Git-secret – store private data in a Git repo

This project scares me because it helps foster a bad practice -- keeping secrets in a repo. You really shouldn&#x27;t be keeping secrets in the repo.<p>You should be using a secrets service that is designed for such a purpose, like Hashicorp&#x27;s Vault[0], so that you never have to keep a secret in the code.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;hashicorp&#x2F;vault" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;hashicorp&#x2F;vault</a>

Nice work!<p>I&#x27;ve been using <a href="https:&#x2F;&#x2F;github.com&#x2F;AGWA&#x2F;git-crypt" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;AGWA&#x2F;git-crypt</a> until now, always good to have more alternatives.<p>Can you tell us what is different about your approach with this project?

I&#x27;ve been using ansible-vault to solve this problem in our infrastructure repository. A symmetric vault key is encrypted using gpg, and Ansible&#x27;s vault_password_file is set to to an executable shell script containing `gpg --batch --use-agent --descrypt vault_key.gpg`.<p>Very specific to Ansible, but works fine. It&#x27;s a shame only files containing variables (we&#x27;re using group_vars) can be encrypted, and not arbitrary files or templates.

Another tool worth looking into is git-gpg, which allows you to store encrypted git repositories on third-party &#x2F; potentially insecure servers, but unlike this tool it stores all changes to source files as compressible textual deltas (a key reason for using git in the first place). The repository is encrypted remotely but the local version has no encrypted blobs inside.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;rustyio&#x2F;git-gpg" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rustyio&#x2F;git-gpg</a><p>Other benefits include architectural simplicity and low footprint: it consists of a single Python script that you add to your executable path.

Similar project, that I personally use quite often: <a href="https:&#x2F;&#x2F;github.com&#x2F;StackExchange&#x2F;blackbox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;StackExchange&#x2F;blackbox</a>

This should really work with ssh public&#x2F;private keys¹. Public keys are probably already on the box the git server runs on, and users already have them generated to access git - no need to generate separate gpg keys.<p>If you have a github account the script could also get the pubkey directly from the github api...<p>¹<a href="http:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;576506&#x2F;how-to-use-ssh-rsa-public-key-to-encrypt-a-text" rel="nofollow">http:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;576506&#x2F;how-to-use-ssh-rsa-pub...</a>

I used to put .gpg files in my repos that stored sensitive information like database passwords and such.<p>I don&#x27;t do that anymore. The main problem as I saw it was that you basically liberate your security to an environment you can&#x27;t monitor or send rejections to (if someone downloads your gpg file). Compare this to an ssh server which affords both those abilities.

&gt; When someone is out - just delete his public key, reencrypt the files, and he won’t be able to decrypt secrets anymore.<p>But they still can encrypt old versions stored in git, no? Do you change all secrets when somebody leaves the team&#x2F;company? I guess that&#x27;d be best practice, but I have no idea how often that&#x27;s done out there.

A word of warning to those considering using this. While I completely understand why people might want to encrypt&#x2F;decrypt files within their public Git repositories, doing so doesn&#x27;t come for free.<p>As Junio C Hamano explains more eloquently and in greater depth here[1], one thing to bear in mind with this (and similar) tools is that they store the managed files as binary blobs, regardless of their original format, meaning that a change to the source file of even a single bit will result in an entirely different <i>uncompressed</i> blob being stored, rather than a compressible textual delta.<p>[1] <a href="http:&#x2F;&#x2F;article.gmane.org&#x2F;gmane.comp.version-control.git&#x2F;113221" rel="nofollow">http:&#x2F;&#x2F;article.gmane.org&#x2F;gmane.comp.version-control.git&#x2F;1132...</a>

At Zemanta, we developed py-secretcrypt[0] and go-secretcrypt[1] for keeping secrets encrypted with Amazon KMS (Key Management Service) in our repos. They are then decrypted on the fly by the application.<p>Access control is managed through AWS KMS key policies, with EC2 instances running the applications having permissions to decrypt the secrets.<p>Blog post about this will follow soon.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;Zemanta&#x2F;py-secretcrypt" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Zemanta&#x2F;py-secretcrypt</a><p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;Zemanta&#x2F;go-secretcrypt" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Zemanta&#x2F;go-secretcrypt</a>

See also: <a href="https:&#x2F;&#x2F;github.com&#x2F;StackExchange&#x2F;blackbox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;StackExchange&#x2F;blackbox</a> &quot;blackbox by StackExchange&quot;

Hmm... adding access controls to Git? I&#x27;m not sure how I feel about this. I like how Git is low level and stays away from all of that stuff leaving it up to wrappers like GitLab, GitHub, Gerrit, etc.<p>When you remove someone from the list of users does it have to go and re-write history? Isn&#x27;t that a big no-no in Git?

If you need to do this, I would recommend looking at Transcrypt: <a href="https:&#x2F;&#x2F;github.com&#x2F;elasticdog&#x2F;transcrypt" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;elasticdog&#x2F;transcrypt</a>

If all you have is a hammer, everything looks like a nail.

I am using keybase.io to store soft secrets like the coveralls.io token. Let me share my simple use case: <a href="http:&#x2F;&#x2F;g14n.info&#x2F;2014&#x2F;07&#x2F;my-keybase-experience&#x2F;" rel="nofollow">http:&#x2F;&#x2F;g14n.info&#x2F;2014&#x2F;07&#x2F;my-keybase-experience&#x2F;</a>

Some cross platform tool that we&#x27;ve developed for our company which has some nice features<p><a href="https:&#x2F;&#x2F;github.com&#x2F;franela&#x2F;vault" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;franela&#x2F;vault</a>

I&#x27;ve been using <a href="https:&#x2F;&#x2F;github.com&#x2F;ahoward&#x2F;sekrets" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ahoward&#x2F;sekrets</a> in private repos for years. Great tool.<p>I definitely agree this should be used with heavy caution and only in private repos.

Recently, I&#x27;ve wrote simple tool for storing secrets like passwords in public Git repos using AES cypher: <a href="https:&#x2F;&#x2F;github.com&#x2F;seletskiy&#x2F;carcosa&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;seletskiy&#x2F;carcosa&#x2F;</a>