When calling travis encrypt-file for multiple files, from the same folder, it causes the cli to overwrite the secure variable that is used for the file.

This causes problems as mentioned in both #239 and #583 --

The trouble seems to be caused here -- https://github.com/travis-ci/travis.rb/blob/master/lib/travis/cli/encrypt_file.rb#L73-L82

As this code creates or updates the secure environment variable for encryption based from the working folder Dir.pwd that travis-cli is being executed from, instead of the full path of the file that is being encrypted.

@env_prefix ||= "encrypted_#{Digest.hexencode(Digest::SHA1.digest(Dir.pwd)[0..5])}"

As a result, calling the encrypt-file from the same working directory results in overwritten key and iv values and causes Travis the issue seen --

bad decrypt
140043714328224:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:539:
The command "openssl aes-256-cbc -K $encrypted_xxxxxxxxxxxx_key -iv $encrypted_xxxxxxxxxxxx_iv -in file.enc -out file -d" failed and exited with 1 during .

There is a mention of the env variables being overwritten in the documentation; however, there is no mention of the conditions which cause the values to be overwritten.

Rather than using the working directory for this behavior, which is both undocumented and unintuitive, it would make the most sense if the input_path was used for generating env for the key and iv values. It seems doubtful that this behavior would be done intentionally, as it would be extremely easy to circumvent the behavior by simply running the cli from a different working folder, like so:

base-project$ travis encrypt-file file1 --add
base-project$ mkdir -p tmp1
base-project$ cd tmp1
base-project/tmp1$ travis encrypt-file ../file2 --add
base-project/tmp1$ cd ..
base-project$ rmdir tmp1
base-project$ mkdir -p tmp2
base-project$ cd tmp2
base-project/tmp2$ travis encrypt-file ../file3 --add
base-project/tmp2$ cd ..
base-project$ rmdir tmp2

...and so on...

It is a simple fix to -- https://github.com/travis-ci/travis.rb/blob/master/lib/travis/cli/encrypt_file.rb -- to correct the behavior to use the input_path. See pull request #628.