Re: can Git encrypt/decrypt .gpg on push/fetch?

From: Ted Zlatanov <tzz@lifelogs.com>
Date: Sep 9, 2011, 13:52 UTC
Message-ID: <87ehzpvn56.fsf@lifelogs.com>
In-Reply-To: <4E6A165D.5010703@drmicha.warpmail.net>

On Fri, 09 Sep 2011 15:36:29 +0200 Michael J Gruber <git@drmicha.warpmail.net> wrote:

MJG> Aneesh Bhasin venit, vidit, dixit 09.09.2011 12:50:

Show 19 quoted lines

>> Hi Ted,
>> 
>> 
>> 2011/9/9 Ted Zlatanov <tzz@lifelogs.com>
>>> 
>>> I need to store some encrypted files in Git but for some clients with
>>> the right GPG keys, decrypt them on checkout (possibly also encrypt them
>>> back on commit, but that's not as important).
>>> 
>>> diff doesn't have to work, this is just for convenience.  Can Git do
>>> this (matching only .gpg files) or do I need my own command to run after
>>> the checkout/fetch and before commit?  It seems pretty out of Git's
>>> scope but perhaps others have done this before.
>>> 
>> 
>> Have you looked at git hooks (e.g. here : http://progit.org/book/ch7-3.html).
>> 
>> You could do the encryption/decryption in pre-commit and post-checkout
>> hooks scripts respectively...

MJG> I'd recommend textconv for diffing and clean/smudge for plaintext MJG> checkout. That is, there are two convenient versions:

MJG> A) Keep blobs and checkout encrypted MJG> - Use an editor which can encrypt/decrypt on the fly (e.g. vim) MJG> - Use "*.gpg diff=gpg" in your attributes and MJG> [diff "gpg"] MJG> textconv = gpg -d MJG> in your config to have cleartext diffs. Use cachetextconv with caution ;)

MJG> B) Keep blobs encrypted, checkout decrypted MJG> - Use Use "*.gpg filter=gpg" in your attributes and MJG> [filter "gpg"] MJG> smudge = gpg -d MJG> clean = gpg -e -r yourgpgkey MJG> in your config.

MJG> I use A on a regular basis. B is untested (but patterned after a similar MJG> gzip filter I use). You may or may not have better results with "gpg -ea".

MJG> On clients without the keys, you can simply leave out the diff or filter MJG> config resp. set them to "cat".

That's really helpful, thank you Aneesh and Michael. Exactly what I was hoping to achieve.

Ted