{"action":"opened","issue":{"url":"https://api.github.com/repos/boot-clj/boot/issues/432","repository_url":"https://api.github.com/repos/boot-clj/boot","labels_url":"https://api.github.com/repos/boot-clj/boot/issues/432/labels{/name}","comments_url":"https://api.github.com/repos/boot-clj/boot/issues/432/comments","events_url":"https://api.github.com/repos/boot-clj/boot/issues/432/events","html_url":"https://github.com/boot-clj/boot/issues/432","id":143689551,"number":432,"title":"Decrypt deploy creds only when needed","user":{"login":"malcolmsparks","id":163131,"avatar_url":"https://avatars.githubusercontent.com/u/163131?v=3","gravatar_id":"","url":"https://api.github.com/users/malcolmsparks","html_url":"https://github.com/malcolmsparks","followers_url":"https://api.github.com/users/malcolmsparks/followers","following_url":"https://api.github.com/users/malcolmsparks/following{/other_user}","gists_url":"https://api.github.com/users/malcolmsparks/gists{/gist_id}","starred_url":"https://api.github.com/users/malcolmsparks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/malcolmsparks/subscriptions","organizations_url":"https://api.github.com/users/malcolmsparks/orgs","repos_url":"https://api.github.com/users/malcolmsparks/repos","events_url":"https://api.github.com/users/malcolmsparks/events{/privacy}","received_events_url":"https://api.github.com/users/malcolmsparks/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-26T11:03:29Z","updated_at":"2016-03-26T11:03:29Z","closed_at":null,"body":"The `configure-repositories!` solution described [here](https://github.com/boot-clj/boot/wiki/Repository-Credentials-and-Deploying#encrypted-credentials-file) involves the decryption of credentials every time boot is run, even for operations that don't require them. \r\n\r\nThis is a problem for those of us using yubikeys or other hardware tokens who have to keep them plugged in even while doing offline development.\r\n\r\nIt was be better if the design of this was improved such that it was lazier.\r\n\r\nFWIW here's my profile.boot\r\n\r\n```clojure\r\n;; Get credentials from a GPG encrypted file.\r\n(defn decrypt-creds [url]\r\n  (let [creds-file (java.io.File. (boot.App/bootdir) \"credentials.gpg\")\r\n        creds-data (boot.core/gpg-decrypt creds-file :as :edn)]\r\n    (some #(when (re-seq (first %) url) (second %)) creds-data)))\r\n\r\n(defn repo-map [repo]\r\n  (case repo\r\n    \"clojars\" (let [url \"https://clojars.org/repo/\"]\r\n                (merge {:url url}\r\n                       (decrypt-creds url)))\r\n    (throw (ex-info \"Unknown repo\" {:repo repo}))))\r\n\r\n\r\n```\r\n\r\nThis way I can deploy like this in my build.boot\r\n\r\n```\r\n(deftask deploy []\r\n   (push :repo-map (repo-map \"clojars\")))```"}}