{"thread":{"id":"28343","subject":"can Git encrypt/decrypt .gpg on push/fetch?","startedAt":"2011-09-09T10:22:00Z","lastAt":"2011-09-09T19:16:05Z","messageCount":9,"participants":["Ted Zlatanov","Aneesh Bhasin","Michael J Gruber","Jeff King","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"175166","messageId":"87lityxbg7.fsf@lifelogs.com","threadId":"28343","inReplyTo":null,"subject":"can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Ted Zlatanov","fromEmail":"tzz@lifelogs.com","sentAt":"2011-09-09T10:22:00Z","receivedAt":"2011-09-09T10:22:00Z","isPatch":false,"sender":{"key":"tzz@lifelogs.com","avatar":"https://avatars.githubusercontent.com/u/67764?v=4"},"body":"I need to store some encrypted files in Git but for some clients with\nthe right GPG keys, decrypt them on checkout (possibly also encrypt them\nback on commit, but that's not as important). \n\ndiff doesn't have to work, this is just for convenience. Can Git do\nthis (matching only .gpg files) or do I need my own command to run after\nthe checkout/fetch and before commit? It seems pretty out of Git's\nscope but perhaps others have done this before.\n\nThanks\nTed\n"},{"id":"175168","messageId":"CAGhXAGSw3y=cjAHXtwycDifoBPr13AkYtLHRRXejRKue0vkz7A@mail.gmail.com","threadId":"28343","inReplyTo":"87lityxbg7.fsf@lifelogs.com","subject":"Re: can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Aneesh Bhasin","fromEmail":"contact.aneesh@gmail.com","sentAt":"2011-09-09T10:50:10Z","receivedAt":"2011-09-09T10:50:10Z","isPatch":false,"sender":{"key":"contact.aneesh@gmail.com","avatar":null},"body":"Hi Ted,\n\n\n2011/9/9 Ted Zlatanov \n>\n> I need to store some encrypted files in Git but for some clients with\n> the right GPG keys, decrypt them on checkout (possibly also encrypt them\n> back on commit, but that's not as important).\n>\n> diff doesn't have to work, this is just for convenience.  Can Git do\n> this (matching only .gpg files) or do I need my own command to run after\n> the checkout/fetch and before commit?  It seems pretty out of Git's\n> scope but perhaps others have done this before.\n>\n\nHave you looked at git hooks (e.g. here : http://progit.org/book/ch7-3.html).\n\nYou could do the encryption/decryption in pre-commit and post-checkout\nhooks scripts respectively...\n\nregards,\nAneesh\n"},{"id":"175183","messageId":"87ipp1x2uf.fsf@lifelogs.com","threadId":"28343","inReplyTo":"CAGhXAGSw3y=cjAHXtwycDifoBPr13AkYtLHRRXejRKue0vkz7A@mail.gmail.com","subject":"Re: can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Ted Zlatanov","fromEmail":"tzz@lifelogs.com","sentAt":"2011-09-09T13:27:52Z","receivedAt":"2011-09-09T13:27:52Z","isPatch":false,"sender":{"key":"tzz@lifelogs.com","avatar":"https://avatars.githubusercontent.com/u/67764?v=4"},"body":"On Fri, 9 Sep 2011 16:20:10 +0530 Aneesh Bhasin wrote: \n\nAB> 2011/9/9 Ted Zlatanov \n>> \n>> I need to store some encrypted files in Git but for some clients with\n>> the right GPG keys, decrypt them on checkout (possibly also encrypt them\n>> back on commit, but that's not as important).\n>> \n>> diff doesn't have to work, this is just for convenience.  Can Git do\n>> this (matching only .gpg files) or do I need my own command to run after\n>> the checkout/fetch and before commit?  It seems pretty out of Git's\n>> scope but perhaps others have done this before.\n>> \n\nAB> Have you looked at git hooks (e.g. here : http://progit.org/book/ch7-3.html).\n\nAB> You could do the encryption/decryption in pre-commit and post-checkout\nAB> hooks scripts respectively...\n\nYes, thank you. I was wondering if there could be further support so\nthey are checked out in a binary form on the server side if you don't\nhave the keys but in text form if you do. So for instance \"git log -p\"\nwill DTRT on a client with the keys but not on a client without them.\nThis could require deep Git changes so I'm wondering if it's even\ntheoretically possible.\n\nThanks\nTed\n"},{"id":"175184","messageId":"4E6A165D.5010703@drmicha.warpmail.net","threadId":"28343","inReplyTo":"CAGhXAGSw3y=cjAHXtwycDifoBPr13AkYtLHRRXejRKue0vkz7A@mail.gmail.com","subject":"Re: can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2011-09-09T13:36:29Z","receivedAt":"2011-09-09T13:36:29Z","isPatch":false,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Aneesh Bhasin venit, vidit, dixit 09.09.2011 12:50:\n> Hi Ted,\n> \n> \n> 2011/9/9 Ted Zlatanov \n>>\n>> I need to store some encrypted files in Git but for some clients with\n>> the right GPG keys, decrypt them on checkout (possibly also encrypt them\n>> back on commit, but that's not as important).\n>>\n>> diff doesn't have to work, this is just for convenience. Can Git do\n>> this (matching only .gpg files) or do I need my own command to run after\n>> the checkout/fetch and before commit? It seems pretty out of Git's\n>> scope but perhaps others have done this before.\n>>\n> \n> Have you looked at git hooks (e.g. here : http://progit.org/book/ch7-3.html).\n> \n> You could do the encryption/decryption in pre-commit and post-checkout\n> hooks scripts respectively...\n\nI'd recommend textconv for diffing and clean/smudge for plaintext\ncheckout. That is, there are two convenient versions:\n\nA) Keep blobs and checkout encrypted\n- Use an editor which can encrypt/decrypt on the fly (e.g. vim)\n- Use \"*.gpg diff=gpg\" in your attributes and\n[diff \"gpg\"]\n textconv = gpg -d\n in your config to have cleartext diffs. Use cachetextconv with caution ;)\n\nB) Keep blobs encrypted, checkout decrypted\n- Use Use \"*.gpg filter=gpg\" in your attributes and\n[filter \"gpg\"]\n\tsmudge = gpg -d\n\tclean = gpg -e -r yourgpgkey\n in your config.\n\nI use A on a regular basis. B is untested (but patterned after a similar\ngzip filter I use). You may or may not have better results with \"gpg -ea\".\n\nOn clients without the keys, you can simply leave out the diff or filter\nconfig resp. set them to \"cat\".\n\nMichael\n"},{"id":"175188","messageId":"87ehzpvn56.fsf@lifelogs.com","threadId":"28343","inReplyTo":"4E6A165D.5010703@drmicha.warpmail.net","subject":"Re: can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Ted Zlatanov","fromEmail":"tzz@lifelogs.com","sentAt":"2011-09-09T13:52:21Z","receivedAt":"2011-09-09T13:52:21Z","isPatch":false,"sender":{"key":"tzz@lifelogs.com","avatar":"https://avatars.githubusercontent.com/u/67764?v=4"},"body":"On Fri, 09 Sep 2011 15:36:29 +0200 Michael J Gruber wrote: \n\nMJG> Aneesh Bhasin venit, vidit, dixit 09.09.2011 12:50:\n>> Hi Ted,\n>> \n>> \n>> 2011/9/9 Ted Zlatanov \n>>> \n>>> I need to store some encrypted files in Git but for some clients with\n>>> the right GPG keys, decrypt them on checkout (possibly also encrypt them\n>>> back on commit, but that's not as important).\n>>> \n>>> diff doesn't have to work, this is just for convenience. Can Git do\n>>> this (matching only .gpg files) or do I need my own command to run after\n>>> the checkout/fetch and before commit? It seems pretty out of Git's\n>>> scope but perhaps others have done this before.\n>>> \n>> \n>> Have you looked at git hooks (e.g. here : http://progit.org/book/ch7-3.html).\n>> \n>> You could do the encryption/decryption in pre-commit and post-checkout\n>> hooks scripts respectively...\n\nMJG> I'd recommend textconv for diffing and clean/smudge for plaintext\nMJG> checkout. That is, there are two convenient versions:\n\nMJG> A) Keep blobs and checkout encrypted\nMJG> - Use an editor which can encrypt/decrypt on the fly (e.g. vim)\nMJG> - Use \"*.gpg diff=gpg\" in your attributes and\nMJG> [diff \"gpg\"]\nMJG> textconv = gpg -d\nMJG> in your config to have cleartext diffs. Use cachetextconv with caution ;)\n\nMJG> B) Keep blobs encrypted, checkout decrypted\nMJG> - Use Use \"*.gpg filter=gpg\" in your attributes and\nMJG> [filter \"gpg\"]\nMJG> \tsmudge = gpg -d\nMJG> \tclean = gpg -e -r yourgpgkey\nMJG> in your config.\n\nMJG> I use A on a regular basis. B is untested (but patterned after a similar\nMJG> gzip filter I use). You may or may not have better results with \"gpg -ea\".\n\nMJG> On clients without the keys, you can simply leave out the diff or filter\nMJG> config resp. set them to \"cat\".\n\nThat's really helpful, thank you Aneesh and Michael. Exactly what I was\nhoping to achieve.\n\nTed\n"},{"id":"175225","messageId":"20110909184229.GE28480@sigill.intra.peff.net","threadId":"28343","inReplyTo":"4E6A165D.5010703@drmicha.warpmail.net","subject":"Re: can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2011-09-09T18:42:29Z","receivedAt":"2011-09-09T18:42:29Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Sep 09, 2011 at 03:36:29PM +0200, Michael J Gruber wrote:\n\n> A) Keep blobs and checkout encrypted\n> - Use an editor which can encrypt/decrypt on the fly (e.g. vim)\n> - Use \"*.gpg diff=gpg\" in your attributes and\n> [diff \"gpg\"]\n> textconv = gpg -d\n> in your config to have cleartext diffs. Use cachetextconv with caution ;)\n\nI use something like this for my password store, though I use:\n\n textconv = gpg -qd --no-tty\n\nto keep things as clean as possible. Running gpg-agent is a must, of\ncourse.\n\nThe wallet itself is just a gpg-encrypted YAML file, with a few scripts\ngrep within the hierarchy. I'm happy to share the code if anybody is\ninterested. I've also written firefox hooks to fill website form fields,\nbut that code is a little gross.\n\n> B) Keep blobs encrypted, checkout decrypted\n> - Use Use \"*.gpg filter=gpg\" in your attributes and\n> [filter \"gpg\"]\n> \tsmudge = gpg -d\n> \tclean = gpg -e -r yourgpgkey\n> in your config.\n> \n> I use A on a regular basis. B is untested (but patterned after a similar\n> gzip filter I use). You may or may not have better results with \"gpg -ea\".\n\nYeah, I think that would work but have never tried it either.\n\n-Peff\n"},{"id":"175226","messageId":"7vvct1tu3n.fsf@alter.siamese.dyndns.org","threadId":"28343","inReplyTo":"20110909184229.GE28480@sigill.intra.peff.net","subject":"Re: can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2011-09-09T19:05:00Z","receivedAt":"2011-09-09T19:05:00Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jeff King writes:\n\n>> B) Keep blobs encrypted, checkout decrypted\n>> - Use Use \"*.gpg filter=gpg\" in your attributes and\n>> [filter \"gpg\"]\n>> \tsmudge = gpg -d\n>> \tclean = gpg -e -r yourgpgkey\n>> in your config.\n>> \n>> I use A on a regular basis. B is untested (but patterned after a similar\n>> gzip filter I use). You may or may not have better results with \"gpg -ea\".\n>\n> Yeah, I think that would work but have never tried it either.\n\nUnless \"gpg -e\" encrypts the same cleartext into the same cyphertext every\ntime, the above \"clean\" filter probably wouldn't be very useful.\n"},{"id":"175230","messageId":"4E6A653B.9090007@drmicha.warpmail.net","threadId":"28343","inReplyTo":"7vvct1tu3n.fsf@alter.siamese.dyndns.org","subject":"Re: can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2011-09-09T19:12:59Z","receivedAt":"2011-09-09T19:12:59Z","isPatch":false,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Junio C Hamano venit, vidit, dixit 09.09.2011 21:05:\n> Jeff King writes:\n> \n>>> B) Keep blobs encrypted, checkout decrypted\n>>> - Use Use \"*.gpg filter=gpg\" in your attributes and\n>>> [filter \"gpg\"]\n>>> \tsmudge = gpg -d\n>>> \tclean = gpg -e -r yourgpgkey\n>>> in your config.\n>>>\n>>> I use A on a regular basis. B is untested (but patterned after a similar\n>>> gzip filter I use). You may or may not have better results with \"gpg -ea\".\n>>\n>> Yeah, I think that would work but have never tried it either.\n> \n> Unless \"gpg -e\" encrypts the same cleartext into the same cyphertext every\n> time, the above \"clean\" filter probably wouldn't be very useful.\n> \n\nUh, right, this would only make sense with specific versions of debian's\nopenssl then. Only that gpg does not use that ;)\n\nI'm not sure whether \"gpg --symmetric\" has the same issue, but version\nA) seemed better before that already.\n\nMichael\n"},{"id":"175231","messageId":"20110909191605.GG28480@sigill.intra.peff.net","threadId":"28343","inReplyTo":"7vvct1tu3n.fsf@alter.siamese.dyndns.org","subject":"Re: can Git encrypt/decrypt .gpg on push/fetch?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2011-09-09T19:16:05Z","receivedAt":"2011-09-09T19:16:05Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Sep 09, 2011 at 12:05:00PM -0700, Junio C Hamano wrote:\n\n> Jeff King writes:\n> \n> >> B) Keep blobs encrypted, checkout decrypted\n> >> - Use Use \"*.gpg filter=gpg\" in your attributes and\n> >> [filter \"gpg\"]\n> >> \tsmudge = gpg -d\n> >> \tclean = gpg -e -r yourgpgkey\n> >> in your config.\n> >> \n> >> I use A on a regular basis. B is untested (but patterned after a similar\n> >> gzip filter I use). You may or may not have better results with \"gpg -ea\".\n> >\n> > Yeah, I think that would work but have never tried it either.\n> \n> Unless \"gpg -e\" encrypts the same cleartext into the same cyphertext every\n> time, the above \"clean\" filter probably wouldn't be very useful.\n\nAh, right, I remember now running into that at some point. You could get\naround that by using a symmetric cipher in block mode, or with a\nnon-random IV, but then you're opening yourself up to some cryptanalytic\nattacks.\n\n-Peff\n"}]}