启动脚本以从Python导出环境变量

Question

I'm trying to remove all passwords and secrets from applications.

To do this, I'm using environment variables. I would like to avoid putting this specific stuff into ~/.bashrc or other built in files. It would be ideal to call a specific script that exports the desired variables.

The reason for this is because the environment variables contain passwords and I'm trying to isolate them outside of all code except the environment scripts that set environment variables.

To summarize the desired flow:

1. Launch Python app
2. App spawns process that sets new environment variables
3. App pulls values from previously set environment variables
4. App uses those values in further processing

contents of testpy.py

#!/usr/bin/env python

import os
import subprocess

env_file='/tmp/env_file'
db_pass_var='DBPASS'

#execute bash script that sets the env vars
subprocess.call([".", env_file], shell=True)

#try to get the variable set and print it
print os.getenv(db_pass, 'fail')

contents of /tmp/env_file

#!/usr/bin/env bash

export DBUSER="myuser"
export DBPASS="mypass"

I've tried various methods like subprocess.Popen commands I found on other stackoverflow threads but nothing seems to work.

Alternatives that I want to avoid:

• Running the env_file script first, then launching the python code. The goal is to run it all from 1 application.

• Putting the passwords into a config file. The goal is environment variables. Config files I would like to reserve to pointing to what variable to call, rather than setting the env vars themselves. This is because config files are checked into source control. The only thing I want to leave out of source control is the actual export environment variables themselves which contain all sensitive environment info.

Answer 1

There's an easier way. Just provide a wrapper script that sets the environment variables and then calls your main script.

It's convenient to use the envdir utility for this. If you can't use that for some reason, then set env vars directly using os.environ and spawn off your main script as a child process.