Merged
Merged
Conversation
|
|
||
| ### Alternative implementations | ||
|
|
||
| Unknown |
Merged
stefanv marked this pull request as ready for review
November 28, 2023 20:38
|
|
||
| - **Publishing packages**: PyPi provides a [trusted publisher](https://docs.pypi.org/trusted-publishers/using-a-publisher/) mechanism for avoiding passwords | ||
|
|
||
| ### Other security considerations |
|
|
||
| ## Implementation | ||
|
|
||
| ### Principles |
|
|
||
| It should be noted that, in many cases, secrets & passwords can be avoided. | ||
| Most online services (GitHub, PyPi, etc.), have permissioning systems through which developers can be given the required access. | ||
| Access to servers can be given through SSH keys, which each developer has to safeguard. |
| The secrets are stored, encrypted, in a public Git repository. | ||
| The vault uses [gopass](https://github.com/gopasspw/gopass), a more user friendly implementation of [pass](https://www.passwordstore.org/), to manage access via GPG keys. | ||
| Each secret is encrypted using the public keys of all developers that should have access. | ||
| If a developer's access is removed, the vault is re-encrypted so that that developer cannot read future copies of the repository (but secrets should be considered compromised and, thus, rotated). |
|
|
||
| - **Publishing packages**: PyPi provides a [trusted publisher](https://docs.pypi.org/trusted-publishers/using-a-publisher/) mechanism for avoiding passwords | ||
|
|
||
| ### Other security considerations |
Mention secret rotation on re-encryption of vault
WIP: SPEC 6: Keys to the Castle
Add SPEC 6: Keys to the Castle
