Secrets from file

src/keybaseca/config/config.go

@@ -5,11 +5,8 @@ import (
 	"io/ioutil"
 	"os"
 	"strings"
-
 	"github.com/keybase/bot-sshca/src/keybaseca/constants"
-
 	"github.com/keybase/bot-sshca/src/keybaseca/botwrapper"
-
 	"github.com/keybase/bot-sshca/src/shared"
 )
 
@@ -143,13 +140,13 @@ func (ef *EnvConfig) GetKeybaseHomeDir() string {
 // Get the keybase paper key for the bot account. Used if you are running a separate instance of keybase for the chatbot.
 // May be empty.
 func (ef *EnvConfig) GetKeybasePaperKey() string {
-	return os.Getenv("KEYBASE_PAPERKEY")
+	return shared.ReadFileOrDefault(os.Getenv("KEYBASE_PAPERKEY_PATH"), os.Getenv("KEYBASE_PAPERKEY"))
 }
 
 // Get the keybase username for the bot account. Used if you are running a separate instance of keybase for the chatbot.
 // May be empty.
 func (ef *EnvConfig) GetKeybaseUsername() string {
-	return os.Getenv("KEYBASE_USERNAME")
+	return shared.ReadFileOrDefault(os.Getenv("KEYBASE_USERNAME"), os.Getenv("KEYBASE_USERNAME_PATH"))
 }
 
 // Get the expiration period for signatures generated by the bot.

src/shared/utils.go

@@ -1,6 +1,8 @@
 package shared
 
 import (
+	"io/ioutil"
+	"os"
 	"os/user"
 	"path/filepath"
 	"strings"
@@ -29,3 +31,20 @@ func ExpandPathWithTilde(path string) string {
 	}
 	return path
 }
+
+// Tries to read data from a file from given path.
+// If no file is found, the file read creates an error or is empty,
+// the function will return the value of the `or` parameter instead.
+func ReadFileOrDefault(filePath string, or string) string {
+	if len(filePath) <= 0 {
+		return or
+	}
+	if _, err := os.Stat(filePath); os.IsNotExist(err) {
+		return or
+	}
+	data, err := ioutil.ReadFile(filePath)
+	if err != nil || len(data) <= 0 {
+		return or
+	}
+	return string(data)
+}