I'm working on a project where we use git-secret for hiding information. This is backed by gpg, and adding people to git-secret (http://git-secret.io/) is done by adding a public key to a pubring.gpg. After starting with a clean computer, I had to generate a new key and add it to git secret. Usually someone else does the adding, but I decided to try myself, and to my surprise I was able to both add and remove users to this pubring, without my key being part of it.

Is there a way to limit the access to modifying a pubring, so that only users with their public key inside of it can add or remove keys from the pubring?

  • Maybe you should add a brief description of how git-secret works. – Elias Dec 14 '17 at 11:50
  • Added a link to its documentation, it's not really important how it works, besides that it uses gpg to encrypt/decrypt files.. In any case I would need to secure pubring.gpg, since it's possible to add/remove keys directly against this, without even using git-secret. – Tobb Dec 14 '17 at 11:54
  • From a cursory review: git-secret appears to be intended for use with a repo where the only users with commit/push access are also trusted to know the secrets. That is, it lets you put your secrets on, say, a public github repo without the rest of the world seeing them, but does not provide a way to hide them from other committers to your repo. If you need a way to keep them secret from other devs, either deny them commit access and review every pull request to make sure they aren't adding themselves to git-secret, or manually review the list of "recipients" before each git secret hide. – CBHacking Jul 12 '18 at 23:24

The way I understand adding keys to your keyring doesn't allow them to decrypt anything. git secret will only add decryption information for users whom you have added with

git secret tell persons@email.id

(Which might internally be implemented as a keyring, though). There is still a problem, howewer. From the docs:

Note, that it is possible to add yourself to the system without decrypting existing files. It will be possible to decrypt them after reencrypting them with the new keyring. So, if you don’t want unexpected keys added, make sure to configure some server-side security policy with the pre-receive hook.

Trying to answer the question from the title: The gpg keyring is stored in a file and you can probably just use normal access control restrictions on that file.

| improve this answer | |
  • The quote you have added is exactly what the problem consists of. One only needs to be able to add the key to the keyring, then wait for someone else to encrypt the files again, this time with the new key in place. Then, access will be granted, possibly without anyone even noticing. – Tobb Dec 14 '17 at 12:27
  • Hence, my question is whether it is possible to avoid this, by only allowing people already in the keyring to modify it. – Tobb Dec 14 '17 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.