sobolevn/git-secret

👥 A bash-tool to store your private data inside a git repository.

Summary

git-secret is a bash tool that stores private files inside a regular git repository by encrypting them with the public GPG keys of permitted users. It works as a git addon, so adding, removing, and revoking access follows git-style commands and keeps secrets versioned alongside code.

What it is useful for

It is useful when a team needs to share credentials, API keys, or configuration files containing secrets with specific collaborators without putting plaintext in a repository. Each trusted user is added to the repo's keyring; their public key is used to encrypt the tracked secret files, and they decrypt locally with their GPG secret key.

When someone's access needs to end, the README documents running git secret removeperson [email protected] followed by re-encrypting the files, which prevents that user from decrypting new revisions going forward. This is helpful for onboarding and offboarding workflows where rotating every secret is not always practical, though the README notes that if a removed user may have copied keys or data while they had access, the underlying secrets should also be changed.

How engineers can use it

The README documents installing with brew install git-secret on macOS, and also notes support for apt, yum, and building from source via make, with the installation section in the project docs covering details. Before use, the system needs bash 3.2.57 or newer, gawk 4.0.2+, git 1.8.3.1+, gpg from 1.4 through 2.x, and sha256sum 8.21+ (with shasum used instead on macOS and FreeBSD).

A typical workflow described in the README is to initialize git-secret inside a repo, add permitted users by their GPG email, register files with git secret add, then hide (encrypt) them so only the encrypted .secret versions are committed. The git-secret hide -m form only re-encrypts files whose sha256sum has changed.

A documented limitation: the README warns about sha256 collision risk when using -m, recommending padding small files (such as those holding a single password) with random data, or avoiding -m altogether for those cases.