Re: can Git encrypt/decrypt .gpg on push/fetch?

On Fri, 09 Sep 2011 15:36:29 +0200 Michael J Gruber [off-list ref] wrote: 

MJG> Aneesh Bhasin venit, vidit, dixit 09.09.2011 12:50:

quoted

Hi Ted,


2011/9/9 Ted Zlatanov [off-list ref]

quoted

I need to store some encrypted files in Git but for some clients with
the right GPG keys, decrypt them on checkout (possibly also encrypt them
back on commit, but that's not as important).

diff doesn't have to work, this is just for convenience.  Can Git do
this (matching only .gpg files) or do I need my own command to run after
the checkout/fetch and before commit?  It seems pretty out of Git's
scope but perhaps others have done this before.

Have you looked at git hooks (e.g. here : http://progit.org/book/ch7-3.html).

You could do the encryption/decryption in pre-commit and post-checkout
hooks scripts respectively...

MJG> I'd recommend textconv for diffing and clean/smudge for plaintext
MJG> checkout. That is, there are two convenient versions:

MJG> A) Keep blobs and checkout encrypted
MJG> - Use an editor which can encrypt/decrypt on the fly (e.g. vim)
MJG> - Use "*.gpg diff=gpg" in your attributes and
MJG> [diff "gpg"]
MJG>         textconv = gpg -d
MJG>   in your config to have cleartext diffs. Use cachetextconv with caution ;)

MJG> B) Keep blobs encrypted, checkout decrypted
MJG> - Use Use "*.gpg filter=gpg" in your attributes and
MJG> [filter "gpg"]
MJG> 	smudge = gpg -d
MJG> 	clean = gpg -e -r yourgpgkey
MJG>   in your config.

MJG> I use A on a regular basis. B is untested (but patterned after a similar
MJG> gzip filter I use). You may or may not have better results with "gpg -ea".

MJG> On clients without the keys, you can simply leave out the diff or filter
MJG> config resp. set them to "cat".

That's really helpful, thank you Aneesh and Michael.  Exactly what I was
hoping to achieve.

Ted