A bash tool to store private data inside a git repository using PGP encryption and public-key cryptography.
git-secret is a bash tool that enables secure storage of private data within a git repository. It encrypts files using permitted users' public keys, allowing trusted individuals to decrypt them with their private keys. This approach simplifies access management and handles public-private key infrastructure automatically.
Development teams and DevOps engineers who need to securely share secrets like API keys, passwords, or configuration files within a git repository without exposing them in plaintext.
Developers choose git-secret because it integrates seamlessly with git workflows, uses PGP public-key encryption for secure sharing, and simplifies permission changes without requiring secrets to be re-encrypted when a user is removed.
:busts_in_silhouette: A bash-tool to store your private data inside a git repository.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
git-secret encrypts and tracks files directly within git repositories, allowing secrets to be version-controlled alongside code without exposing plaintext. The README emphasizes it 'works seamlessly with git repositories.'
Adding or removing users is simple via keyring management, and secrets don't need to be re-encrypted when revoking access—just remove the key and re-encrypt. The README highlights this as a core feature.
Available through package managers like Homebrew, apt, and yum, making installation straightforward across different operating systems. The README lists these as supported installation methods.
Uses public-key encryption with PGP, reducing custom key management overhead and benefiting from established security practices. The README states it 'encrypts files with permitted users' public keys.'
Requires specific versions of bash, gawk, git, gpg, and sha256sum, which can complicate setup in minimal or controlled environments. The README explicitly lists these as requirements.
The -m option for encrypting only modified files relies on sha256sum checksums, and the README warns of potential collisions, advising padding files or avoiding -m for greater security—a notable caveat.
Each user must generate and manage their own PGP keys, which can be a barrier for teams unfamiliar with GPG or in organizations with centralized key policies.
Tightly integrated with git, so it's not suitable for non-git version control systems or scenarios where secrets need real-time access outside of git workflows.