1 files changed, 46 insertions, 0 deletions
diff --git a/secrets/get.sh b/secrets/get.sh
new file mode 100755
index 0000000..d88b696
--- /dev/null
+++ b/secrets/get.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ "$#" -gt 0 && ("$1" == "-h" || "$1" == "--help") ]]; then
+    cat <<EOF
+get: Retrieve and decrypt a secret from the store
+
+Decrypts and outputs a secret value from the global secret store.
+
+Usage:
+  get <secret-name>
+  get -h|--help
+
+Arguments:
+  secret-name    Name of the secret to retrieve
+
+The command will:
+1. Check if the secret exists in the store
+2. Ensure the private key is available
+3. Decrypt the secret using age and output to stdout
+
+Note: Exits with error if secret doesn't exist or decryption fails.
+EOF
+    exit 0
+fi
+
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+source "${this_dir}/common.sh"
+
+if [[ "$#" -lt 1 ]]; then
+    >&2 echo "ERROR: Need secret name"
+    exit 1
+fi
+name="$1"
+
+file="$(file_for "${name}")"
+if ! [[ -r "${file}" ]]; then
+    >&2 echo "ERROR: Secret '$name' not found"
+    exit 1
+fi
+
+ensure_private_key
+
+age_decrypt "${private_key}" "${file}"
+