{"push_id":794764687,"size":3,"distinct_size":1,"ref":"refs/heads/master","head":"283f4b24e67156185690a47e0994f99c70765e37","before":"1ac585cb7fa1f1175255fa31d841b8f1a92e0b75","commits":[{"sha":"e139ff25913f1c18f88f91ac27f6484e35e5a71b","author":{"email":"61d7d687722e0a82be801f0c519e99d4d7a41bc8@pebble.com","name":"Peter Wagner"},"message":"PBL-21842: Provide encryption of environment variables\n\nA common git-deploy pattern involves .env files that propogate through\netcd to environment variables for the target service.\nIf this pattern is used for passwords, it leaves a plaintext copy:\n- in the git-deploy container\n- in any clones of git-deploy repo/history\n- in etcd (the scariest!)\n\nThis changeset introduces a new git-shell command: secret.\nThe new command generates a ciphertext that can be committed to git\nin place of the original plaintext string.\nThis prevents plaintext storage in all of the above cases.\n\nPresently all keys stay in the git-deploy container: export\nand propagation are left as an exercise for downstream.\nEventually these could go be stored in etcd, but we need to\nenable+trust etcd authentication before that becomes sane.","distinct":false,"url":"https://api.github.com/repos/pebble/git-deploy/commits/e139ff25913f1c18f88f91ac27f6484e35e5a71b"},{"sha":"984c9253832e550780bb3c92ec29a50de5b7d780","author":{"email":"61d7d687722e0a82be801f0c519e99d4d7a41bc8@pebble.com","name":"Peter Wagner"},"message":"PBL-21842: decouple secrets from example layout\n\nEncryption keys are no longer automatically generated to\nfollow the repo/app hierarchy: named keys provide max flexibility.\nEncryption keys must be created _before_ they are used, requiring\nusers aim steadily before shooting themselves in the foot.\n\nRepo-level signing keys are refactored to a global signing key, which\nis generated when the first encryption key is requested.\nThis retains the security features of signing, without shoehorning every\nprotected value into a repo.\nUninterested downstream hooks can --skip-verify to ignore this signature.","distinct":false,"url":"https://api.github.com/repos/pebble/git-deploy/commits/984c9253832e550780bb3c92ec29a50de5b7d780"},{"sha":"283f4b24e67156185690a47e0994f99c70765e37","author":{"email":"3161cdc7bf197e4c3a35b9cbe358c79910f27e90@lrvick.net","name":"Lance R. Vick"},"message":"Merge pull request #9 from pebble/gpg-secrets\n\nPBL-21842: Provide encryption of environment variables","distinct":true,"url":"https://api.github.com/repos/pebble/git-deploy/commits/283f4b24e67156185690a47e0994f99c70765e37"}]}