11–20 of 34 posts
Have you tried BlackBox?
Projects like https://github.com/StackExchange/blackbox have the benefit of using GPG group encryption. Each person has their own secret key but any one key can decrypt the file. This makes key rotation easier.
Neat! I like that it maintains everything in the same file. No need to mess with .gitignore Have you tried BlackBox? Projects like https://github.com/StackExchange/blackbox have the benefit of using GPG group encryption. Each person has their own secret key but any one key can decrypt the file. This makes key rotation easier.
I am surprised Mozilla developers chose to write this project in Go instead of Rust, but do not get me wrong, I like Go, it is my primary programming language at work, and I always try to advocate for the right tool for the job. I still find it curious, though. I guess it was easier to translate Python to Go than to Rust.
AWS_SDK_LOAD_CONFIG=1
Generally found that setting that env var with anything mildly complicated (in go!) in terms of AWS roles helps.
Other libraries/clis/etc (in other languages) tend to transparently traverse the credentials chain for you.
Is it just for easier debugging, so you can see the structure of the encrypted file?
What is the purpose of encrypting just the values and not the keys? If you need to run the file through sops to decrypt the values before using it, why not just encrypt the entire file? Is it just for easier debugging, so you can see the structure of the encrypted file?