StackExchange/blackbox

Safely store secrets in Git/Mercurial/Subversion - could be interesting for storing some shared creds within a git repo (still private though). They recommend just storing a single key to something like a key vault service so you aren't encrypting all the .env variables for example but are instead encrypting the key that would give access to all the env variables.

Summary

StackExchange/blackbox is a set of shell scripts that wrap GnuPG to encrypt selected files inside a Git, Mercurial, Subversion, or Perforce repository so secrets can sit in version control "encrypted at rest." The repository is marked archived and the README opens with "THIS PROJECT IS ABANDONED. DO NOT USE," directing readers to alternative tools.

What it is useful for

The tool targets a narrow use case: a small team that wants to commit one or a handful of secret-bearing files (SSL private keys, a hiera YAML, an Ansible vault password file) alongside the rest of their code without trusting the VCS host. It was originally written for Puppet and the README shows it driving blackbox_postdeploy on Puppet masters so that a no-passphrase GPG subkey decrypts files at deploy time.

The README is explicit about scope: it is a "simple wrapper around gpg" and is not designed to scale to large numbers of files. The documented best practice is to keep real secrets in a dedicated service such as Conjur, AWS KMS, Azure Key Vault, or GCP KMS, and use BlackBox only to encrypt the small credential file that accesses that service. Documented limitations include sensitivity to GPG version mismatches (newer GPG can produce keys older GPG cannot read), a need to keep blackbox-admins.txt and blackbox-files.txt with LF line endings, and the fact that revoking a user's key does not retroactively invalidate files they already decrypted.

How engineers can use it

Because the project is abandoned, new adoption is not recommended; the README's "Alternatives" section points to projects such as git-crypt. For reference, the documented workflow is:

1. Generate a GPG key pair (e.g. gpg --gen-key) and start the agent with eval $(gpg-agent --daemon).
2. cd into a Git, Mercurial, Subversion, or Perforce repo and run blackbox_initialize.
3. Run blackbox_register_new_file <path> to encrypt a specific file, then blackbox_edit <file> (or the blackbox_edit_start / blackbox_edit_end pair) to make changes.
4. Add or remove teammates with blackbox_addadmin <gpg-key> and blackbox_removeadmin <gpg-key>, then re-encrypt existing files with blackbox_update_all_files.

Installation is documented in the README via Homebrew (brew install blackbox), MacPorts (sudo port install vcs_blackbox), make copy-install, or nix-shell -p blackbox; see the README for the full list and per-platform caveats such as Cygwin, MinGW, and WSL2 setup.