File encryption in Git Repository

Question

Is there any way (in built or add-on) to encrypt individual files in a repository, accessible by limited people. Files when checked in by those folks will auto encrypt and decrypt when checked out. They will stay encrypted if tried to be accessed by other people.

Fionafionna

I do not know of anything that does this "off the shelf" as it were, but in theory, you can, through .gitattributes and clean and smudge filters, accomplish this goal. It's just a Small Matter of Programming... – Stickler

Have a look at github.com/AGWA/git-crypt – Shear

git-crypt — git-crypt enables transparent encryption and decryption of files in a git repository. Files which you choose to protect are encrypted when committed, and decrypted when checked out. git-crypt lets you freely share a repository containing a mix of public and private content. git-crypt gracefully degrades, so developers without the secret key can still clone and commit to a repository with encrypted files. – Tyus

@phd: git-crypt looks like just what I was thinking of (except they obviously know more than I do about encryption—I can follow the description but know nothing of the proof they mention, but it certainly sounds like the right idea). – Stickler

I am using gocryptfs at the bottom, and a normal git inside the mounted plain text drive – Hawfinch

@MartinMeeser With regard to gocryptfs, gec builds upon it to use a git repo on the outside. – Burkholder

Answer 1

I know my answer is late but there is plenty of alternatives for storing secrets in git repos:

1. Git-crypt
2. BlackBox
3. SOPS
4. Transcrypt

Most of them use GNU Privacy Guard (GPG), symmetric key encryption, and/or cloud key services (SOPS). If you just want a simple encryption mechanism with password you can also take a look at ansible vault, which doesn't require generating keys for each account.

Afresh

Git-crypt is simple and easy to use – Flattie

Git-crypt has had no releases since 2017. – Ceric

git-crypt 0.7.0 released on 2022-04-21 github.com/AGWA/git-crypt/releases/tag/0.7.0 – Scarcity

I also have good experience with git-crypt, but my followup question: is there a possibility to work with them on android (found no way for git-crypt (besides solutions like termux))? Or any other ideas how to conveniently open (git-)crypted files in a git-repo from android? – Chuckhole

Answer 2

Maybe Blackbox helps?

From their website (https://github.com/StackExchange/blackbox):

Safely store secrets in a VCS repo (i.e. Git, Mercurial, Subversion or Perforce). These commands make it easy for you to Gnu Privacy Guard (GPG) encrypt specific files in a repo so they are "encrypted at rest" in your repository. However, the scripts make it easy to decrypt them when you need to view or edit them, and decrypt them for use in production. Originally written for Puppet, BlackBox now works with any Git or Mercurial repository.

...

Rather than one GPG passphrase for all the files, each person with access has their own GPG keys in the system. Any file can be decrypted by anyone with their GPG key. This way, if one person leaves the company, you don't have to communicate a new password to everyone with access. Simply disable the one key that should no longer have access. The process for doing this is as easy as running 2 commands (1 to disable their key, 1 to re-encrypt all files.)

Himelman

Answer 3

I created this to be a bit more simple and idempotent since Ansible vault did not offer a deterministic encryption method. It's probably not the recommended tool for all use cases but provides a very simple interface for encryption at rest. https://github.com/shyce/shield

Dyson

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. – Crystallization

Answer 4

one way is to use Vim.

You can just open the file in Vim.

Then input command ":X"

input your password

And share the password to whom need to access it.

Day

This is an easy solution, but whenever you write to the file and commit, git will save the new file in the repo (instead of the diff between the new file and the last version) as git cannot compute diffs on encrypted files. This eventually bloats the repo. – Ornithischian