Right now the only non-argv way to give apkeep the Google Play aas_token (or the auth_token added in 1.0.0) is the ini file passed with -i, which means the token has to be written to disk in cleartext.
I fetch the token from a secrets manager at runtime and would rather never persist it. Could apkeep gain a way to read the token from one of:
- an environment variable, e.g.
APKEEP_AAS_TOKEN / APKEEP_AUTH_TOKEN;
- a
--token-file pointing at a path the caller controls (so it can be a pipe / process substitution / /dev/fd/... rather than a real file on disk); or
- stdin.
The -i ini file can stay exactly as-is for the common case — this would just add a path for callers who already hold the token in memory and want to keep it off both the argv (already avoided via the ini) and the disk.
Tested against 1.0.0. Thanks for apkeep.
Right now the only non-argv way to give apkeep the Google Play
aas_token(or theauth_tokenadded in 1.0.0) is the ini file passed with-i, which means the token has to be written to disk in cleartext.I fetch the token from a secrets manager at runtime and would rather never persist it. Could apkeep gain a way to read the token from one of:
APKEEP_AAS_TOKEN/APKEEP_AUTH_TOKEN;--token-filepointing at a path the caller controls (so it can be a pipe / process substitution //dev/fd/...rather than a real file on disk); orThe
-iini file can stay exactly as-is for the common case — this would just add a path for callers who already hold the token in memory and want to keep it off both the argv (already avoided via the ini) and the disk.Tested against 1.0.0. Thanks for apkeep.