err)
 		}
@@ -224,6 +229,20 @@ func main() {
 	}
 }
 
+func getPassphraseForEncryption() (string, error) {
+	if passphraseFileDescriptor != -1 {
+		pass, err := readPassphraseFromFD(passphraseFileDescriptor)
+
+		if err != nil {
+			return "", fmt.Errorf("could not read passphrase from file descriptor %d: %v", passphraseFileDescriptor, err)
+		}
+
+		return string(pass), nil
+	}
+
+	return passphrasePromptForEncryption()
+}
+
 func passphrasePromptForEncryption() (string, error) {
 	fmt.Fprintf(os.Stderr, "Enter passphrase (leave empty to autogenerate a secure one): ")
 	pass, err := readPassphrase()
@@ -345,6 +364,16 @@ func decrypt(keys []string, in io.Reader, out io.Writer) {
 }
 
 func passphrasePrompt() (string, error) {
+	if passphraseFileDescriptor != -1 {
+		pass, err := readPassphraseFromFD(passphraseFileDescriptor)
+
+		if err != nil {
+			return "", fmt.Errorf("could not read passphrase from file descriptor %d: %v", passphraseFileDescriptor, err)
+		}
+
+		return string(pass), nil
+	}
+
 	fmt.Fprintf(os.Stderr, "Enter passphrase: ")
 	pass, err := readPassphrase()
 	if err != nil {

cmd/age/encrypted_keys.go

@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"syscall"
 
 	"filippo.io/age"
 	"golang.org/x/term"
@@ -45,6 +46,26 @@ func (i *LazyScryptIdentity) Unwrap(stanzas []*age.Stanza) (fileKey []byte, err
 	return fileKey, err
 }
 
+// readPassphraseFromFD reads a passphrase from a file descriptor.
+func readPassphraseFromFD(fd int) ([]byte, error) {
+	// readPassphraseFromFD should not be used as an alternative to readPassphrase
+	if fd == 0 {
+		return nil,fmt.Errorf("refusing to read passphrase from standard input (STDIN).\n")
+	}
+
+	buffer := make([]byte, 1024)
+	nBytes, err := syscall.Read(fd, buffer)
+
+	if err != nil {
+		return nil, err
+	}
+
+	passphrase := make([]byte, nBytes)
+	copy(passphrase, buffer)
+
+	return passphrase, nil
+}
+
 // readPassphrase reads a passphrase from the terminal. If stdin is not
 // connected to a terminal, it tries /dev/tty and fails if that's not available.
 // It does not read from a non-terminal stdin, so it does not check stdinInUse.