<commit_before># Biscuit

[![Build Status](https://travis-ci.org/dcoker/biscuit.svg)](https://travis-ci.org/dcoker/secrets)

Biscuit is a simple key-value store for your infrastructure secrets.

## Is Biscuit right for me?

Biscuit is most useful to teams already using AWS and IAM to manage their 
infrastructure. If that describes your team, then Biscuit might be useful to 
you if you answer "yes" to any of these questions:

* Do you live in constant fear of accidentally committing infrastructure secrets to source control?
* Do you commit private keys to your source repository?
* Do you share passwords with other developers?
* Do you want to manage secrets securely across multiple regions?

### Features

* Provides a simple key/value CLI to secure storage.
* Secrets can live alongside with your code in source control.
* Operates with KMS keys across multiple regions.
* Facilitates management of AWS IAM Policies, KMS Policies, and KMS Grants across multiple regions.
* Local encryption using AES-GCM-256 or Secretbox (NaCL).
* Offline mode: Using the "testing" key manager, you can use Biscuit in
  test environments without changing your code and without network 
  dependencies.

### Feature Comparison

| Package                                             | Requires a server? | Multi-region | HA  | Rotation | Storage  | AWS KMS  | Principals | Web UI |
|:----------------------------------------------------|:-------------------|:-------------|:----|:---------|:---------|:---------|:-----------|:-------|
| Biscuit                                             | No                 | Yes          | Yes | No       | File     | Required | AWS Only   | No     |
| [Credstash](https://github.com/fugue/credstash)     | No                 | No           | Yes | No       | DynamoDB | Required | AWS Only   | No     |
| [Lyft Confidant](https://github.com/lyft/confidant) | Yes                | No           | No  | No       | DynamoDB | Required | AWS Only   | Yes    |
| [Hashicorp Vault](https://www.vaultproject.io)      | Yes                | Yes          | Yes | Yes      | Varied   | Optional | Multiple   | No     |

## Quick Start

### Installing

#### From Binaries

| Platform | 32-bit | 64-bit | ARM | ARM-64 |
|:---------|:-------|:-------|:----|:---|
| Mac OSX | | [download](https://s3-us-west-2.amazonaws.com/biscuit-binaries/latest/biscuit/darwin_amd64/biscuit) | | |
| Linux | [download](https://s3-us-west-2.amazonaws.com/biscuit-binaries/latest/biscuit/linux_386/biscuit) | [download](https://s3-us-west-2.amazonaws.com/biscuit-binaries/latest/biscuit/linux_amd64/biscuit) | [download](https://s3-us-west-2.amazonaws.com/biscuit-binaries/latest/biscuit/linux_arm/biscuit) | [download](https://s3-us-west-2.amazonaws.com/biscuit-binaries/latest/biscuit/linux_arm64/biscuit) |
| Windows | [download](https://s3-us-west-2.amazonaws.com/biscuit-binaries/latest/biscuit/windows_386/biscuit.exe) | [download](https://s3-us-west-2.amazonaws.com/biscuit-binaries/latest/biscuit/windows_amd64/biscuit.exe) | | |

#### From Source

If you have Golang 1.6+ installed, you can install with:

```
go get -v github.com/dcoker/biscuit
```

### Setup

```shell
# Verify that your AWS credentials are readable.
biscuit kms get-caller-identity

# Provision a KMS Key w/useful defaults in us-east-1, us-west-1, 
# and us-west-2 and create a secrets.yml file.
biscuit kms init -f secrets.yml<commit_msg>Update README.md to link to GitHub Releases page.<commit_after># Biscuit

[![Build Status](https://travis-ci.org/dcoker/biscuit.svg)](https://travis-ci.org/dcoker/secrets)

Biscuit is a simple key-value store for your infrastructure secrets.

## Is Biscuit right for me?

Biscuit is most useful to teams already using AWS and IAM to manage their 
infrastructure. If that describes your team, then Biscuit might be useful to 
you if you answer "yes" to any of these questions:

* Do you live in constant fear of accidentally committing infrastructure secrets to source control?
* Do you commit private keys to your source repository?
* Do you share passwords with other developers?
* Do you want to manage secrets securely across multiple regions?

### Features

* Provides a simple key/value CLI to secure storage.
* Secrets can live alongside with your code in source control.
* Operates with KMS keys across multiple regions.
* Facilitates management of AWS IAM Policies, KMS Policies, and KMS Grants across multiple regions.
* Local encryption using AES-GCM-256 or Secretbox (NaCL).
* Offline mode: Using the "testing" key manager, you can use Biscuit in
  test environments without changing your code and without network 
  dependencies.

### Feature Comparison

| Package                                             | Requires a server? | Multi-region | HA  | Rotation | Storage  | AWS KMS  | Principals | Web UI |
|:----------------------------------------------------|:-------------------|:-------------|:----|:---------|:---------|:---------|:-----------|:-------|
| Biscuit                                             | No                 | Yes          | Yes | No       | File     | Required | AWS Only   | No     |
| [Credstash](https://github.com/fugue/credstash)     | No                 | No           | Yes | No       | DynamoDB | Required | AWS Only   | No     |
| [Lyft Confidant](https://github.com/lyft/confidant) | Yes                | No           | No  | No       | DynamoDB | Required | AWS Only   | Yes    |
| [Hashicorp Vault](https://www.vaultproject.io)      | Yes                | Yes          | Yes | Yes      | Varied   | Optional | Multiple   | No     |

## Quick Start

### Installing

#### Downloading

See [releases](https://github.com/dcoker/biscuit/releases) for the latest release.

#### Building from Source

If you have Golang 1.6+ installed, you can install with:

```
go get -v github.com/dcoker/biscuit
```

### Setup

```shell
# Verify that your AWS credentials are readable.
biscuit kms get-caller-identity

# Provision a KMS Key w/useful defaults in us-east-1, us-west-1, 
# and us-west-2 and create a secrets.yml file.
biscuit kms init -f secrets.yml
{'fraction_non_alphanumeric': 0.15215968586387435, 'fraction_numerical': 0.008180628272251309, 'mean_word_length': 2.3440919037199124, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 18, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 16, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1474823', 'n_tokens_mistral': 1837, 'n_tokens_neox': 1775, 'n_words': 576}