9

Specifically, how are things like keystores handled, or other items needed to build or run an app?

In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web Store.

I have several ideas, but I really want to know how others are actually handling this type of situation.

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
  • 1
    I can't think of a specific example, but my suspicion is that this is handled by not distributing the secret parts. The job of deploying to the app store belongs to one person or group, not to the Internet at large. People can contribute to the code, but somebody remains as the sole point of contact, and keeps the needed secrets. –  Feb 24 '12 at 14:17
  • https://github.com/openstreetmap/chef/issues/61 - here is a an example of real open-source project explaining that all used private repos are for "data bags containing the various passwords, private keys,etc". – reducing activity Apr 16 '16 at 17:28

2 Answers2

8

Please remember the following important rule:

  • Don't hardcode cryptographic keys or secrets in the code!

This rule is not specific to open source. It is a good rule of thumb for all source code.

Maybe you are wondering: where should you store secret keys, passwords, etc.? The answer: Store them in a separate configuration file, not in the source code. Don't include them in the source code repository / version control system.

D.W.
  • 98,420
  • 30
  • 267
  • 572
5

A similar question was asked in https://stackoverflow.com/questions/1635963/open-source-and-how-it-works-for-secure-projects

As this is really an integration/deployment issue, you might consider using a lookup function for sensitive data.

By using keywords to identify your data and keeping separate tables in development, staging and production, you can still run tests against this part of the code, while protecting the sensitive detail.

Examples: Java getProperty() or Puppet extlookup()

Update: See also this Encrypted Yaml Hiera extension. Hiera is the (now standard) successor for extlookup() in Puppet.

You will still require a place where these keys can be decrypted without an operator present, so the Puppet master will need to know those keys. Because eyaml uses asymmetric encryption there is no need for sharing keys. You do need proper controls in place for access to the Puppet master, but that's nothing new.

Community
  • 1
Henk Langeveld
  • 196
  • 4