Re: can Git encrypt/decrypt .gpg on push/fetch?

[Ted Zlatanov <tzz@lifelogs.com>]

On Fri, 09 Sep 2011 15:36:29 +0200 Michael J Gruber <git@drmicha.warpmail.net> wrote: 

MJG> Aneesh Bhasin venit, vidit, dixit 09.09.2011 12:50:
>> Hi Ted,
>> 
>> 
>> 2011/9/9 Ted Zlatanov <tzz@lifelogs.com>
>>> 
>>> I need to store some encrypted files in Git but for some clients with
>>> the right GPG keys, decrypt them on checkout (possibly also encrypt them
>>> back on commit, but that's not as important).
>>> 
>>> diff doesn't have to work, this is just for convenience.  Can Git do
>>> this (matching only .gpg files) or do I need my own command to run after
>>> the checkout/fetch and before commit?  It seems pretty out of Git's
>>> scope but perhaps others have done this before.
>>> 
>> 
>> Have you looked at git hooks (e.g. here : http://progit.org/book/ch7-3.html).
>> 
>> You could do the encryption/decryption in pre-commit and post-checkout
>> hooks scripts respectively...

MJG> I'd recommend textconv for diffing and clean/smudge for plaintext
MJG> checkout. That is, there are two convenient versions:

MJG> A) Keep blobs and checkout encrypted
MJG> - Use an editor which can encrypt/decrypt on the fly (e.g. vim)
MJG> - Use "*.gpg diff=gpg" in your attributes and
MJG> [diff "gpg"]
MJG>         textconv = gpg -d
MJG>   in your config to have cleartext diffs. Use cachetextconv with caution ;)

MJG> B) Keep blobs encrypted, checkout decrypted
MJG> - Use Use "*.gpg filter=gpg" in your attributes and
MJG> [filter "gpg"]
MJG> 	smudge = gpg -d
MJG> 	clean = gpg -e -r yourgpgkey
MJG>   in your config.

MJG> I use A on a regular basis. B is untested (but patterned after a similar
MJG> gzip filter I use). You may or may not have better results with "gpg -ea".

MJG> On clients without the keys, you can simply leave out the diff or filter
MJG> config resp. set them to "cat".

That's really helpful, thank you Aneesh and Michael.  Exactly what I was
hoping to achieve.

Ted