git 当您的项目中有密钥时，如何推送到 GitHub？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5132152/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
when you have secret key in your project, how can pushing to GitHub be possible?
提问by nonopolarity
I am trying to push a brand new, empty Rail 3.0.4 project to GitHub, but just realize that the cookie session store has a secret key:
我正在尝试将一个全新的空 Rail 3.0.4 项目推送到 GitHub，但只是意识到 cookie 会话存储有一个密钥：
In config/initializers/secret_token.rb
在 config/initializers/secret_token.rb
NewRuby192Rails304Proj::Application.config.secret_token = '22e8...'
So how can we avoid it being push to GitHub? We can ignore this file (using .gitignore), but without this file, a Rails app won't run at all (and is not a complete Rails app). Or in general, other files or frameworks may have files containing secret keys too. In such case, how should it be handled when pushing to GitHub?
那么我们怎样才能避免它被推送到 GitHub 上呢？我们可以忽略这个文件（使用.gitignore），但是没有这个文件，Rails 应用程序根本无法运行（并且不是一个完整的 Rails 应用程序）。或者一般来说，其他文件或框架也可能有包含密钥的文件。在这种情况下，push到GitHub时应该如何处理？
采纳答案by VonC
Add in your repo:
在你的仓库中添加：
- a template of it (
secret_token.rb.template), - a script able to generate a proper config file
secret_token.rbbased on local data found on the server (like an encrypted file with the secret value ready to be decoded and put in thesecret_token.rbfile)
- 它的模板 (
secret_token.rb.template), - 一个能够
secret_token.rb根据在服务器上找到的本地数据生成正确配置文件的脚本（例如一个加密文件，其秘密值准备好被解码并放入secret_token.rb文件中）
From there, add a git attribute custom driver:
从那里，添加一个git 属性自定义驱动程序：
The script referenced above will be your 'smudge' script which will, on checkout of the working tree, generate automatically the right file.
上面引用的脚本将是您的“ smudge”脚本，它将在检出工作树时自动生成正确的文件。
回答by Zachary K
Put the secret key in some sort of external config file. Thats what we do.
将密钥放在某种外部配置文件中。这就是我们所做的。
回答by sobolevn
There are several external tools, which do exactly that. Basically, these tools encrypt the file with your private data and store it in the VCS, but ignore the original unencrypted file.
有几个外部工具可以做到这一点。基本上，这些工具使用您的私人数据加密文件并将其存储在 VCS 中，但忽略原始未加密的文件。
One of the most known and trusted is blackbox. It uses gpgto encrypt your files and works with both gitand hg. By the way, it is created by SO team. Have a look at the alternativessection, it has at least five other tools.
最著名和最受信任的一种是blackbox. 它用于gpg加密您的文件并与git和 一起使用hg。顺便说一下，它是由 SO 团队创建的。看看替代部分，它至少有五个其他工具。
I can also recommend you a tool called git-secret, it also uses gpg. But it works only with git. The main advantage is that the workflow is much easier compared to other tools.
我还可以向您推荐一个名为 的工具git-secret，它也使用gpg. 但它仅适用于git. 主要优点是与其他工具相比，工作流程要容易得多。
回答by Allen Ding
You could risk trusting Github's security/privacy if it is a private repository .. or:
- Pull the data from a configuration file on the server. For example, if you use Capistrano for deployment, you can add a step that copies the configuration file from somewhere on the server.
- Use an environment variable.
如果 Github 是私有存储库，您可能会冒着信任它的安全性/隐私的风险……或者：
- 从服务器上的配置文件中提取数据。例如，如果您使用 Capistrano 进行部署，您可以添加一个从服务器上某处复制配置文件的步骤。
- 使用环境变量。
