From d411f346b4c05375e4a3d0bbcf48c2d84b1b2e72 Mon Sep 17 00:00:00 2001
From: Mitsuo Tokumori <mitsuo@tokumori.xyz>
Date: Tue, 7 Jul 2026 05:36:07 +0900
Subject: Initial commit

---
 .gitignore         |  1 +
 README             | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 main.py            |  4 ++++
 run.sh             |  3 +++
 secrets.sh.example |  1 +
 5 files changed, 56 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 README
 create mode 100644 main.py
 create mode 100755 run.sh
 create mode 100644 secrets.sh.example

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b654e1f
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+secrets.sh
diff --git a/README b/README
new file mode 100644
index 0000000..f50f0b2
--- /dev/null
+++ b/README
@@ -0,0 +1,47 @@
+Bootstrap secrets management in a project.
+
+Problem: Secrets (e.g., passowrds, API keys) get accidentaly commited and are
+leaked when a repository becomes public.
+
+Solution:
+
+secrets.sh.example  defines variable names
+secrets.sh          defines secret values
+run.sh              sources secrets
+.gitignore          exclude secrets.sh
+
+Rationale
+=========
+
+People are lazy.  The less steps the better.  So, `run.sh` should create
+`secrets.sh` out of `secrets.sh.example`, and nd tell the user to modify it.
+
+This flow is simple and portable.  No unreliable dependencies like:
+
+https://pypi.org/project/python-dotenv/  for the people that cannot use os.environ
+https://www.npmjs.com/package/dotenv
+
+People often use these tools because they don't know shell scripting.  Here's a
+quick reminder
+
+```sh
+foo=somevalue
+./run           # does not receive foo
+foo=anothervalue ./run    # passes foo only for ./run
+export foo      # mark variable for automatic export
+export -n foo   # remove export mark
+unset foo       # delete variable, alongside any marks
+
+set | grep foo    # check local variables
+env | grep foo    # check variables marked for automatic export to the environment of subsequently executed commands
+
+
+# shell built-ins
+help export
+help unset
+
+# external programs
+man env
+
+# Shell built-ins take precedence over any external program with the same name.
+```
diff --git a/main.py b/main.py
new file mode 100644
index 0000000..240d7fd
--- /dev/null
+++ b/main.py
@@ -0,0 +1,4 @@
+import os
+
+for k in os.environ:
+    print(f"{k}={os.environ[k]}")
diff --git a/run.sh b/run.sh
new file mode 100755
index 0000000..3cddd6d
--- /dev/null
+++ b/run.sh
@@ -0,0 +1,3 @@
+[ -f secrets.sh ] || cp secrets.sh.example secrets.sh
+source secrets.sh
+python main.py | grep MYSECRET
diff --git a/secrets.sh.example b/secrets.sh.example
new file mode 100644
index 0000000..6f3b387
--- /dev/null
+++ b/secrets.sh.example
@@ -0,0 +1 @@
+export MYSECRET=yoursecret
-- 
cgit v1.2.3