git-crypt enables transparent encryption and decryption of files in a git repository.
Files which you choose to protect are encrypted when committed, and decrypted when checked out. git-crypt lets you freely share a repository containing a mix of public and private content.
git-crypt gracefully degrades, so developers without the secret key can still clone and commit to a repository with encrypted files. This lets you store your secret material (such as keys or passwords) in the same repository as your code, without requiring you to lock down your entire repository.
git-crypt relies on git filters, which were not designed with encryption in mind.
- GPG mode – share the repository with others (or with yourself) using GPG.
- Symmetric mode – export a symmetric secret key, which you must securely convey to collaborators (GPG is not required, and no files are added to your repository).
- Encrypts files using AES-256 in CTR mode with a synthetic IV derived from the SHA-1 HMAC of the file. This mode of operation provides semantic security under deterministic chosen-plaintext attack. That means that although the encryption is deterministic (which is required so git can distinguish when a file has and hasn’t changed), it leaks no information beyond whether two files are identical or not.
- Temporarily make files to accessible to everyone with the git-crypt unlock command.