$ show humblepenguinn/envio
envio is a Rust CLI tool for managing environment variables in encrypted profiles. It creates, edits, imports, exports, and deletes profiles stored as `.envio` files in a project's `.envio/profiles` directory. The profiles can be plaintext or encrypted using passphrase (Argon2id + XChaCha20Poly1305), symmetric key (base64-encoded 32-byte key + XChaCha20Poly1305), or GPG (delegates to the system `gpg` CLI). The tool integrates with the OS keyring to store encryption keys and provides both a command-line interface and a TUI (beta) built with ratatui. The architecture cleanly separates library code (profile, cipher, env map) from binary code (CLI, TUI, prompts). The library is reusable for other Rust projects needing profile-based encrypted env management, though cipher types are somewhat coupled to the crate's error types. The encryption implementations demonstrate solid security practices (Argon2id password hashing, XChaCha20Poly1305 AEAD with streaming). The CI/CD pipeline builds for multiple platforms and generates shell completions and man pages at compile time. The project lacks unit tests in the visible source tree, which is a notable gap.
The LLM identified 5 files worth highlighting for reuse:
Implements passphrase-based encryption using Argon2id for key derivation and XChaCha20Poly1305 in streaming mode (BE32 chunked). This is a self-contained module that handles salting, nonce generation, and chunked encryption/decryption. It could be extracted as a standalone encryption helper for other Rust projects needing password-based AEAD encryption, though it depends on the crate's error type.
Implements symmetric key encryption using XChaCha20Poly1305 in streaming mode (BE32 chunked). It takes a base64-encoded 32-byte key and encrypts/decrypts data in chunks. The pattern is clean and isolated, suitable for reuse in other projects that require symmetric encryption of binary data. The key size validation and nonce handling follow good security practices.
Wraps the system's GPG CLI tool via subprocess to encrypt/decrypt profile data. It demonstrates a pattern for integrating external cryptography tools without native bindings: spawning `gpg` with piped stdin/stdout, parsing `--list-keys` output to discover available recipient keys, and handling error conditions. The approach is reusable for projects that want to delegate encryption to GPG while providing a Rust-native interface.
Defines the `Env` struct and `EnvMap` collection (backed by `IndexMap`). `EnvMap` preserves insertion order and provides methods like `insert`, `remove`, `get`, `retain`, `iter`, and conversions to/from `IndexMap<String,String>` and byte slices via postcard. It is a lightweight, reusable container for key-value pairs with metadata (comment, expiration). Could be used in other Rust projects requiring ordered, serde-serializable env maps.
Compile-time script that generates shell completions (bash, zsh, fish, powershell) and a man page using clap_complete and clap_mangen. It also captures build metadata (timestamp, profile, target). This pattern is highly reusable for any Rust CLI project using clap: it offloads completion generation to build time, ensuring they stay in sync with the CLI definition without runtime overhead.