Download the PHP package bharathcoorg/interenv without Composer
On this page you can find all versions of the php package bharathcoorg/interenv. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download bharathcoorg/interenv
More information about bharathcoorg/interenv
Files in bharathcoorg/interenv
Package interenv
Short Description Hardware-Enclave Protected Secrets for PHP & Laravel Applications (Zero Plaintext .env on Disk) by Interlayer
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package interenv
Built for macOS Secure Enclave / Keychain, Windows TPM/DPAPI credential storage, and Linux TPM / Secret Service.
Secrets are decrypted for the command lifecycle; physical erasure on SSD/CoW storage is not guaranteed.
📦 Official Packages & SDKs
InterEnv core engine, CLI, and multi-language client SDKs are officially published and immediately available across all major package ecosystems:
| Ecosystem | Registry / Source | Install / Add Command | Direct Registry Links |
|---|---|---|---|
| Rust | crates.io | cargo add interenv • cargo install interenv |
 • crates.io/crates/interenv |
| Node.js / TypeScript | npm | npm install interenv • npx interenv |
 • npmjs.com/package/interenv |
| Python / AI Agents | PyPI | pip install interenv |
 • pypi.org/project/interenv |
| PHP / Laravel / Symfony | Packagist | composer require bharathcoorg/interenv |
 • packagist.org/packages/bharathcoorg/interenv |
| Go Microservices | Go Modules | go get github.com/Bharathcoorg/interenv/go/[email protected] |
pkg.go.dev/github.com/Bharathcoorg/interenv/go |
| Standalone Binaries | GitHub Releases | Prebuilt binaries for Linux, macOS (Apple Silicon & Intel), Windows | GitHub v1.0.1 Release Assets |
| Container Image | GitHub Packages (GHCR) | docker pull ghcr.io/bharathcoorg/interenv:latest |
GitHub Packages |
⚡ Why InterEnv?
Every software engineer, Web3 validator, and AI agent builder uses environment variables to store mission-critical credentials: INTERLAYER_VALIDATOR_KEY, ETHEREUM_PRIVATE_KEY, OPENAI_API_KEY, AWS_SECRET_ACCESS_KEY, database connection strings, and webhook signing secrets.
- ❌ The Catastrophic Problem: Plaintext
.envfiles get accidentally committed to public GitHub repositories daily. Maliciousnpmandpippackages scan developers' hard drives to exfiltrate plaintext secrets. In blockchain environments, a leaked.envmeans permanent loss of validator stake or treasury funds. - ❌ The Flaw in Other Tools:
dotenvxencrypts secrets but stores the decryption key in another plaintext file (.env.keys) on disk! Cloud secret managers (1Password, Doppler, Infisical) are cloud-locked, slow, and require expensive monthly subscriptions. - 🛡️ The InterEnv Solution: Engineered originally to safeguard high-stakes validator keys and autonomous agent secrets for the Interlayer Blockchain ecosystem, InterEnv seals your project secrets using a hardware-backed provider where available, or the operating-system credential store as a fallback. Secrets are decrypted into the child process environment for the command lifecycle; in-memory cleanup uses Rust zeroization where supported, but cannot guarantee removal of every runtime copy.
📊 Security Architecture Comparison
| Feature | Plaintext .env |
dotenvx |
1Password / Doppler | InterEnv (This Tool) |
|---|---|---|---|---|
| Storage Security | 🔴 Zero (Plaintext on disk) | 🟡 Key file on disk (.env.keys) |
🟢 Cloud Vault | 🟢 Hardware-backed or OS credential store |
| Disk Plaintext | 🔴 Exposed | 🟡 Exposes decrypted files | 🟢 None | 🟢 No plaintext lock payload |
| Cloud Dependency | 🟢 Offline | 🟢 Offline | 🔴 Required (Vendor Lock-in) | 🟢 100% Offline & Local-First |
| Pricing | Free | Free | $19–$39/user/month | 🟢 100% Free & Open Source (MIT) |
| Git Pre-Commit Hook | ❌ Manual | ❌ Manual | ❌ Complex setup | 🟢 Built-in 1-Click Guard |
| Secure Shredding | ❌ None | ❌ None | ❌ None | 🟢 Best-effort overwrite + unlink |
| Runtime Speed | Instant | Slow (Node.js) | Slow CLI (Cloud round-trips) | ⚡ < 1ms (Pure Rust) |
🚀 Installation
Via Cargo (Rust)
Via NPM / NPX (Node.js)
From Source
[!NOTE] Real TPM 2.0 Support: Linux hardware TPM 2.0 support requires building with
--features tpm. Without this flag, Linux uses the OS credential store when available; it does not use a software-derived XOR KEK.
See INSTALL.md for full installation guides across Cargo, NPM, PyPI, Go, PHP, and Docker.
💡 Quickstart in 10 Seconds
1. Seal Your .env into protected key storage
Inside any project with an existing .env file:
What happens:
- Generates an XChaCha20-Poly1305 master project key and seals it with the strongest available hardware-backed or OS credential provider.
- Creates an encrypted, git-safe
.interenv.lockfile. - Best-effort overwrites and removes the plaintext
.env; SSDs, snapshots, copy-on-write filesystems, and wear-leveling can retain historical blocks.
2. Run Any App with Secrets in Volatile Memory
Execute any tool, test runner, validator node, or web server:
Secrets are injected directly into child process memory. Nothing ever touches disk.
3. Edit Secrets Safely
Need to add a new API key?
Opens your default $EDITOR in a secure temporary buffer, updates keys, re-encrypts into .interenv.lock, and securely shreds the temp buffer.
4. Install Git Pre-Commit Protection
Installs an automated guard in .git/hooks/pre-commit that detects and immediately aborts any accidental staging or commit of .env files or hardcoded API keys.
💻 Multi-Language Programmatic SDKs
InterEnv provides native, zero-dependency SDKs across all major programming ecosystems. Secrets are injected directly into process memory without creating or touching plaintext .env files on disk.
Node.js & TypeScript
Python & AI Agents
Go Microservices
PHP & Laravel
🛠️ Command Reference
| Command | Description |
|---|---|
interenv lock [file] |
Encrypt .env into hardware enclave and securely shred the plaintext |
interenv run <cmd...> |
Execute command with secrets injected into child process memory |
interenv edit |
Open decrypted secrets in $EDITOR and re-seal automatically on save |
interenv show |
Display sealed environment keys (masked by default, --reveal to unmask) |
interenv status |
Inspect repository security status and hardware enclave binding |
interenv doctor |
Audit filesystem CoW behavior, swap configuration, and enclave status |
interenv hook install |
Install Git pre-commit hook to prevent secret leaks |
interenv shred <file> |
Best-effort overwrite and remove a sensitive file |
🔒 Security Model & Guarantees
- Authenticated Encryption (AEAD): All environment payloads are encrypted with XChaCha20-Poly1305 using 192-bit (24-byte) random nonces sourced from the OS RNG (
rand::rngs::OsRng). - Key Provider Sealing: Master encryption keys use the strongest available provider without mislabeling fallbacks:
- macOS: Apple Secure Enclave when available; otherwise the OS Keychain provider.
- Windows: Microsoft Platform Crypto Provider/TPM when available; otherwise DPAPI/OS credential storage.
- Linux: TPM 2.0 when the
tpmfeature is enabled and hardware is available; otherwise the OS Secret Service credential store. No software-derived XOR KEK is used.
- Headless & CI/CD Support: For automated CI runners and Docker containers, pass
--passphraseor setINTERENV_PASSPHRASEto derive master keys via Argon2id (memory-hard password hashing with OWASP defaults: 19 MiB RAM, 2 iterations, parallelism = 1). - Memory Zeroization: Plaintext secret buffers implement
zeroize::ZeroizeOnDrop, ensuring keys and values are actively wiped from RAM upon release.
Security Guarantees Table
| Vector | Guarantee | Implementation |
|---|---|---|
| Disk Inspection | No plaintext lock payload | Master key protected by hardware/OS provider; source .env is removed after best-effort overwrite. |
| Peer Process Sniffing | Process Sandbox | Linux Seccomp BPF filter; macOS Sandbox profile; Windows Job Object. |
| Cross-Host Replay | Machine Bound | Hardware KEK prevents decrypting lockfile on foreign machines without passphrase. |
| Accidental Commits | Pre-Commit Abort | Automatic hook intercepts git commit staging .env or plain credentials. |
| Memory Dump on Drop | Buffer Scrubber | Custom Drop scrubs key and value buffers in-place via raw slice zeroization. |
⚖️ Comparison with Other Tools
| Feature | interenv |
dotenv-vault |
sops |
git-crypt |
|---|---|---|---|---|
| Hardware-backed / OS credential KEK | 🟢 Native where supported | ❌ Cloud Only | 🟡 Optional (KMS/PGP) | ❌ GPG Symmetric |
| Plaintext on Disk | 🟢 Encrypted lock payload; no persistent plaintext .env required |
❌ Decrypts on disk | ❌ Decrypts to disk | ❌ In-place filter |
| Process Sandboxing | 🟢 Seccomp / Sandbox | ❌ None | ❌ None | ❌ None |
| Cloud Dependency | 🟢 100% Offline | 🔴 Cloud Vault | 🟡 Cloud KMS / PGP | 🟢 100% Offline |
| Plaintext Cleanup | 🟢 Best-effort overwrite + unlink | ❌ None | ❌ None | ❌ None |
| Language Runtime | ⚡ Rust CLI | 🟡 Node.js CLI | 🟡 Go CLI | ⚡ C++ Filter |
🌐 Platform Support Matrix
| Operating System | Enclave Key Storage | Process Sandbox Isolation | Disk Shredding Hook |
|---|---|---|---|
| Windows 10 / 11 / Server | TPM 2.0 (NCrypt) + DPAPI | Windows Job Object (KILL_ON_CLOSE) |
SetEndOfFile + FlushFileBuffers + ADS Wipe |
| macOS (Apple Silicon / Intel) | Apple Secure Enclave + Keychain | Apple Sandbox Profile (sandbox_init) |
F_FULLFSYNC Cache Flush |
| Linux (Ubuntu / Fedora / Arch) | TPM 2.0 (tss-esapi) / Secret Service |
Seccomp BPF (PR_SET_NO_NEW_PRIVS) |
FALLOC_FL_ZERO_RANGE + TRIM |
[!NOTE] Linux TPM 2.0 Hardware Binding: Real Linux TPM 2.0 hardware binding requires building with
--features tpm(cargo build --release --features tpm). Without this flag or on machines lacking/dev/tpmrm0, Linux uses the OS Secret Service credential store when available and never uses a software-derived XOR KEK.[!WARNING] Windows Job Object Isolation: Windows builds enforce Job Object isolation with
JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE. Creation, configuration, and child assignment failures are fail-closed; there is no runtime bypass.
⚠️ Limitations
- Root / Ring-0 Access: An attacker with root or kernel privileges on the local machine can dump arbitrary memory.
- Solid State Drive Wear-Leveling: CoW filesystems (APFS, Btrfs, ZFS) and SSD flash translation layers (FTL) may wear-level blocks. InterEnv applies filesystem decommit calls (
fallocate,BLKDISCARD,SetFileValidData) and warns ininterenv doctor. - Hardware Failure / Reinstall: If a machine-bound TPM is reset, locally sealed lockfiles cannot be retrieved without an Argon2id passphrase backup (
interenv lock --passphrase).
🛡️ Audits & Reviews
InterEnv has undergone multi-phase adversarial security hardening:
- v0.1.0 Security Audit: Argon2id OWASP parameters, XChaCha20-Poly1305 cipher migration,
Secretsfull memory zeroization, crash-safe temporary file guards. - v0.2.0 Platform Hardening: Windows Job Object containment, Linux Seccomp BPF privilege filter, macOS Sandbox profile, Windows NCrypt TPM 2.0 KEK, safe atomic path canonicalization (
safe_canonicalize). - v1.0.0 Release Candidate Hardening: macOS Secure Enclave hardware binding, Linux TPM 2.0 KEK feature flag, supply chain verification (
cargo-audit,cargo-deny), fuzz testing targets, criterion benchmarks, and lockfile schema v3.0 migration.
📦 Reproducible Builds
InterEnv release binaries are bit-for-bit reproducible:
All release binaries are built with lto = "fat", codegen-units = 1, panic = "abort", and path prefix remapping to ensure verifiable artifact provenance.
❓ Frequently Asked Questions
What is InterEnv?
InterEnv is a high-performance, local-first secret management engine written in Rust that permanently eradicates plaintext .env files from developer disks. It binds encrypted project secrets directly to host hardware security enclaves (Apple Secure Enclave on macOS, TPM 2.0 / DPAPI on Windows, and Linux Secret Service) and decrypts them exclusively into volatile process memory.
Why was InterEnv engineered for Interlayer Blockchain?
Interlayer Blockchain is a sovereign multi-VM Layer 1 architecture designed for high-throughput consensus, decentralized validators, and autonomous on-chain AI agents. In high-stakes blockchain infrastructure, relying on external cloud secret managers introduces latency bottlenecks and vendor lock-in, while storing validator keys, relayer secrets, or deployer credentials in plaintext .env files risks catastrophic financial compromise. InterEnv was engineered to provide host silicon-level hardware isolation (Apple Secure Enclave and TPM 2.0) so that validator operators, node engineers, and autonomous Web3 agents can execute commands without requiring a plaintext .env file to remain in the project.
How is InterEnv different from dotenv, dotenvx, and dotenv-vault?
dotenv: Leaves all API keys, database passwords, and private tokens unencrypted on physical storage, exposing them to rogue npm/pip supply-chain packages and accidental git commits.dotenvx: Encrypts.envfiles but writes the decryption master key to an unencrypted.env.keysfile on the exact same disk.dotenv-vault/Doppler/Infisical: Require proprietary cloud vaults, persistent internet connections, and paid monthly subscriptions.InterEnv: 100% offline, local-first, free & open source (MIT), uses hardware-backed providers where available, and performs best-effort plaintext cleanup without claiming guaranteed physical erasure.
How do AI Coding Agents (Cursor, Claude Desktop, Windsurf) safely use InterEnv?
AI coding agents execute your application via interenv run <command> or import the language SDK (interenv.config() in Node.js, interenv.load_env() in Python, interenv.Load() in Go, InterEnv::load() in PHP). Secrets are injected directly into the child process memory space via standard environment variables without ever creating a plaintext .env file on disk. This prevents LLMs, indexing bots, or repository search tools from reading or exfiltrating raw credentials.
How does InterEnv run in headless Docker containers and CI/CD pipelines?
When sealing a project for multi-developer or continuous integration workflows, run interenv lock --passphrase. In your automated CI runner (GitHub Actions, GitLab CI, Docker, Kubernetes), provide the secret passphrase through the INTERENV_PASSPHRASE environment variable along with INTERENV_CI=1. InterEnv derives the master key via OWASP-compliant memory-hard Argon2id (19 MiB RAM, 2 iterations, 1 parallelism) without interactive terminal prompts.
🌐 Built for Interlayer Blockchain & Open For All
InterEnv was engineered to safeguard sensitive validator credentials, blockchain deployment keys, and autonomous AI agents for the Interlayer Blockchain sovereign multi-VM ecosystem, and is open source for developers worldwide:
- ⚡
intermcp— Ultra-fast, safe Model Context Protocol (MCP) engine and multiplexing hub in pure Rust. - 🛡️
interenv— Hardware-enclave protected secrets for terminal, AI agents & git. - ⛓️ Interlayer Blockchain
📄 License
MIT License. Copyright (c) 2026 Bharath B R (Interlayer). Contributions welcome! Please open an issue or PR.
