#
# Usage: {{ foo | vault }}
#

def vault(encrypted, env):
  method = """
from keyczar import keyczar
import os.path
import sys
keydir = '.vault'
if not os.path.isdir(keydir):
  keydir = os.path.expanduser('~/.decrypted_openconext_keystore_{env}')
crypter = keyczar.Crypter.Read(keydir)
sys.stdout.write(crypter.Decrypt("%s"))
  """.format(env=env) % encrypted
  from subprocess import check_output
  return check_output(["python", "-c", method])

class FilterModule(object):

  def filters(self):
    return {
      'vault': vault
    }

@@ -356,20 +356,22 @@
 ypted%0A  
-from
+import
  subproc
@@ -377,76 +377,229 @@
 cess
- import check_output%0A  return check_output(%5B%22python%22, %22-c%22, method%5D)
+%0A  child = subprocess.Popen(%5B'python', '-c', method%5D, stdout=subprocess.PIPE)%0A  output = child.communicate()%5B0%5D%0A  if child.returncode != 0:%0A    raise ValueError(%22Exit code non-zero: %25d%22 %25 child.returncode)%0A  return output
 %0A%0Acl

Use Popen which is available on RHEL6, but do check exit code