Use keybase non-interactively, from a script?

[brikis98]

We have some automated tests that run on a CI server that need to retrieve a file from KBFS. I've created a "machine user" Keybase account and that user now has access to the file. If I could keybase login <machine-user>, I'd be all set, but the login command prompts for a password.

Is there any way to use the client, or at least the login command, in a non-interactive mode?

[delitescere]

I understand the need to cryptographically identify each device, but it is extremely bothersome in a world with infrastructure-as-code where a CI service might be being provisioned from scratch at any time (e.g. as a Docker container). Even if I keep pertinent parts of .local and .config on a host volume and keep the hostname consistent, the keybase login insists I have a new device that must be verified by another device.

Is there some mechanism of providing additional credentials (e.g. private key, paper key) to keybase login so automated systems can be keybase clients? Obviously those credentials should be held in an encrypted state by the provisioning system (e.g. in encrypted environment variables in Jenkins).

Otherwise, the use of keybase as a git repository for secrets becomes much less useful in an end-to-end continuous delivery pipeline. We have to duplicate those secrets in other systems (e.g. in encrypted environment variables in Jenkins).

This might be called "ephemeral device" support. See #9066

Thanks!

[bootstraponline]

Implemented in #11500

I think this issue can be closed.

[maxtaco]

Thanks for the feedback!