1

The problem: I have a project with a config file for development and production. I want the production config file to live in VCS to make it easy to checkout a tag and build a particular version of the project with the correct config at any time. Obviously, I don't want the production config to be plaintext in VCS to avoid leaking secrets.

My theoretical solution: The production config file is always encrypted on disk, so inside of VCS it is always an opaque blob. Certain people have the decryption key on their machines to modify the config as needed and to deploy it.

Ideally, this file is always encrypted after a VCS checkout and opening the file transparently decrypts it then re-encrypts it after saving it.

I feel like a proven crypto solution exists for this problem but I'm not sure what it is. Thoughts?

Improve this question

1 Answer 1

Reset to default
1

Stack Exchange has actually written a program called "BlackBox" that they use for git and mercurial repos. The idea is, there are scripts to edit files, that automatically decrypts and starts an editor so you can make changes, then encrypts it after you've saved the file. BlackBox uses PGP encryption, and will track everyone's public keys. You could easily write a program like this for one person, but Blackbox tracks everyone on a project. Give it a look, it may suit your needs. And if it doesn't, they list good alternatives in their readme.

https://github.com/StackExchange/blackbox

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .