Securely processing secret values in application configurations

A computer program product, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code executable by at least one processor to perform operations for:

• retrieving a configuration file for an application from a first repository, wherein the configuration file stores a configuration value and a link to a secret value in a second repository;
• retrieving the secret value from the second repository using the link to the secret value in the configuration file;
• hashing the configuration value to output a hashed configuration value and the secret value to output a hashed secret value;
• and
• signing, with a private key, the hashed configuration value to output a hashed and signed configuration value and the hashed secret value to output a hashed and signed secret value;
• and
• storing the configuration value, the secret value, the hashed and signed configuration value, and the hashed and signed secret value in a release file, wherein the configuration value and the secret value are environment variables;
• and
• executing the application using the release file.

A computer system, comprising:

• one or more processors, one or more computer-readable memories and one or more computer-readable, tangible storage devices;
• and
• program instructions, stored on at least one of the one or more computer-readable, tangible storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to perform operations comprising:
• retrieving a configuration file for an application from a first repository, wherein the configuration file stores a configuration value and a link to a secret value in a second repository;
• retrieving the secret value from the second repository using the link to the secret value in the configuration file;
• hashing the configuration value to output a hashed configuration value and the secret value to output a hashed secret value;
• and
• signing, with a private key, the hashed configuration value to output a hashed and signed configuration value and the hashed secret value to output a hashed and signed secret value;
• and
• storing the configuration value, the secret value, the hashed and signed configuration value, and the hashed and signed secret value in a release file, wherein the configuration value and the secret value are environment variables;
• and
• executing the application using the release file.