nodes/machinepainting-ComfyUI_DropSendNode
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs: simplify key-storage instructions to match what scripts actually do

Browse Source 
The previous version told users to wrap every decrypt run with a
'security find-generic-password' command — but the macOS and Linux
decrypt scripts already do that lookup internally. So the wrapper
was redundant: just storing the key in Keychain (macOS) or via
secret-tool (Linux) is enough; the script finds it on its own.

  • macOS: GUI walkthrough for Keychain Access (New Password Item,
    Name=ComfyUI_Encryption_Key, Account=ComfyUI), plus the
    'security add-generic-password' CLI equivalent. No wrapper.
  • Linux: 'secret-tool store' one-liner. No wrapper.
  • Windows: User Environment Variable via sysdm.cpl, since the
    Windows decrypt script does NOT auto-lookup Credential Manager
    and only reads the env var. (Removed the PowerShell
    Get-StoredCredential complexity that was solving a problem the
    Windows script doesn't have.)

The key insight, now stated explicitly: each decrypt script does its
own platform-appropriate lookup. Users don't need to bridge the
keystore-to-env-var gap themselves.

No code changes.
This commit is contained in:
MachinePainting
2026-05-09 07:55:54 -07:00
parent 01ae9f6e09
commit 701fab766a
1 changed files with 28 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+28 -69
View File
@@ -401,96 +401,55 @@ pip install cryptography
### Store your encryption key locally
The decrypt script reads `COMFYUI_ENCRYPTION_KEY` from your shell environment. Pick one approach per platform.
The decrypt scripts look up the key in the right place for each platform automatically. Just store it once and they'll find it.
#### macOS
#### macOS — Keychain (recommended)
**Approach A — Keychain (recommended).** The key is stored encrypted at rest, locked behind your login, and never written to a dotfile in plaintext. Requires a tiny one-line wrapper to inject the value into the env at decrypt time.
The macOS decrypt script (`decrypt_folder_mac.sh`) and the cross-platform `decrypt_folder.py` both call `security find-generic-password -s "ComfyUI_Encryption_Key" -a "ComfyUI"` internally. So if you put the key in Keychain with those exact attributes, decryption finds it — no env vars, no wrapper scripts.
1. Save the key into Keychain (one-time setup, in Terminal):
**GUI (most users):**
```bash
security add-generic-password -a "ComfyUI" -s "ComfyUI_Encryption_Key" -w "your_key_here"
```
1. Open **Keychain Access** (search in Spotlight).
2. **File → New Password Item…**
3. Fill in:
- **Keychain Item Name:** `ComfyUI_Encryption_Key`
- **Account Name:** `ComfyUI`
- **Password:** paste your encryption key
4. Click **Add**.
2. Whenever you decrypt, run the script through this one-liner (no rc-file edits needed):
To update the key later, double-click the entry, check **Show password**, paste the new value, **Save Changes**.
```bash
COMFYUI_ENCRYPTION_KEY="$(security find-generic-password -a ComfyUI -s ComfyUI_Encryption_Key -w)" ./decrypt_folder_mac.sh
```
*(Replace `./decrypt_folder_mac.sh` with whichever decrypt script you're running.)*
3. To remove the key later: `security delete-generic-password -a "ComfyUI" -s "ComfyUI_Encryption_Key"`
> You can also browse the entry in **Keychain Access.app → login → Passwords → ComfyUI_Encryption_Key**. Double-click and check **Show password** to read it manually.
**Approach B — Shell rc file (simple, plaintext on disk).** Easier but the key sits in `~/.zshrc` (or `~/.bash_profile`) in plaintext at mode `0644`. Fine for a single-user laptop you trust; not appropriate on a shared Mac.
**CLI equivalent** (one-liner, same result):
```bash
echo 'export COMFYUI_ENCRYPTION_KEY="your_key_here"' >> ~/.zshrc
source ~/.zshrc
security add-generic-password -a "ComfyUI" -s "ComfyUI_Encryption_Key" -w "your_key_here"
```
#### Windows
To remove: `security delete-generic-password -a "ComfyUI" -s "ComfyUI_Encryption_Key"`
**Approach A — Credential Manager via PowerShell (recommended).** Stores the key encrypted under your Windows account, never written to a dotfile in plaintext.
#### Windows — User Environment Variable
1. **One-time setup** — install the `CredentialManager` PowerShell module (it's not built in):
```powershell
Install-Module -Name CredentialManager -Scope CurrentUser
```
2. **Save the key** (one-time, in PowerShell):
```powershell
New-StoredCredential -Target "ComfyUI_Encryption_Key" `
-UserName "ComfyUI" `
-Password "your_key_here" `
-Persist LocalMachine
```
3. **Whenever you decrypt**, fetch from Credential Manager and inject:
```powershell
$env:COMFYUI_ENCRYPTION_KEY = (Get-StoredCredential -Target ComfyUI_Encryption_Key).GetNetworkCredential().Password
python decrypt_folder.py
```
4. **Remove later:**
```powershell
Remove-StoredCredential -Target "ComfyUI_Encryption_Key"
```
**Approach B — User Environment Variable (simple).** Easier and built into Windows. The key is stored in the user-scoped registry (not visible to other Windows users) but is plaintext when read by any process running as you.
The Windows decrypt script (`decrypt_folder_win.py`) reads `COMFYUI_ENCRYPTION_KEY` from the environment. There is no Credential Manager auto-lookup, so the simplest path is a User-scoped environment variable (stored in your user's registry, not visible to other Windows users).
1. Press `Win + R`, run `sysdm.cpl`, open **Advanced**, click **Environment Variables**.
2. Under **User variables**, click **New**:
- **Name:** `COMFYUI_ENCRYPTION_KEY`
- **Value:** your key
3. Click OK through both dialogs. **Restart any open terminals** to pick up the new env var.
- **Variable name:** `COMFYUI_ENCRYPTION_KEY`
- **Variable value:** your encryption key
3. Click OK through both dialogs. **Restart any open terminals** so they pick up the new value.
#### Linux
To update the key, double-click the entry instead of clicking New.
**Approach A — `gnome-keyring` / `secret-tool` (recommended on GNOME desktops).**
#### Linux — gnome-keyring via `secret-tool` (recommended on GNOME / Cinnamon / similar)
1. Save the key (one-time setup):
The Linux decrypt script (`decrypt_folder_linux.sh`) and the cross-platform `decrypt_folder.py` both call `secret-tool lookup service ComfyUI username ComfyUI` internally.
```bash
echo -n "your_key_here" | secret-tool store --label="ComfyUI Encryption Key" service ComfyUI key encryption
```
```bash
echo -n "your_key_here" | secret-tool store --label="ComfyUI Encryption Key" service ComfyUI username ComfyUI
```
2. Inject at decrypt time:
To remove: `secret-tool clear service ComfyUI username ComfyUI`
```bash
COMFYUI_ENCRYPTION_KEY="$(secret-tool lookup service ComfyUI key encryption)" ./decrypt_folder_linux.sh
```
3. Remove later: `secret-tool clear service ComfyUI key encryption`
**Approach B — Shell rc file (simple, plaintext on disk).**
**Headless or non-GNOME systems** (no `secret-tool` installed): set as an environment variable instead.
```bash
echo 'export COMFYUI_ENCRYPTION_KEY="your_key_here"' >> ~/.bashrc