diff --git a/fscrypt.yaml b/fscrypt.yaml
new file mode 100644
index 00000000000..590a5887eca
--- /dev/null
+++ b/fscrypt.yaml
@@ -0,0 +1,63 @@
+package:
+  name: fscrypt
+  version: 0.3.5
+  epoch: 0
+  description: Go tool for managing Linux filesystem encryption
+  copyright:
+    - license: Apache-2.0
+
+environment:
+  environment:
+    BINDIR: /usr/bin
+  contents:
+    packages:
+      - build-base
+      - busybox
+      - findutils
+      - go
+      - linux-pam-dev
+      - m4
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/google/fscrypt
+      tag: v${{package.version}}
+      expected-commit: 49c71dedfee544fd74808d3a18972fb65d6e9f02
+
+  - uses: go/bump
+    with:
+      deps: golang.org/x/crypto@v0.17.0
+
+  - runs: make BINDIR="${{targets.destdir}}/usr/bin" PREFIX="${{targets.destdir}}/usr" DESTDIR=""
+
+  - runs: make BINDIR="${{targets.destdir}}/usr/bin" PREFIX="${{targets.destdir}}/usr" DESTDIR="" install
+
+  - uses: strip
+
+update:
+  enabled: true
+  github:
+    identifier: google/fscrypt
+    strip-prefix: v
+    use-tag: true
+
+test:
+  pipeline:
+    - runs: |
+        fscrypt --version | grep ${{package.version}}
+
+        # Make sure there are no encrypted volumes
+        set +e
+        fscrypt status | grep Yes
+        if [ $? -eq 0 ]; then
+         echo "output should have been empty, got: "
+         fscrypt status
+         exit 1
+        fi
+        set -e
+        # Encrypt a volume
+        fscrypt setup --force
+
+        # Now make sure there is an encrypted volume
+        fscrypt status | grep Yes