threads / discuss / 41334

Merging branches with smudge filter

Subject: Merging branches with smudge filter

## tl;dr

4 messages between Feb 4, 2016 and Feb 9, 2016.

replies: 3people: 3as markdown or json

Leonardo· Feb 4, 2016, 23:10 UTC · lore

Hi, everybody. I'm new to git and I'd like to keep track of some codes we have here in our company. They have some sensitive information I would like to keep private. After some googling, I found some solutions that encrypt/decrypt the files using filters as they're committed/checked out. I've been using this approach and it suits my needs. Now I need to merge two branches, but the process is failing for two files in particular. First of all, here's my config file:

[filter "openssl"]
    clean = openssl enc -aes-256-cbc -a -nosalt -pass pass:password
    smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass pass:password
    required

For these two files I mentioned, decryption fails. Then I did this:

    smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass
pass:password || tee -a /out.txt

Based on the output, it seems like the input data is corrupted, but I don't get it. These files are regular source code like any other file. I can also check out both branches individually, so I'm assuming the stored blob is fine. Every other file is perfectly merged. What should I do?

Thank you.

Junio C Hamano· Feb 8, 2016, 17:32 UTC · re: Leonardo · lore

Re: Merging branches with smudge filter

Leonardo <leobasilio@gmail.com> writes:

Show 12 quoted lines

> Hi, everybody. I'm new to git and I'd like to keep track of some codes
> we have here in our company. They have some sensitive information I
> would like to keep private. After some googling, I found some
> solutions that encrypt/decrypt the files using filters as they're
> committed/checked out. I've been using this approach and it suits my
> needs. Now I need to merge two branches, but the process is failing
> for two files in particular. First of all, here's my config file:
>
> [filter "openssl"]
>     clean = openssl enc -aes-256-cbc -a -nosalt -pass pass:password
>     smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass pass:password
>     required

Git works on the "clean" representation of the data, i.e. the representation of the blob object stored in the object database and in the index, when manipulating the contents, e.g. diffing two variants, patching (think "add -p"), merging, etc.

As you are making the "clean" version an encrypted opaque sequence of bytes, it is expected that you wouldn't be able to run 3-way merges.

Leonardo· Feb 8, 2016, 17:52 UTC · re: Junio C Hamano · lore

Re: Merging branches with smudge filter

Hi. I understand what you mean, but if that's the case, I don't get how every file was merged successfully despite the encryption, except two of them. I thought the smudge filter was supposed to be applied to every blob before any git operation, thus exposing the clean source code. Well, in the end I've merged these two files manually. I think I might have done something wrong while branching. I'm still learning. Next time I'll be more attentive.

2016-02-08 15:32 GMT-02:00 Junio C Hamano <gitster@pobox.com>:

Show 23 quoted lines

> Leonardo <leobasilio@gmail.com> writes:
>
>> Hi, everybody. I'm new to git and I'd like to keep track of some codes
>> we have here in our company. They have some sensitive information I
>> would like to keep private. After some googling, I found some
>> solutions that encrypt/decrypt the files using filters as they're
>> committed/checked out. I've been using this approach and it suits my
>> needs. Now I need to merge two branches, but the process is failing
>> for two files in particular. First of all, here's my config file:
>>
>> [filter "openssl"]
>>     clean = openssl enc -aes-256-cbc -a -nosalt -pass pass:password
>>     smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass pass:password
>>     required
>
> Git works on the "clean" representation of the data, i.e. the
> representation of the blob object stored in the object database and
> in the index, when manipulating the contents, e.g. diffing two
> variants, patching (think "add -p"), merging, etc.
>
> As you are making the "clean" version an encrypted opaque sequence
> of bytes, it is expected that you wouldn't be able to run 3-way
> merges.

Michael J Gruber· Feb 9, 2016, 09:15 UTC · re: Leonardo · lore

Re: Merging branches with smudge filter

[Please bottom-reply on this list] Leonardo venit, vidit, dixit 08.02.2016 18:52:

Show 7 quoted lines

> Hi. I understand what you mean, but if that's the case, I don't get
> how every file was merged successfully despite the encryption, except
> two of them. I thought the smudge filter was supposed to be applied to
> every blob before any git operation, thus exposing the clean source
> code. Well, in the end I've merged these two files manually. I think I
> might have done something wrong while branching. I'm still learning.
> Next time I'll be more attentive.

Simple rule with filters: "cleaned" is what is stored in the repo (as blobs) "smudged" is what you see in your files in the working tree

Now, if Git is asked to merge two revisions and some blobs were not changed at all, or only by one side of the merge, these parts of the merge can be resolved trivially.

The others can't. You may want to try merge tools, or even a custom merge driver (see git-merge man page).

Michael

Show 24 quoted lines

> 2016-02-08 15:32 GMT-02:00 Junio C Hamano <gitster@pobox.com>:
>> Leonardo <leobasilio@gmail.com> writes:
>>
>>> Hi, everybody. I'm new to git and I'd like to keep track of some codes
>>> we have here in our company. They have some sensitive information I
>>> would like to keep private. After some googling, I found some
>>> solutions that encrypt/decrypt the files using filters as they're
>>> committed/checked out. I've been using this approach and it suits my
>>> needs. Now I need to merge two branches, but the process is failing
>>> for two files in particular. First of all, here's my config file:
>>>
>>> [filter "openssl"]
>>>     clean = openssl enc -aes-256-cbc -a -nosalt -pass pass:password
>>>     smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass pass:password
>>>     required
>>
>> Git works on the "clean" representation of the data, i.e. the
>> representation of the blob object stored in the object database and
>> in the index, when manipulating the contents, e.g. diffing two
>> variants, patching (think "add -p"), merging, etc.
>>
>> As you are making the "clean" version an encrypted opaque sequence
>> of bytes, it is expected that you wouldn't be able to run 3-way
>> merges.