4

I understand that it is bad practice to add passwords and secret tokens to source control, with obvious implications arising if you are working on an open-source or related project. Rather, you should store them as environment variables.

However, is it legitimate to add an encrypted private PEM key file to source control for an open source project, and only keep the decryption password as an environment variable? Or should I store the entire contents of the PEM as the environment variable?

Improve this question
6

There is nothing insecure with what you are suggesting.

However, why would you want to store a private key in your source control? If I fork your project, why will I be using your private key? It is obvious that I would want to generate and use my own private key, so make that part of the setup process.

Improve this answer
5
  • Unless I wanted to spoof someone else?
    – user13695
    Mar 4 '14 at 7:27
  • 2
    Travis CI does this so you can encrypt access tokens for private repos and such.
    – Darkhogg
    Nov 18 '15 at 15:28
  • Also useful if you want to be able to restore the configuration of your laptop with a single command: github.com/cristiklein/puppet-developer-laptop
    – user1202136
    Jan 14 '16 at 22:57
  • 1
    I am wondering if this does not add risk. If a flaw in the encryption of the private PEM key is discovered, you can bet that an army of bots will decrypt all PEMs on GitHub. Is this scenario worth worrying about?
    – user1202136
    Jan 14 '16 at 22:59
  • // , What if you need to revoke it? Now git bisect doesn't work any more.
    – Nathan Basanese
    May 23 '20 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.