TRANSCRYPT(1)

📦
version 2.3.2 · 2 versions
, in nixpkgs unstable

💅 TRANSCRYPT — like, the whole manual, bestie

okay so this is transcrypt(1) — the section-1 manual page — and honestly? it's giving ✨magic✨. it's a script that makes a Git repo encrypt stuff transparently, meaning the files look normal to you but land in git all locked up. let me tell you everything, no cap. 🫶

✨ NAME ✨

transcrypt — transparently encrypt files within a git repository 💖

🌸 SYNOPSIS 🌸

transcrypt [options...]

that's it. that's the whole invocation. iconic. 🎀

🦋 DESCRIPTION 🦋

so here's the tea: transcrypt will configure a Git repository to support the transparent encryption/decryption of files. how? by utilizing OpenSSL's symmetric cipher routines and Git's built-in clean/smudge filters. literally the dream team. 💫

it will also add a Git alias "ls-crypt" to list all transparently encrypted files within the repository. cute nickname, does a real job. 👑

the transcrypt source code and full documentation may be downloaded from https://github.com/elasticdog/transcrypt. go follow, iykyk. 🐕

🌈 OPTIONS 🌈

so many options and every single one is a main character. here we go:

  • -c, --cipher=cipher — the symmetric cipher to utilize for encryption; defaults to aes-256-cbc 🔐
  • -p, --password=password — the password to derive the key from; defaults to 30 random base64 characters 🎲
  • -y, --yes — assume yes and accept defaults for non-specified options. yes-queen mode, no questions asked 🙈
  • -d, --display — display the current repository's cipher and password. show me the secrets bestie 👀
  • -r, --rekey — re-encrypt all encrypted files using new credentials. glow-up for your keys 💅
  • -f, --flush-credentials — remove the locally cached encryption credentials and re-encrypt any files that had been previously decrypted. bye to the cache 🧹
  • -F, --force — ignore whether the git directory is clean, proceed with the possibility that uncommitted changes are overwritten. ⚠️ girl be CAREFUL with this one, it literally says uncommitted changes might get overwritten. periodt.
  • -u, --uninstall — remove all transcrypt configuration from the repository and leave files in the current working copy decrypted. we're breaking up (amicably) 💔
  • -l, --list — list all of the transparently encrypted files in the repository, relative to the top-level directory 📋
  • -s, --show-raw=file — show the raw file as stored in the git commit object; use this to check if files are encrypted as expected. vibe check on your ciphertext 🔍
  • -e, --export-gpg=recipient — export the repository's cipher and password to a file encrypted for a gpg recipient. sharing is caring (securely) 🤝
  • -i, --import-gpg=file — import the password and cipher from a gpg encrypted file 📥
  • -v, --version — print the version information 🏷️
  • -h, --help — view this help message 🆘

🍓 EXAMPLES 🍓

🌟 starting fresh (the setup era)

to initialize a Git repository to support transparent encryption, just change into the repo and run the transcrypt script. transcrypt will prompt you interactively for all required information if the corresponding option flags were not given. no flags? no problem, it'll interview you like a little journalist 🎤

$ cd <path-to-your-repo>/
$ transcrypt

🔥 actually encrypting stuff

once a repository has been configured with transcrypt, you can transparently encrypt files by applying the "crypt" filter and diff to a pattern in the top-level .gitattributes config. if that pattern matches a file in your repository, the file will be transparently encrypted once you stage and commit it:

$ echo 'sensitive_file  filter=crypt diff=crypt' >> .gitattributes
$ git add .gitattributes sensitive_file
$ git commit -m 'Add encrypted version of a sensitive file'

(no that's not a typo, there are two spaces in there. leave it. it's fine. 💀)

see the gitattributes(5) man page for more information — go read it, it's your new bestie too 📖

🧚 you just cloned an encrypted repo

if you have just cloned a repository containing files that are encrypted, you'll want to configure transcrypt with the same cipher and password as the origin repository. once transcrypt has stored the matching credentials, it will force a checkout of any existing encrypted files in order to decrypt them. match the creds, get the files, slay 💖

👑 your origin repo just rekeyed

if the origin repository has just rekeyed, all clones should flush their transcrypt credentials, fetch and merge the new encrypted files via Git, and then re-configure transcrypt with the new credentials. three-step choreography, do it in order, no skipping 🩰

💜 AUTHOR 💜

Aaron Bull Schaefer <aaron@elasticdog.com> — thank you king 🫡

🌸 MAINTAINER 🌸

James Murty <james@murty.co> — keeping it alive, we love to see it 🫶

⭐ SEE ALSO ⭐

and that's the whole page, bestie! 💖 this absolute icon of a manpage is dated August 2016 and it's TRANSCRYPT(1) — go forth, encrypt transparently, and don't ever run -F without thinking. mwah! 💅✨🌈

📦 where this page comes from