Skip to content

Commit 0b36143

Browse files
shadowhandshadowhand
committed
Updated gitcrypt to version 0.2.0, added "gitcrypt init" command for interactive setup, updated README
Fixes shadowhand#1
1 parent be0b54b commit 0b36143

File tree

2 files changed

+109
-38
lines changed

2 files changed

+109
-38
lines changed

‎README.md‎

Lines changed: 28 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -21,25 +21,36 @@ And it must be accessible in your `$PATH`:
2121

2222
## Configuration
2323

24-
First, you will need to add a secret salt and secure passphrase to your git
25-
configuration. The secret salt must be 16 **hexidecimal** chacaters and the
26-
secure passphrase can be any characters of any length:
24+
To quickly setup gitcrypt interactively, run `gitcrypt init` from the root
25+
of your git repository. It will ask you for a passphrase, cipher mode, and
26+
what files should be encrypted.
27+
28+
$ cd my-repo
29+
$ gitcrypt init
30+
31+
Your repository is now set up! Any time you `git add` a file that matches the
32+
filter pattern the `clean` filter is applied, automatically encrypting the file
33+
before it is staged. Using `git diff` will work normally, as it automatically
34+
decrypts file content as necessary.
35+
36+
### Manual Configuration
37+
38+
First, you will need to add a secure passphrase to your git configuration:
2739

28-
$ git config gitcrypt.salt 0000000000000000
2940
$ git config gitcrypt.pass my-secret-phrase
3041

31-
*It is possible to set these options globally using `git config --global`, but
32-
more secure to create a separate salt and passphrase for every repository.*
42+
*It is possible to set this options globally using `git config --global`, but
43+
more secure to create a separate passphrase for every repository.*
3344

34-
A quick way to generate a new salt is:
45+
The default [encryption cipher][4] is `aes-256-cbc`, which should be suitable
46+
for almost everyone. However, it is also possible to use a different cipher:
3547

36-
$ head -c 10 < /dev/random | md5 | cut -c-16
48+
$ git config gitcrypt.cipher aes-256-cbc
3749

38-
## Usage
50+
**Do not use an `ecb` cipher unless you are 100% sure what you are doing!**
3951

40-
For every repository that you want to use gitcrypt in, you will need a
41-
[.gitattributes][4] file to define what files will be encrypted. Any file
42-
[pattern format][5] can be used here.
52+
Next, you need to define what files will be automatically encrypted using the
53+
[.gitattributes][5] file. Any file [pattern format][6] can be used here.
4354

4455
To encrypt all the files in the repo:
4556

@@ -73,12 +84,7 @@ Or if you prefer to manually edit `.git/config`:
7384
[diff "encrypt"]
7485
textconv = gitcrypt diff
7586

76-
Your repository is now set up! Any time you `git add` a file that matches the
77-
filter pattern the `clean` filter is applied, automatically encrypting the file
78-
before it is staged. Using `git diff` will work normally, as it automatically
79-
decrypts file content as necessary.
80-
81-
### Decryption and Clones
87+
## Decrypting Clones
8288

8389
To set up decryption from a clone, you will need to repeat most of these steps
8490
on the other side.
@@ -93,9 +99,8 @@ Do not fear, this is actually what we want right now, because we need to setup
9399
gitcrypt before doing a checkout. Now we just repeat the configuration as it
94100
was done for the original repo.
95101

96-
Second, set your encryption salt and passphrase:
102+
Second, set your encryption passphrase:
97103

98-
$ git config gitcrypt.salt 0123456789abcdef
99104
$ git config gitcrypt.pass "gosh, i am so insecure!"
100105

101106
Third, edit `.gitattributes` or `.git/info/attributes`:
@@ -125,7 +130,8 @@ you could [buy me a beer][wishes].
125130
[1]: http://syncom.appspot.com/papers/git_encryption.txt "GIT transparent encryption"
126131
[2]: http://syncom.appspot.com/
127132
[3]: http://git.661346.n2.nabble.com/Transparently-encrypt-repository-contents-with-GPG-td2470145.html "Web discussion: Transparently encrypt repository contents with GPG"
128-
[4]: http://www.kernel.org/pub/software/scm/git/docs/gitattributes.html
129-
[5]: http://www.kernel.org/pub/software/scm/git/docs/gitignore.html#_pattern_format
133+
[4]: http://en.wikipedia.org/wiki/Cipher
134+
[5]: http://www.kernel.org/pub/software/scm/git/docs/gitattributes.html
135+
[6]: http://www.kernel.org/pub/software/scm/git/docs/gitignore.html#_pattern_format
130136

131137
[wishes]: http://www.amazon.com/gp/registry/wishlist/1474H3P2204L8 "Woody Gilk's Wish List on Amazon.com"

‎gitcrypt‎

Lines changed: 81 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,85 @@
11
#!/bin/bash
22

3-
VERSION=0.1.0
3+
readonly VERSION="0.2.0"
4+
readonly DEFAULT_CIPHER="aes-256-cbc"
5+
6+
init_config() {
7+
local answer
8+
while [ 1 ]; do
9+
while [ -z "$PASS" ]; do
10+
echo -n "Enter your passphrase: "
11+
read PASS
12+
done
13+
14+
while [ 1 ]; do
15+
echo -n "What encryption cipher do you want to use? [$DEFAULT_CIPHER] "
16+
read CIPHER
17+
[ -z "$CIPHER" ] && CIPHER="$DEFAULT_CIPHER"
18+
19+
local exists
20+
exists=$(openssl list-cipher-commands | grep "$CIPHER")
21+
[ $? -eq 0 ] && break
22+
23+
echo "Cipher '$CIPHER' is not available"
24+
done
25+
26+
echo -e "\nThis configuration will be stored:\n"
27+
echo "pass: $PASS"
28+
echo "cipher: $CIPHER"
29+
echo -e -n "\nDoes this look right? [Y/n] "
30+
read answer
31+
32+
case "$answer" in
33+
n*|N*)
34+
# Reconfigure
35+
unset -v PASS
36+
unset -v CIPHER
37+
;;
38+
*)
39+
# Finished
40+
break
41+
;;
42+
esac
43+
done
44+
45+
echo -n "Do you want to use .git/info/attributes? [Y/n] "
46+
read answer
47+
48+
local attrs
49+
case "$answer" in
50+
n*|N*)
51+
attrs=".gitattributes"
52+
;;
53+
*)
54+
attrs=".git/info/attributes"
55+
;;
56+
esac
57+
58+
local pattern
59+
echo -n "What files do you want encrypted? [*] "
60+
read pattern
61+
[ -z "$pattern" ] && pattern="*"
62+
63+
echo "$pattern filter=encrypt diff=encrypt" >> $attrs
64+
echo "[merge]" >> $attrs
65+
echo " renormalize = true" >> $attrs
66+
67+
# Encryption
68+
git config gitcrypt.pass "$PASS"
69+
git config gitcrypt.cipher "$CIPHER"
70+
71+
# Filters
72+
git config filter.encrypt.smudge "gitcrypt smudge"
73+
git config filter.encrypt.clean "gitcrypt clean"
74+
git config diff.encrypt.textconv "gitcrypt diff"
75+
}
476

577
_clean() {
678
# Encrypt using OpenSSL
7-
openssl enc -base64 -$CIPHER -S "$SALT" -k "$PASS"
79+
openssl enc -base64 -$CIPHER -salt -k "$PASS"
880
}
981

1082
_smudge() {
11-
if [ -z "$SALT" ] || [ -z "$PASS" ]; then
12-
echo "Gitcrypt: secret salt and/or pass phrase have not been set"
13-
exit 1
14-
fi
15-
1683
# If decryption fails, use `cat` instead
1784
openssl enc -d -base64 -$CIPHER -k "$PASS" 2> /dev/null || cat
1885
}
@@ -24,26 +91,24 @@ _diff() {
2491

2592
case "$1" in
2693
clean|smudge|diff)
27-
# Need secret salt and secure passphrase
28-
SALT=$(git config gitcrypt.salt)
29-
if [ -z "$SALT" ]; then
30-
echo "Gitcrypt: secret salt (gitcrypt.salt) has not been configured"
31-
exit 1
32-
fi
33-
94+
# Need a secure passphrase
3495
PASS=$(git config gitcrypt.pass)
3596
if [ -z "$PASS" ]; then
3697
echo "Gitcrypt: secure passphrase (gitcrypt.pass) has not been configured"
3798
exit 1
3899
fi
39100

40-
# Cipher
101+
# And a cipher mode
41102
CIPHER=$(git config gitcrypt.cipher)
42-
[ -z "$CIPHER" ] && CIPHER="aes-256-cbc"
103+
[ -z "$CIPHER" ] && CIPHER="$DEFAULT_CIPHER"
43104

44105
# Execute command
45106
_$1 "$2"
46107
;;
108+
init)
109+
# Run setup commands
110+
init_config
111+
;;
47112
version)
48113
# Show version
49114
echo "gitcrypt version $VERSION"

0 commit comments

Comments
 (0)