Databases
StackOverflow2013
Postsdbo
POMake setup for encrypted individual files in a C++ project
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POMake setup for encrypted individual files in a C++ project
    primarykey
    data
    text
    <p>We have a C/C++ project where we wish to encrypt (with GPG) every single source file, and have make (specifically, GNU Make) seamlessly work (as it does now with unencrypted source).</p> <p>If we encrypt only the C or C++ files, this seems fairly easy to accomplish with a rule like this:</p> <pre><code>%.o : %.cc.gpg %.hh $(GPG) --decrypt $&lt; | $(CXX) $(CFLAGS) -x c++ -c -o $@ - </code></pre> <p>However, if we start encrypting header files, it gets a lot trickier, as the C file may #include any number of headers. So it seems to me that first I need to generate a dependency list, then decrypt every one that is encrypted, and compile. Ideally, the decryption would be done in-memory, rather than leaving decrypted files laying around while compilation takes place.</p> <p>Some notes, in anticipation of the comments I'll get:</p> <ul> <li>The users' workflow will involve GPG plugins for their editor, but the rest should be as seamless as possible (i.e. traditional commandline-based Linux svn + make + gcc workflow)</li> <li>We are using subversion for source control. We know and are OK with source being stored as binary blobs (as well as the implications of this, e.g. breaking svn diff)</li> <li>The subversion repo lives on an encrypted filesystem (LUKS), and access is only through https</li> <li>This is a management requirement</li> <li>In my web research of this problem, I've seen a lot of people argue against encrypting every source file. As I said, it's a management requirement. But one thing that is not addressed by these arguments is keeping the source safe from sysadmins. Yes, at some point you have to trust people, but our source is kind of like the recipe to Coke: if it is uncontrolled, it could literally ruin the company. So why take chances?</li> </ul>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USMatt
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POMake setup for encrypted individual files in a C++ project
      1. USRudi
      1. VTFavorite
    1. COIs getting new management an option? :-)
      singulars
      1. POMake setup for encrypted individual files in a C++ project
      1. USBo Persson
    2. COHow are you planning to get the decryption keys into the build process? If it is via a passphrase file, why not configure your developer workstations with encrypted filesystems?
      singulars
      1. POMake setup for encrypted individual files in a C++ project
      1. USKarl Barrus
    3. COI think the "everything must be done in memory" point can be disregarded if working with a Linux system. If some solution would require writing to a file, then just store that file in a memory mounted partition (e.g. /tmp). Then it *shouldn't* ever end up on a disk.
      singulars
      1. POMake setup for encrypted individual files in a C++ project
      1. USDarhuuk
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload