Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Specifically, how are things like keystores handled, or other items needed to build or run an app?

In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web Store.

I have several ideas, but I really want to know how others are actually handling this type of situation.

share|improve this question
1  
I can't think of a specific example, but my suspicion is that this is handled by not distributing the secret parts. The job of deploying to the app store belongs to one person or group, not to the Internet at large. People can contribute to the code, but somebody remains as the sole point of contact, and keeps the needed secrets. – Ernest Friedman-Hill Feb 24 '12 at 14:17

migrated from stackoverflow.com Feb 29 '12 at 21:06

2 Answers

up vote 3 down vote

A similar question was asked in Open Source and how it works for secure projects?

As this is really an integration/deployment issue, you might consider using a lookup function for sensitive data.

By using keywords to identify your data and keeping separate tables in development, staging and production, you can still run tests against this part of the code, while protecting the sensitive detail.

Examples: Java getProperty() or Puppet extlookup()

share|improve this answer
Ensure that you physically separate those tables... – Henk Langeveld Feb 28 '12 at 15:47
up vote 3 down vote

Please remember the following important rule:

  • Don't hardcode cryptographic keys or secrets in the code!

This rule is not specific to open source. It is a good rule of thumb for all source code.

Maybe you are wondering: where should you store secret keys, passwords, etc.? The answer: Store them in a separate configuration file, not in the source code. Don't include them in the source code repository / version control system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.