From 71bca1305e946a5b4ad3bf58d3399fce7d2352f5 Mon Sep 17 00:00:00 2001
From: Cory Francis Myers <cory@freedom.press>
Date: Mon, 11 Mar 2024 16:32:01 -0700
Subject: [PATCH] feat: instead of setting environment variables, render input
 template to output file

---
 with-qubesdb | 36 +++++++++++++++++++++++++-----------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/with-qubesdb b/with-qubesdb
index 35c37bc9d..c2a716742 100755
--- a/with-qubesdb
+++ b/with-qubesdb
@@ -1,24 +1,38 @@
 #!/usr/bin/env python3
 import argparse
 import subprocess
+from jinja2 import Template
 
 from qubesdb import QubesDB
 
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Use -k/--key one or more times to read the specified key from QubesDB.  All subsequent arguments will be interpreted as the command to be invoked with those keys set as environment variables.")
-    parser.add_argument("-k", "--key", action="append")
-    args = parser.parse_known_args()
 
+def get_env(args):
     env = {}
     try:
         db = QubesDB()
-        for key in args[0].key or []:
+        for key in args or []:
             value = db.read(f"/vm-config/{key}")
-            env[key] = value or ''
-
-        if len(args[1]) > 0:
-            cmd = subprocess.Popen(args[1], env=env)
-            cmd.wait()
+            env[key] = (value or "").decode()
 
     finally:
-        db.close()
\ No newline at end of file
+        db.close()
+
+    return env
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description="Use -k/--key one or more times to read the specified key from QubesDB.  The input template will be written to the output file with those variables substituted."
+    )
+    parser.add_argument("-k", "--key", action="append")
+    parser.add_argument("input")
+    parser.add_argument("output")
+    args = parser.parse_args()
+    env = get_env(args.key)
+
+    with open(args.input) as input_f:
+        template = Template(input_f.read())
+
+    with open(args.output, "w") as output_f:
+        rendered = template.render(**env)
+        output_f.write(rendered)