Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Specifically, how are things like keystores handled, or other items needed to build or run an app?

In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web Store.

I have several ideas, but I really want to know how others are actually handling this type of situation.

share|improve this question

migrated from stackoverflow.com Feb 29 '12 at 21:06

This question came from our site for professional and enthusiast programmers.

1  
I can't think of a specific example, but my suspicion is that this is handled by not distributing the secret parts. The job of deploying to the app store belongs to one person or group, not to the Internet at large. People can contribute to the code, but somebody remains as the sole point of contact, and keeps the needed secrets. –  Ernest Friedman-Hill Feb 24 '12 at 14:17

2 Answers 2

A similar question was asked in http://stackoverflow.com/questions/1635963/open-source-and-how-it-works-for-secure-projects

As this is really an integration/deployment issue, you might consider using a lookup function for sensitive data.

By using keywords to identify your data and keeping separate tables in development, staging and production, you can still run tests against this part of the code, while protecting the sensitive detail.

Examples: Java getProperty() or Puppet extlookup()

Update: See also this Encrypted Yaml Hiera extension. Hiera is the (now standard) successor for extlookup() in Puppet.

You will still require a place where these keys can be decrypted without an operator present, so the Puppet master will need to know those keys. Because eyaml uses asymmetric encryption there is no need for sharing keys. You do need proper controls in place for access to the Puppet master, but that's nothing new.

share|improve this answer
    
Ensure that you physically separate those tables... –  Henk Langeveld Feb 28 '12 at 15:47

Please remember the following important rule:

  • Don't hardcode cryptographic keys or secrets in the code!

This rule is not specific to open source. It is a good rule of thumb for all source code.

Maybe you are wondering: where should you store secret keys, passwords, etc.? The answer: Store them in a separate configuration file, not in the source code. Don't include them in the source code repository / version control system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.