From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 3236 invoked by alias); 13 Mar 2016 15:48:49 -0000 Mailing-List: contact zsh-users-help@zsh.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Id: Zsh Users List List-Post: List-Help: X-Seq: 21378 Received: (qmail 12414 invoked from network); 13 Mar 2016 15:48:48 -0000 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on f.primenet.com.au X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM, T_DKIM_INVALID autolearn=ham autolearn_force=no version=3.4.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to :content-transfer-encoding; bh=FIIrMFdYMZkf0OcMnBHCdue92HjNZNOAEmqMvVJXx7o=; b=Amx6fkn5tog8dVmrbZJ0khRyV/18El8qqa7NyLEqazaqE31Y9n//xmWfa4WZ/oLoQp Rp+ZKB/ddeW/Tc2IKhU/vihwOTkMzGxWU8bffudr6AdsRFdsgNTAg9hXD0CPTjMJtLOx A5A/LPTD+o36/Ch5spJ/ZhUQdxDJ5ZbwM8mHPze5mTIADm5aa73aCyiCUzhXjyEhTlrZ XkHGSozcKfbWzSMcl9PwyTm9NttsJ6fK+KoS6gZ9iJ8SOcechsATjiTTL7KbyMBaA7T6 G2CUYI6brmAGlTu6AfTxHrMLNHpu7lveEb/pwh/LlgceL58f5duGBBirPjQgmThSCET9 ibkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-transfer-encoding; bh=FIIrMFdYMZkf0OcMnBHCdue92HjNZNOAEmqMvVJXx7o=; b=lSD02QWthdkoYLeXntQCQg6uKIXzUb2E13ifBpGGkOgixSngIXw+5oiy7lv7OHxKDs XeFYwm9QwL+oxetO940+TAk2xjXb1Nv4gaR/iXeaM8ogCO6i/zu7NhAAwO0mBI+83TS+ +2cQ19PV9WXHvC2iMEPP+x+UK+9u6PuqwquJm2WLjxsIDQZTDTim2r+YjEMUVTxtDj26 VKvs9b4OGLJSfr7K0otkz7SJEn1u0gwWcNWJ0BB1OKBZ/i3/nL9DVKZFKfLjU0Ywh7mh Zl6AY1LPsoeqzKEbj3bcXPhB3n3l6VxrV+d7HrORcl3Yct3qR/mYCCxE6ktb/BJ4QzPz Sy3w== X-Gm-Message-State: AD7BkJJITCzHg1DtwwxTFZ9fEeD2vfLnAZs9C1XyO3JZjHyVqDeD0EgAjW+Ru7hfQPFIwmPuMkRjS7e6Sf+x9Q== MIME-Version: 1.0 X-Received: by 10.107.167.80 with SMTP id q77mr22726999ioe.110.1457884123272; Sun, 13 Mar 2016 08:48:43 -0700 (PDT) Date: Sun, 13 Mar 2016 18:48:43 +0300 Message-ID: Subject: git-secret - zsh-plugin to store your private data inside a git repository From: =?UTF-8?B?0J3QuNC60LjRgtCwINCh0L7QsdC+0LvQtdCy?= To: zsh-users@zsh.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable There=E2=80=99s a known problem in server configuration and deploying, when you have to store your private data such as: database passwords, application secret-keys, OAuth secret keys and so on, outside of the git repository. Even if this repository is private, it is a security risk to just publish them into the world wide web. What are the drawbacks of storing them separately? These files are not version controlled. Filenames change, locations change, passwords change from time to time, some new information appears, other is removed. And you can not tell for sure which version of the configuration file was used with each commit. When building the automated deployment system there will be one extra step: download and place these secret-configuration files where they need to be. So you have to maintain an extra secure server, where everything is stored. How does git-secret solve these problems? git-secret encrypts files and stores them inside the git repository, so you will have all the changes for every commit. git-secret doesn=E2=80=99t require any other deploy operations rather than = git secret reveal, so it will automatically decrypt all the required files. What is git-secret? git-secret is a bash tool to store your private data inside a git repo. How=E2=80=99s that? Basically, it just encrypts, using gpg, the track= ed files with the public keys of all the users that you trust. So everyone of them can decrypt these files using only their personal secret key. Why deal with all this private-public keys stuff? Well, to make it easier for everyone to manage access rights. There are no passwords that change. When someone is out - just delete his public key, reencrypt the files, and he won=E2=80=99t be able to decrypt secrets anymore. Find out more: https://sobolevn.github.io/git-secret/