README.md in cocoapods-keys-1.7.0 vs README.md in cocoapods-keys-2.0.0

- old
+ new

@@ -4,11 +4,11 @@ Its good security practice to keep production keys out of developer hands. CocoaPods-keys makes it easy to have per-user config settings stored securely in the developer's keychain, and not in the application source. It is a plugin that once installed will run on every `pod install` or `pod update`. ## Requirements -Requires CocoaPods 0.36 +Requires CocoaPods 0.36+ ## Installation $ gem install cocoapods-keys @@ -20,11 +20,11 @@ ## Usage Using the new Plugin API in CocoaPods we can automate a lot of the fiddly bits away. You define what keys you want inside your [Podfile](https://github.com/artsy/eidolon/blob/0a9f5947914eb637fd4abf364fa3532b56da3c52/Podfile#L6-L21) and Keys will detect what keys are not yet set. If you need to specify a different project name from the target name, use the key `:target` to specify it. -``` +```ruby plugin 'cocoapods-keys', { :project => "Eidolon", :keys => [ "ArtsyAPIClientSecret", "ArtsyAPIClientKey", @@ -109,10 +109,14 @@ #### Continuous Integration It's rarely a good idea to mess around with the keychain in your CI, so keys will look for an environment var with the same string before looking in the keychain. Also you could create a `.env` file in your project folder. +#### Maintainance State + +CocoaPods Keys is effectively "done" software from Artsy's perspective. It has done everything we've needed for years. So, I wouldn't recommend making issues requesting new features, simply because we won't be building them ourselves. We'll definitely continue making sure it works etc though, we use it in production. + #### Security Key security is difficult. Right now even the biggest apps get their keys [leaked](https://threatpost.com/twitter-oauth-api-keys-leaked-030713/77597). This is neatly summed up by John Adams of the Twitter Security Team on [Quora](http://www.quora.com/Twitter-1/How-were-the-Twitter-iPhone-and-Android-OAuth-keys-leaked). > Putting this in the context of, "should you be storing keys in software", is more appropriate. Many companies do this. It's never a good idea. @@ -123,6 +127,6 @@ So in summary, the ideal way to store keys is to not store keys. In reality though most Apps embed keys, and this does that and adds some rudimentary obfuscation to the keys. A well motivated app cracker could probably extract this within a few minutes however. #### Thanks -This was built with a lot of help from [@segiddins](https://github.com/segiddins) and [@ashfurrow](http://github.com/ashfurrow). +This was built with a lot of help from [@segiddins](https://github.com/segiddins), [@ashfurrow](http://github.com/ashfurrow) and [@marcelofabri](https://github.com/marcelofabri).