GIT-SECRET-HIDE(1)

📦
version 0.5.0 · 3 versions
, in debian bookworm, debian trixie, fedora 43, fedora 44, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ GIT-SECRET-HIDE(1) ✨

okay so bestie, welcome to git-secret-hide 💅 this is the one that does the hiding, from the git-secret family (version 0.5.0-alpha2, she's a lil alpha but she's iconic).

🎀 NAME 🎀

git-secret-hide — encrypts all added files with repo keyring. that's it, that's the girl 💖

🦋 SYNOPSIS 🦋

git secret hide [-c] [-F] [-P] [-v] [-d] [-m]

🌸 DESCRIPTION 🌸

so git-secret-hide writes an encrypted version of each file that got added by the git-secret-add command. no cap.

then literally anyone you've enabled via git secret tell can decrypt those files. slay 🫶

under the hood? git-secret is using the keyring of public keys sitting in .gitsecret/keys to encrypt your files, and the encrypted versions are typically called filename.txt.secret. cute, right?

later, permitted users can use their secret key (typically from their home directory) to decrypt files. that's the whole vibe 💜

⚠️ ok this next part is IMPORTANT so like, read it, fr fr:

it is recommended to encrypt (or re-encrypt) ALL the files in a git-secret repo every single time git secret hide is run. otherwise the keyring (the one stored in .gitsecret/keys/*.gpg) may have changed since the last time the files were encrypted, and it´s possible to create a state where the users in the output of git secret whoknows may not be able to decrypt the some files in the repo, or may be able decrypt files they´re not supposed to be able to. 😭 that's a whole mess, we do not want.

in other words, unless you re-encrypt all the files in a repo each time you hide any, it´s possible to make it so some files can no longer be decrypted by users who should be (and would appear) able to decrypt them, and vice-versa. 🫠 the way that access control can just *dissolve*…

if you know what you are doing and wish to encrypt or re-encrypt only a subset of the files even after reading the above paragraphs, you can use the -F or -m options. here's the tea:

  • -F forces git secret hide to skip any hidden files where the unencrypted versions aren´t present.
  • -m skips any hidden files that have not be been modified since the last time they were encrypted.

✨ OPTIONS ✨

  • -v — verbose, shows extra information. she's chatty and we love that 💬
  • -c — deletes encrypted files before creating new ones. out with the old, in with the new 💅
  • -F — forces hide to continue if a file to encrypt is missing. no meltdowns, we keep it moving 🚀
  • -P — preserve permissions of unencrypted file in encrypted file. matchy matchy 🎀
  • -d — deletes unencrypted files after encryption. bye bestie 👋 (dramatic but intentional)
  • -m — encrypt files only when modified. if it didn't change, we're not touching it ✋
  • -h — shows help. the classic, the icon, the safe word 🙈

🌈 ENV VARIABLES 🌈

💖 MANUAL 💖

run man git-secret-hide to see this document. yes, the thing you are literally reading rn. meta 🪞✨

👑 SEE ALSO 👑

sobolevn wrote this in April 2022, and it's part of the git-secret 0.5.0-alpha2 era 💖 that's the whole page bestie, now go encrypt something responsibly 🫶✨🎀

📦 where this page comes from