Add safe way to pass shared secret to `openssl mac` and/or `openssl dgst -hmac` about openssl HOT 3 OPEN

Its possible, yes, but why not just use command substitution here:

openssl mac -digest "$digest" -macopt key:$(cat key.txt) "$mac_name"

That's the same. The shell still passes the secret in clear in one of openssl's command line arguments (again, which is public information on most systems) to openssl. Only in that case it got the value from the contents of key.txt¹.

There are some dirty non-portable hacks one can use to inject code into openssl that updates argv[] just after the execve(), but users shouldn't have to go there.

^{¹ with all trailing newline characters removed and, since you forgot the quotes around $(...) subject to split+glob; and since you can't pass NUL in arguments to commands, you'd rather use that with keyex than key.}

from openssl.

Its possible, yes, but why not just use command substitution here:

openssl mac -digest "$digest" -macopt key:$(cat key.txt) "$mac_name"

from openssl.

Because the result of that command substitution will still show up publicly in the command line.

from openssl.