Is there any reason I shouldn’t store my keystore in version control?

Anyone with read access to your Git repo will get the private key. This is considered a security issue and for that reason it is not recommended. If your GIT repo is completely private meaning no one but you has access to it (NOT A private repo on i.e. GitHub, but rather git repo on local disk or in the infrastructure you control in 100%) then putting your private key there is as safe as safe your local infrastructure is.

Assume that the keystore itself and the private keys inside both have strong passwords on them

Note that password is your last way of defense in case of your (“public”) private key. If it will be compromised in any way (guessed, stolen, cracked) then it’s over.

Additionally, I am more than certain that not all (if any) of devs needs access to release keys. If you need them to have it, hand it using other channels than repo (i.e. GPG encrypted mail etc). But I’d first rethink your security policy.

Leave a Comment