lukasjarosch / lukasjarosch/skipper
Add asymmetric encryption secret driver
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 12
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Problem
For the AES secret driver I still need to have somehow securely share the key between all people that want to reveal secrets. The other drivers require using a cloud provider.
Solution
I would like to be able to configure some public keys in the skipper config and then encrypt secrets using all those public keys.
Each one of the corresponding private keys can decrypt the secrets.
This way every participant only has to add their public key to the repository and no secret material needs to be exchanged.
Possible solutions could e.g. integrate gpg, age or sops.
Additional context
After changing the public keys, you should be able to reencrypt all the keys. Maybe even support to automatically rotate the secret if a public key was removed. Could be implemented in a separate PR/Issue.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue refers to the AES secret driver, other drivers, and skipper configuration, but names no files or tests. Start by inspecting those existing drivers and the configuration path, then compare the proposed gpg, age, and sops integrations. Done means secrets can be encrypted for configured public keys and decrypted by each corresponding private key.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100