What is Sesam?

sesam is a tool for managing secrets in git.

Software projects often required to store and load several secrets such as database passwords, certificates, API keys or other credentials. Those secrets should be stored encrypted and only be accessible to the users that actually need them.

sesam allows leveled access with multiple users to those encrypted secrets and gives you a simple interface to manage both users and secrets.

You might think of a password manager now, which is not too far off. A password manager is usually targeted at managing individual secrets, while a secret manager is focused on sharing selected secrets with other users in a team and machines. If you already know what a secret manager is then you might be interested in Why we built another tool.

Features

• Signed, hash-chained and encrypted audit log.
• Support for SSH keys, age keys and age plugin identities.
• Forge recipient shortcuts for GitHub, GitLab and Codeberg.
• Both declarative (config) and imperative (CLI) workflows possible.
• Different access levels through user groups.
• Secure - common crypto, minimal info leakage in rest.
• High level of integration with git.
• Familiarity to git users.
• Versioned - by wrapping git.
• Decentralized & offline ready.
• Safe to use (hard to accidentally push unencrypted secrets)
• Scriptable via CLI interface.
• Fast encryption and decryption.
• Almost zero dependencies.
• Support for rotation and exchange of secrets.
• Per-secret integrity checks with root-hash verification.

In short, sesam fits well the GitOps model of infrastructure.

Who is it for?

• Open source developers wanting to store secrets in their repos and give only their co-developers access.
• Small to mid-sized teams wanting to have different access levels in their secrets.
• Individuals wanting to store secrets in their git repos, even if it's just a single user.
• Machine users that need a scriptable tool.

Learning

How to use this manual:

• Go to Installation to grab your copy of sesam.
• Go to Basic Usage to walk through what it can do.
• Go to Advanced Usage if you need some more depth.
• Go to Reference if you need to look up things later on.

The name

It is a reference to Ali Baba and the Forty Thieves out of the story collection One Thousand and One Nights. In this story the cave opens upon calling the passphrase "Open, Sesam!" revealing a hidden cave full of gold and treasures.

You see this scene depicted on the landing page.

The logo is a sesame pod, with the seeds replaced by cute little keys.