The source for my Godot 4 game is public and open. With exports targeting Web, Linux, or Windows this was just fine. However, now I'm trying to target macOS with an export as well. This includes signing and notarizing the app (as I suspect Android and iOS targets would need too) with specific secrets.
These secrets should not go into the public source but, well... be kept secret. I cannot find any good documentation on how to do this. I've checked:
As well as other bits of the documentation and online search results. None of them have any definitive advice on how to handle this situation. But perhaps I've not been reading of searching precisely enough?
The closest I've come is what the
.gitignore from godot-demo-projects seems to do: just ignore
exports_presets.cfg and presumably have secrets inside that file. That has two major downsides for me:
- A ton of other non-secret export settings are now no longer under source control;
- You're one git mistake away from making your secrets public.
I must be missing something, because anyone who wants to make a notarized macOS export for a Godot game will encounter this situation. Even if your source code is private, you'd not want to have secrets in there in plaintext, right?
How do you keep export secrets safely outside of the game code repository, without giving up on all source control of non-secret export settings?
I'm happy to utilize any Godot 4 feature as I'm on the latest major release, but I reckon others might be interested in a Godot 3.x solution as well.