RGBCube/agenix
1
Fork 0
mirror of https://github.com/RGBCube/agenix synced 2025-07-29 09:47:44 +00:00
Code Issues Activity Actions

doc: add new doc website

Browse source 
* use mmdoc
* add github pages action to auto publish
* do not edit README for now, will follow up with a commit directs
people to the doc site
This commit is contained in:
Ryan Mulligan 2023-02-26 14:17:37 -08:00
parent 4828951d9d
commit 657789137c
22 changed files with 602 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
doc/threat-model-warnings.md Normal file
View file

@ -0,0 +1,14 @@
# Threat model/Warnings {#threat-model-warnings}
This project has not been audited by a security professional.
People unfamiliar with `age` might be surprised that secrets are not
authenticated. This means that every attacker that has write access to
the secret files can modify secrets because public keys are exposed.
This seems like not a problem on the first glance because changing the
configuration itself could expose secrets easily. However, reviewing
configuration changes is easier than reviewing random secrets (for
example, 4096-bit rsa keys). This would be solved by having a message
authentication code (MAC) like other implementations like GPG or
[sops](https://github.com/Mic92/sops-nix) have, however this was left
out for simplicity in `age`.