Keeping secrets in Git

If you are sick of juggling secrets and want to keep them encrypted in Git, here is a pre-commit hook:

#!/usr/bin/env bash
set -euo pipefail
[ -f ~/.secrets-key ] && [ -d secrets ] || exit 0
pack() { tar -c --format=ustar --sort=name --owner=0 --group=0 --numeric-owner --mtime=2000-01-01Z secrets | gzip -n9; }
salt=$(pack | sha256sum | cut -c-16)
{ printf Salted__; xxd -r -p <<<"$salt"; pack | openssl enc -aes-256-cbc -md sha256 -pbkdf2 -iter 200000 -S "$salt" -pass file:$HOME/.secrets-key; } >secrets.tar.enc
git add secrets.tar.enc

Put the master password in ~/.secrets-key. The contents of the secrets folder in your working copy will be committed as secrets.tar.enc.

To decrypt:

openssl enc -d -aes-256-cbc -md sha256 -pbkdf2 -iter 200000 -pass file:$HOME/.secrets-key -in secrets.tar.enc | tar -xzf -

Ordinary encryption changes the output file every time and clutters up your Git history. The trick here is convergent encryption: we use the SHA256 hash of the contents as the salt for password-based encryption. If the folder's contents stay the same, so does the encrypted file.

I fucking love cryptography.