chezmoi -v secret pass show misc/example.com
stdout examplepassword

chezmoi apply
cmp $HOME/.netrc golden/.netrc

-- bin/pass --
#!/bin/sh

case "$*" in
"grep ^$")
    ;;
"show misc/example.com")
    echo "examplepassword"
    ;;
*)
    echo "pass: invalid command: $*"
    exit 1
esac
-- bin/pass.cmd --
@echo off
REM Windows drops the leading ^ from the ^$ argument that chezmoi passes to "pass grep" so match on $ only.
REM For background information, read http://daviddeley.com/autohotkey/parameters/parameters.htm#WIN.
IF "%*" == "grep $" (
    exit /b 0
) ELSE IF "%*" == "show misc/example.com" (
    echo | set /p=examplepassword
    exit /b 0
) ELSE (
    echo pass: invalid command: %*
    exit /b 1
)
-- home/user/.local/share/chezmoi/private_dot_netrc.tmpl --
machine example.com
login examplelogin
password {{ pass "misc/example.com" }}
-- golden/.netrc --
machine example.com
login examplelogin
password examplepassword
