Fidelius is a tool for managing GPG encrypted secrets in a git repository.
The gpg
command is used to perform all encryption and decryption. Fidelius
is a simple wrapper that makes working with multiple encrypted files easy, and
follows some simple rules that define which files are decrypted and where the
plaintext is written.
- Paths like
file.encrypted.ext.asc
are decrypted tofile.decrypted.ext
, - Paths like
directory.encrypted/file.ext.asc
are decrypted todirectory/file.ext
.
These rules ensure decrypted files have the correct extension for their
contents, are easy to exclude from version control with .gitignore
rule
(fidelius
will check they are excluded!) and that decrypted files are
placed where you want in your directory structure.
The last of these is partially useful when working with tools like Helm which may crash if they encounter encrypted files in their directory structure, so it can be useful to keep the encrypted files in a separate directory.
You'll need Python 3.7, Pip and GPG installed.
You can then install fidelius
via pip
:
pip install fidelius
This will install fidelius
executable. Run fidelius --help
for full usage
information.
fidelius new -r '[email protected]' 'example.encrypted.txt.asc'
fidelius edit -r '[email protected]' 'example.encrypted.txt.asc'
fidelius view 'example.encrypted.txt.asc'
fidelius decrypt 'example.encrypted.txt.asc' && cat 'example.decrypted.txt'
You can also use Fidelius from another Python program. Only decryption is currently provided via this API, intended for use in CI tasks:
from fidelius.incantations import Fidelius
from fidelius.secrets import SecretKeeper
secret_keeper: SecretKeeper = Fidelius().cast()
secret_keeper.decrypt()
All files with .encrypted
anywhere in the name and a .asc
or .gpg
suffix
are decrypted into the same directory. The .asc
or .gpg
suffix is removed
and .encrypted
is replaced with .decrypted
.
one.encrypted.json.asc -> one.decrypted.json
All files with a .asc
or .gpg
suffix in a directory named %.encrypted
are
decrypted into %
, keeping the same relative path. Filenames have the .asc
or
.gpg
suffix removed, and .encrypted
is replaced with .decrypted
. Encrypted
files without .encrypted
in their name have a .decrypted
suffix added before
the last suffix in the filename.
directory.encrypted/two.json.gpg -> directory/two.decrypted.json
directory.encrypted/three.encrypted.json.gpg -> directory/three.decrypted.json
Add a .gitattributes
file to your repository:
*.asc diff=fidelius
Add a custom git diff driver to ~/.gitconfig
in your home directory:
[diff "fidelius"]
textconv = "gpg --batch --quiet --decrypt"
The git diff
command will now compare the plaintext of your secrets.
Fidelius is built to fit my own use cases perfectly, but there are several other far more mature projects for managing encrypted secrets in git repositories.
Licensed under the MIT License.
Written by Sam Clements.