See also: https://github.com/StackExchange/blackbox "blackbox by StackExchange"
Git-secret – store private data in a Git repo
11–20 of 74 posts
Re: Git-secret – store private data in a Git repo
#12> When someone is out - just delete his public key, reencrypt the files, and he won’t be able to decrypt secrets anymore.
But they still can encrypt old versions stored in git, no? Do you change all secrets when somebody leaves the team/company? I guess that'd be best practice, but I have no idea how often that's done out there.
Re: Git-secret – store private data in a Git repo
#13A word of warning to those considering using this. While I completely understand why people might want to encrypt/decrypt files within their public Git repositories, doing so doesn't come for free. As Junio C Hamano explains more eloquently and in greater depth here[1], one thing to bear in mind with this (and similar) tools is that they store the managed files as binary blobs, regardless of their original format, me…
I can imagine a great number of use cases involve encrypting an access key or password making this not a big issue, right?
Re: Git-secret – store private data in a Git repo
#14Recently, I've wrote simple tool for storing secrets like passwords in public Git repos using AES cypher: https://github.com/seletskiy/carcosa/
Re: Git-secret – store private data in a Git repo
#15Another tool worth looking into is git-gpg, which allows you to store encrypted git repositories on third-party / potentially insecure servers, but unlike this tool it stores all changes to source files as compressible textual deltas (a key reason for using git in the first place). The repository is encrypted remotely but the local version has no encrypted blobs inside.
https://github.com/rustyio/git-gpg
Other benefits include architectural simplicity and low footprint: it consists of a single Python script that you add to your executable path.
Re: Git-secret – store private data in a Git repo
#16This should really work with ssh public/private keys¹. Public keys are probably already on the box the git server runs on, and users already have them generated to access git - no need to generate separate gpg keys.
If you have a github account the script could also get the pubkey directly from the github api...
¹http://superuser.com/questions/576506/how-to-use-ssh-rsa-pub...
Re: Git-secret – store private data in a Git repo
#17I've been using ansible-vault to solve this problem in our infrastructure repository. A symmetric vault key is encrypted using gpg, and Ansible's vault_password_file is set to to an executable shell script containing `gpg --batch --use-agent --descrypt vault_key.gpg`. Very specific to Ansible, but works fine. It's a shame only files containing variables (we're using group_vars) can be encrypted, and not arbitrary fil…
To be a bit pedantic, all .yml files can be encrypted with ansible-vault, so also playbooks and roles. There are two things currently that bother me about ansible-vault. The first is that the 'edit' command write a completely new file even if I didn't change anything. And the second is that the diffs in git become useless. I'd love to have a special diff driver for ansible-vault encrypted files that decrypts before d…
If you use show instead of edit it doesn't re-encrypt the file.
Agreed on the useless diffs however, it makes reviewing pull requests or changes much harder.
Re: Git-secret – store private data in a Git repo
#18This project scares me because it helps foster a bad practice -- keeping secrets in a repo. You really shouldn't be keeping secrets in the repo.
You should be using a secrets service that is designed for such a purpose, like Hashicorp's Vault[0], so that you never have to keep a secret in the code.
Re: Git-secret – store private data in a Git repo
#19This project scares me because it helps foster a bad practice -- keeping secrets in a repo. You really shouldn't be keeping secrets in the repo. You should be using a secrets service that is designed for such a purpose, like Hashicorp's Vault[0], so that you never have to keep a secret in the code. [0] https://github.com/hashicorp/vault
Perhaps it's an alternative practice/behavior rather than a "bad" practice?
Re: Git-secret – store private data in a Git repo
#20If you need to do this, I would recommend looking at Transcrypt: https://github.com/elasticdog/transcrypt