My threat model is that, the adversary has physical access to the machine and root access. I don't care about any data on the system other than a couple python scripts that contain sensitive information.
I will be protecting these text files against read access by encrypting with gpg with the key stored inside a yubikey. The second layer of protection will be using Fernet inside python's cryptography module. It's built on AES in CBC mode with a 128-bit.
With these measures, will my text-file/scripts be protected against read access? If not, any recommendations?
EDIT: During every session, I will clear my memory cache, unmount the volume containing the script files, and the turn off the machine.
The attacker will only have physical access to my machine in the turned-off state. For example if I accidentally lose it. There is the potential of remote attacks when I'm interfacing the machine in a public network (public-wifi) for example. But I will have proper firewall setup to prevent any kind of remote attacks.
So in my mind, the only reasonable attack vector for the adversary is to have physical access. Correct me if I'm wrong here please.
The second assumption I'm making is that the attacker will have some 0 day exploit that allows them to gain root access to the machine (starting from the turned-off state).
The decrypted js or python scripts will be used when I'm interfacing with public wifi. So presumably the keys used to decrypt will be stored both in my yubikey and in the memory(temporarily). Decrypt keys will not be stored on disk. So to prevent memory dumps, I will clear cache before turning off the machine after every session.