diff --git a/RELEASE_ENGINEERING.TXT b/RELEASE_ENGINEERING.TXT
index 52c323d..461c89a 100644
--- a/RELEASE_ENGINEERING.TXT
+++ b/RELEASE_ENGINEERING.TXT
@@ -43,3 +43,37 @@ R="v1.$(date +%Y%m%d)"
 git tag "$R"
 git push origin tag "$R"
 ```
+
+# Updating MacPorts
+
+Step 1: Generate the Port file
+
+tools/mk_portfile.sh tools/Portfile.template Portfile 1.20150222
+
+Step 2: Test it locally
+
+sudo vi /opt/local/etc/macports/sources.conf
+  Add this line early in the file:
+  file:///var/tmp/ports
+rm -rf /var/tmp/ports
+mkdir -p /var/tmp/ports/security/vcs_blackbox
+cp Portfile /var/tmp/ports/security/vcs_blackbox
+cd /var/tmp/ports && portindex
+sudo port clean --all vcs_blackbox
+sudo port uninstall vcs_blackbox
+sudo port install vcs_blackbox
+
+Step 3: File a request for an update
+
+* https://trac.macports.org/newticket
+* Summary: `vcs_blackbox @1.20150222 Update to latest upstream`
+* Description: ```
+New upstream of vcs_blackbox.
+github.setup and checksums updated.```
+* Type: `update`
+* Component: `ports`
+* Port: `vcs_blackbox`
+
+Attach the `Portfile` generated in Step 1.
+
+Step 4: Wait for the devs to pick up the change.
\ No newline at end of file
diff --git a/tools/Portfile.template b/tools/Portfile.template
new file mode 100644
index 0000000..2c45dd1
--- /dev/null
+++ b/tools/Portfile.template
@@ -0,0 +1,31 @@
+# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4
+# $Id: Portfile 132962 2015-02-16 10:33:02Z ryandesign@macports.org $
+
+PortSystem          1.0
+PortGroup           github 1.0
+
+github.setup        StackExchange blackbox @@VERSION@@ v
+name                vcs_blackbox
+categories          security
+platforms           darwin
+maintainers         whatexit.org:tal openmaintainer
+license             BSD
+supported_archs     noarch
+
+description         Safely store secrets in git/hg/svn repos using GPG encryption
+
+long_description    Storing secrets such as passwords, certificates and private keys \
+                    in Git/Mercurial/SubVersion is dangerous. Blackbox makes it easy \
+                    to store secrets safely using GPG encryption. They can be easily \
+                    decrypted for editing or use in production.
+
+checksums           rmd160  @@RMD160@@ \
+                    sha256  @@SHA256@@
+
+use_configure       no
+
+build               {}
+
+# This project's Makefile uses DESTDIR incorrectly.
+destroot.destdir    DESTDIR=${destroot}${prefix}
+destroot.target     packages-macports
diff --git a/tools/macports_update.sh b/tools/macports_update.sh
new file mode 100755
index 0000000..ee871fb
--- /dev/null
+++ b/tools/macports_update.sh
@@ -0,0 +1,29 @@
+#! /usr/bin/env bash
+
+# Generate the Macports Portfile and test it.
+
+PORTVERSION=${1?"Arg 1 must be a version number like 1.20150222 (with no v)"} ; shift
+
+tools/mk_portfile.sh tools/Portfile.template Portfile "$PORTVERSION"
+
+echo
+echo 'Adding file:///var/tmp/ports to the start of /opt/local/etc/macports/sources.conf'
+echo
+fgrep >/dev/null -x 'file:///var/tmp/ports' /opt/local/etc/macports/sources.conf || sudo sed -i -e '1s@^@file:///var/tmp/ports\'$'\n@' /opt/local/etc/macports/sources.conf
+
+echo
+echo 'Installing port using local repo.'
+echo
+sudo port uninstall vcs_blackbox
+rm -rf /var/tmp/ports
+mkdir -p /var/tmp/ports/security/vcs_blackbox
+cp Portfile /var/tmp/ports/security/vcs_blackbox
+cd /var/tmp/ports && portindex
+sudo port clean --all vcs_blackbox
+sudo port install vcs_blackbox
+
+#echo
+#echo 'Removing file:///var/tmp/ports from /opt/local/etc/macports/sources.conf'
+#echo
+#sudo sed -i -e '\@^file:///var/tmp/ports@d' /opt/local/etc/macports/sources.conf
+echo 'You may wish to: sudo vi /opt/local/etc/macports/sources.conf'
diff --git a/tools/mk_portfile.sh b/tools/mk_portfile.sh
new file mode 100755
index 0000000..8fbe5b7
--- /dev/null
+++ b/tools/mk_portfile.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Turn the Portfile.template into a Portfile.
+# Usage:
+#   mk_portfile.sh TEMPLATE OUTPUTFILE VERSION
+
+# FIXME(tal): This code may be broken.  URL may be incorrect.
+
+set -e
+blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+source ${blackbox_home}/../bin/_stack_lib.sh
+
+TEMPLATEFILE=${1?"Arg 1 must be the template."} ; shift
+OUTPUTFILE=${1?"Arg 2 must be the outputfile."} ; shift
+PORTVERSION=${1?"Arg 3 must be a version number like 1.20150222 (with no v)"} ; shift
+
+make_self_deleting_tempfile bbtar
+echo URL="https://github.com/StackExchange/blackbox/archive/v${PORTVERSION}.tar.gz"
+curl -L "https://github.com/StackExchange/blackbox/archive/v${PORTVERSION}.tar.gz" -o ${bbtar}
+RMD160=$(openssl dgst -rmd160 ${bbtar}  | awk '{ print $NF }')
+SHA256=$(openssl dgst -sha256 ${bbtar}  | awk '{ print $NF }')
+echo PORTVERSION=$PORTVERSION
+echo RMD160=$RMD160
+echo SHA256=$SHA256
+
+sed <"$TEMPLATEFILE" >"$OUTPUTFILE" -e 's/@@VERSION@@/'"$PORTVERSION"'/g' -e 's/@@RMD160@@/'"$RMD160"'/g' -e 's/@@SHA256@@/'"$SHA256"'/g'