Git-secret – store private data in a Git repo
coderwall.com
Git-secret – store private data in a Git repo
1–10 of 74 posts
Re: Git-secret – store private data in a Git repo
#2Nice work!
I've been using https://github.com/AGWA/git-crypt until now, always good to have more alternatives.
Can you tell us what is different about your approach with this project?
Re: Git-secret – store private data in a Git repo
#3[deleted]
Re: Git-secret – store private data in a Git repo
#4Hmm... adding access controls to Git? I'm not sure how I feel about this.
I like how Git is low level and stays away from all of that stuff leaving it up to wrappers like GitLab, GitHub, Gerrit, etc.
When you remove someone from the list of users does it have to go and re-write history? Isn't that a big no-no in Git?
Re: Git-secret – store private data in a Git repo
#5Similar project, that I personally use quite often: https://github.com/StackExchange/blackbox
Re: Git-secret – store private data in a Git repo
#6Hmm... adding access controls to Git? I'm not sure how I feel about this. I like how Git is low level and stays away from all of that stuff leaving it up to wrappers like GitLab, GitHub, Gerrit, etc. When you remove someone from the list of users does it have to go and re-write history? Isn't that a big no-no in Git?
I have nothing to do with this project, but I think the answer to your question is no - you don't have to re-write history. If the removed party had access to previous revisions signed with his key, they're already "compromised" as far as security is concerned. Whether or not you rewrite history, he already has it.
The re-encryption they're referring to is presumably just to protect future revisions (since you would ideally rotate all keys they had access to, git-secret or not, and publish new ones right away).
Re: Git-secret – store private data in a Git repo
#7A word of warning to those considering using this. While I completely understand why people might want to encrypt/decrypt files within their public Git repositories, doing so doesn't come for free.
As Junio C Hamano explains more eloquently and in greater depth here[1], one thing to bear in mind with this (and similar) tools is that they store the managed files as binary blobs, regardless of their original format, meaning that a change to the source file of even a single bit will result in an entirely different uncompressed blob being stored, rather than a compressible textual delta.
[1] http://article.gmane.org/gmane.comp.version-control.git/1132...
Re: Git-secret – store private data in a Git repo
#8I've been using ansible-vault to solve this problem in our infrastructure repository. A symmetric vault key is encrypted using gpg, and Ansible's vault_password_file is set to to an executable shell script containing `gpg --batch --use-agent --descrypt vault_key.gpg`.
Very specific to Ansible, but works fine. It's a shame only files containing variables (we're using group_vars) can be encrypted, and not arbitrary files or templates.
Re: Git-secret – store private data in a Git repo
#9A word of warning to those considering using this. While I completely understand why people might want to encrypt/decrypt files within their public Git repositories, doing so doesn't come for free. As Junio C Hamano explains more eloquently and in greater depth here[1], one thing to bear in mind with this (and similar) tools is that they store the managed files as binary blobs, regardless of their original format, me…
While technically true, the type of data this extension is meant for (small configuration snippets containing sensitive credentials) are both small and rarely-changing. A couple extra bytes in the index won't be a very big deal.
Re: Git-secret – store private data in a Git repo
#10I've been using ansible-vault to solve this problem in our infrastructure repository. A symmetric vault key is encrypted using gpg, and Ansible's vault_password_file is set to to an executable shell script containing `gpg --batch --use-agent --descrypt vault_key.gpg`. Very specific to Ansible, but works fine. It's a shame only files containing variables (we're using group_vars) can be encrypted, and not arbitrary fil…
To be a bit pedantic, all .yml files can be encrypted with ansible-vault, so also playbooks and roles.
There are two things currently that bother me about ansible-vault. The first is that the 'edit' command write a completely new file even if I didn't change anything. And the second is that the diffs in git become useless. I'd love to have a special diff driver for ansible-vault encrypted files that decrypts before diffing when the secret is available.