rot

Age is nice but seems to have stagnated--last release is from 2022, and it's not using a more modern PBKDF like argon. If you're looking for something designed for secret storage/sharing, checkout rot: https://github.com/candiddev/rot

I think you’re misunderstanding how Go imports work. In Go projects, the versioning happens in the go.mod file [0]. [0]: https://github.com/candiddev/rot/blob/9168285d9ccfe783dc8234...

The first thing I noticed is that the cryptographic packages are referenced by an unversioned GitHub URL. E.g.: https://github.com/candiddev/rot/blob/9168285d9ccfe783dc8234... This type of approach would not pass a code review of something as security-critical as a secrets management tool. E.g.: this generally prevents "reproducible builds", and allows you to "sneak in" changes even if downstream users aren't modifying anything themselves. It's a recipe for a supply-chain attack.

Finally open sourced an internal tool we've been using for managing secrets. It's similar to SOPS, but more opinionated, easier to configure/use correctly, and produces nicer git diffs. It also supports one-way encryption, so you don't have to know the private key to add secrets.