How to manage the credentials store#

Intended audience

Staff members

We use pass, lightweight directory-based password manager, as our password manager.


The repository location is in the forge.


A git diff driver is available: it will allow you to run diff/show commands on encrypted files transparently. Its configuration is stored in the .gitconfig and .gitattributes file in the repo. To enable it you should configure your local copy to read .gitconfig from the repository, as it is not done by default for security reasons.

The following will both clone your repo and set it up to use the diff driver:

git clone ssh://
git config --local include.path ../.gitconfig

(yes, it’s really ../, because the path is relative to the .git/ directory)


More information can be found at the repository.