jswidler / lockgit Goto Github PK

when using lockgit open, if a directory does not exist, there is an error. it should create the directory instead.

CPU 100% used by lockgit

I am very hesitant to use a tool like this that doesn't explain what is secured and how in the README.md.

How are the keys protected? What encryption is used? etc.

Could you add something to the documentation that talks a bit about the encryption method you use and its security, as well as providing insight on how you'd recommend using this securely with deployments to production environments?

Thanks

Pattern does not appear when the file is not mounted.

             FILE            |   UPDATED   | PATTERN |                ID
+----------------------------+-------------+---------+----------------------------------+
  keys/prod/combined.pem     | unavailable |         | J3uUiGGyIQuaK372dmmLkcuAvjZH0XFC

vs

             FILE            | UPDATED | PATTERN |                ID
+----------------------------+---------+---------+----------------------------------+
  keys/prod/combined.pem     | false   | keys/** | J3uUiGGyIQuaK372dmmLkcuAvjZH0XFC

The program panics if you give it a bad key, or probably if there is a file in the vault that is corrupted / encrypted with a different key. It should provides better error messages, and protect users from accidentally using the wrong key by verifying the key on set-key through some new mechanism.