Storing secrets in git

So I gave into the temptation to store "secret" data into a git repository. Of course, to keep things safer, I chose to use an encryption tool. So I tested:

git-secret

So, I tested git-secret. It seems to work but was in my opinion cumbersome.

Furthermore, the version I tested, which was the one from the void has a bug whereby adding files for encryption would update the .gitignore file but would forget to put an EOL at the end of the file.

The main issue I have is that you need to explicitly issue the command:

git-secret hide

To hide files. Alternatively you can include this in your pre-commit hook, but that brings its own issues along.

Overall it was not the best experience.

git-crypt

At the end I opted for git-crypt, which is more seamless and requires less user interaction for it to work.

git-crypt mini howto

I installed git-crypt using my distro package installation command.

Initialize an existing git repo and export encryption key:

cd repo
git-crypt init
git-crypt export /path/to/key

The exported key now needs to be shared between all the repo users. For example can be saved into a secret variable in the CI/CD pipeline system.

Select the files that need to be protected by creating a .gitattributes file:

secretfile filter=git-crypt diff=git-crypt
*.key filter=git-crypt diff=git-crypt
secretdir/** filter=git-crypt diff=git-crypt

Like a .gitignore file, it can match wildcards and should be checked into the repository. Make sure you don't accidentally encrypt the .gitattributes file itself (or other git files like .gitignore or .gitmodules).

NOTE Make sure your .gitattributes rules are in place before you add sensitive files, or those files won't be encrypted!

After cloning a repository with encrypted files, unlock with the secret key:

git-crypt unlock /path/to/key

That's all you need to do - after git-crypt is set up (either with git-crypt init or git-crypt unlock), you can use git normally - encryption and decryption happen transparently.

Verifying that git-crypt is working

  • The simplest way:
  • git crypt status
  • The native way:
  • git check-attr -a -- <path>
  • Checking object hashes (these shouldn't match):
  • git hash-object <path>
  • cat <path> | git hash-object --stdin