Git-secret: All commands give this exception: .gitsecret folder is ignored. abort.

[Clancey]

I have a standard .gitignore, if its empty everything works. But when I use the following it completly breaks git secret.

Autosave files

*~

build

[Oo]bj/
[Bb]in/
packages/
TestResults/

globs

Makefile.in
*.DS_Store
*.sln.cache
*.suo
*.cache
*.pidb
*.userprefs
*.usertasks
config.log
config.make
config.status
aclocal.m4
install-sh
autom4te.cache/
*.user
*.tar.gz
tarballs/
test-results/
Thumbs.db

Mac bundle stuff

*.dmg
*.app

resharper

__Resharper._
*.Resharper

dotCover

*.dotCover

[Clancey]

I think I realized the issue, its the empty lines that causes the issue. If I remove all empty lines it works.

[sobolevn]

thanks for the feedback. I will try to fix it asap.

[sobolevn]

@Clancey sorry, but I can not recreate your issue. What's your setup?

OS? bash/zsh/etc?

What have I tried:

1. Did the init process
2. Created .gitignore with empty lines and comments
3. Added files, removed them, everything worked

[Clancey]

OSX, standard bash/terminal.
I already had a repo with a gitignore and prior commits.
I was unable to do "git secret init"

[sobolevn]

What's the exact error message?

[Clancey]

I just tried it on a different repo, and I cannot replicate it anymore.

[sobolevn]

Well, if you ever find out - let me know. Thanks, anyway!

[Tensho]

I have the same problem. I don't quite understand why should I commit .gitsecret.
OSX El Capitan, zsh

[sobolevn]

.gitsecret folder contains all the logic files to make the program work. It actually contains:

1. public keys used for encryption
2. path mappings, which files you want to track (encrypt and decrypt)

So, if this folder is missing the whole app will crash. To prevent this kind of errors, there's a special warning which says that this folder can't be ignored.

If you find it confusing, I can suggest to change the warning message to be more specific.

[Tensho]

No, I think it's rather expressive. It's personally my problem, that I haven't understood it properly. I'm not enough fluent with PGP algo and GPG tool, but I thought that we don't need to push pub key, because everyone who should know it from my team is able to retrieve from the some kind of world-wide PKI server, I guess. So the only reason to do in a such way... If you work in closed private network without access to remote public key server.
Thank you very much, so quick response ^_^

[akonon]

I have the same issue. There's a repo on Ubuntu 16.04 and git secret works well there. When pulled the repo on CentOS7, whatever command I try, I keep getting:

error: unknown option `no-index'
usage: git check-ignore [options] pathname...
   or: git check-ignore [options] --stdin < <list-of-paths>

    -q, --quiet           suppress progress reporting
    -v, --verbose         be verbose

    --stdin               read file names from stdin
    -z                    input paths are terminated by a null character

.gitsecret folder is ignored. abort.

This happens not only in my old repository. I can't initialize git secret in a new one as well (with the same error).

The package seems to be installed properly

$ sudo yum install git-secret
Пакет git-secret-0.2.2-1.noarch уже установлен, и это последняя версия.
Выполнять нечего

[sobolevn]

@akonon it is not the same issue as it seams to me.
Could you please open a new one?

Thanks!

[TopherGopher]

I was able to replicate (and fix) by following @Clancey's comment https://github.com/sobolevn/git-secret/issues/14#issuecomment-218010655
You can have comments, but you cannot have empty lines.
On OSX using ZSH with a repo and a global gitignore file.

[sobolevn]

@TopherGopher could you please provide an example?

[TopherGopher]

This is...bizarre.
I reintroduced whitespace all over the place in both global and local .gitignore files, committed and then could not reproduce.
I have tried with fresh repos, clean branches, nothing.
I have the original error message from the repo

~/src/cf-scoring-verifier:150645942-scoring-verifier$ git secret init
.gitsecret folder is ignored. abort.

But since I cannot reproduce for you...feel free to re-close...
Just...huh.

[sobolevn]

👻

Sounds strange, quite sure that is not git-secret issue.

[TopherGopher]

It's just weird that changing the gitignore file worked for the fix, that's why I'm just so...confused.
Which is a normal state for me, so... :-)

[notjames]

I'm experiencing the same problem, however, mine is getting triggered a little differently.

1. the problem only happens if I attempt to git-secret hide from within a script.
2. My .gitignore has no superfluous whitespace and
3. running from command line works fine.

I'm still troubleshooting. Any thoughts would be greatly appreciated. I'm trying to get a pre-commit hook working.

[notjames]

at first glance, this appears to be a bug in git rev-parse --is-inside-work-tree used by git-secret in function _is_inside_git_tree but I'm still verifying. What I have so far is:

from outside the script, running strace, git rev-parse is supposed to recursively backward check the path until it finds a directory called .git. For some reason, within the script, it checks PWD and then when it finds no .git it hard fails without recursively back-checking the path. I'm not using symlinks (hard or soft) so why it just fails is not immediately understood. Here are the straces to show what I'm talking about:

within script:

 75 close(3)                                = 0                                                                                                                                      
 76 rt_sigprocmask(SIG_UNBLOCK, [PIPE], NULL, 8) = 0                                                                                                                                 
 77 rt_sigaction(SIGPIPE, {sa_handler=SIG_DFL, sa_mask=[PIPE], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f7bd0f2c140}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0    
 78 getcwd("/path/to/stuff", 129) = 85                                                                         
 79 stat(".git", 0x7ffd5ff05870)            = -1 ENOENT (No such file or directory)                                                                                                  
 80 lstat(".git/HEAD", 0x7ffd5ff05720)      = -1 ENOENT (No such file or directory)                                                                                                  
 81 write(2, "fatal: Not a git repository: '.git'\n", 36) = 36                                                                                                                       
 82 exit_group(128)                         = ? 

From cli:

close(3)                                = 0
rt_sigprocmask(SIG_UNBLOCK, [PIPE], NULL, 8) = 0
rt_sigaction(SIGPIPE, {sa_handler=SIG_DFL, sa_mask=[PIPE], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f059c648140}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
getcwd("/path/to/stuff/dir1/dir2/dir3/", 129) = 85
stat("/path/to/stuff/dir1/dir2/dir3/", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
stat("/path/to/stuff/dir1/dir2/dir3/.git", 0x7ffe11580bc0) = -1 ENOENT (No such file or directory)
lstat("/path/to/stuff/dir1/dir2/dir3/.git/HEAD", 0x7ffe11580a70) = -1 ENOENT (No such file or directory)
lstat("/path/to/stuff/dir1/dir2/dir3/HEAD", 0x7ffe11580a70) = -1 ENOENT (No such file or directory)
stat("/path/to/stuff/dir1/dir2/", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
stat("/path/to/stuff/dir1/dir2/.git", 0x7ffe11580bc0) = -1 ENOENT (No such file or directory)
lstat("/path/to/stuff/dir1/dir2/.git/HEAD", 0x7ffe11580a70) = -1 ENOENT (No such file or directory)
lstat("/path/to/stuff/dir1/dir2/HEAD", 0x7ffe11580a70) = -1 ENOENT (No such file or directory)
stat("/path/to/stuff/dir1/", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
stat("/path/to/stuff/dir1/.git", 0x7ffe11580bc0) = -1 ENOENT (No such file or directory)
lstat("/path/to/stuff/dir1/.git/HEAD", 0x7ffe11580a70) = -1 ENOENT (No such file or directory)
lstat("/path/to/stuff/dir1/HEAD", 0x7ffe11580a70) = -1 ENOENT (No such file or directory)
stat("/path/to/stuff", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
stat("/path/to/stuff/.git", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
lstat("/path/to/stuff/.git/HEAD", {st_mode=S_IFREG|0664, st_size=28, ...}) = 0
openat(AT_FDCWD, "/path/to/stuff/.git/HEAD", O_RDONLY) = 3
read(3, "ref: refs/heads/commit-hook\n", 255) = 28
read(3, "", 227)                        = 0
close(3)                                = 0

So you'll notice that rev-parse is checking to see if dir3 (and so on) is a directory and if it is then it recursively checks the parent directory to that just-checked directory, but the script version doesn't even perform that check. I'm not sure why, though. So, more to come.

[notjames]

I just noticed that this issue is closed and it may not be related, though I have a sneaky suspicion it might be if not mildly. Let me know if you want me to create a new issue to track this.

[sobolevn]

@notjames yes, please. open a new one.

[notjames]

@sobolevn will do.

[nikolaia]

I had this problem due to CLRF line endings, changing my .gitignore-file to have LF line endings made git-secret work as intended. CLRF line endings might be the case for many people working on a repo living on the Windows file system using _Bash for Windows_ or the WSL subsystem.

[wpcarro]

I'm getting this issue on Linux, but I do have \n\n (i.e. 2x newlines) in my .gitignore. Should that be problematic? This error and the error message both surprise me.

[wpcarro]

Even after removing the 2x-newlines, I get the following error:

fatal: /home/wpcarro/briefcase/.gitsecret: pathspec magic not supported by this command: 'literal'
git-secret: abort: '/home/wpcarro/briefcase/.gitsecret' is in .gitignore

I ran grep -U "^M" < .gitignore to find any CRLF newlines, but that appeared empty as I expected since I'm running Linux.

Here's my .gitignore:

.vim
./configs/secrets
**/*/.emacs.d/quelpa/**/*
**/*/.emacs.d/elpa/**/*
**/*/.emacs.d/emojis
**/*/.emacs.d/auto-save-list/**/*
**/*/.emacs.d/eshell/
**/*/.emacs.d/var/**/*
**/*/.emacs.d/.cache/**/*
**/*/.emacs.d/request
**/*/.emacs.d/network-security.data
**/*/.emacs.d/smex-items
**/*/.gnupg/random_seed
.netrwhist
Vundle.vim
**/*/.emacs.d/custom.el
**/*/.emacs.d/projectile-bookmarks.eld
**/*/.emacs.d/bookmarks
**/*/transient/history.el
*.hi
*.o
__pycache__
*.class
node_modules/
/configs/.config/fish/config.fish
/configs/.config/fish/fish_variables
/website/blog/public/
/emacs/.emacs.d/tramp
.gitsecret/keys/random_seed
!*.secret
secrets.json

This is currently preventing me from using git-secret since I need to commit --no-verify, which feels like a reckless habit to develop.

Any ideas? How much of this might just be user error?

[joshrabinowitz]

@wpcarro can you confirm which version of git-secret you are using? That is, what is the output of

git-secret --version

If you're seeing an issue with git-secret, I think it was fixed.

If you're still seeing this issue when using git-secret 0.3.2, please also see the docs on using SECRETS_VERBOSE=1 at https://github.com/sobolevn/git-secret/blob/master/man/man7/git-secret.7.ronn#configuration and see if using export SECRETS_VERBOSE=1 gives more details on what's going wrong. If you are still seeing this issue after trying with the most recent release of git-secret and using SECRETS_VERBOSE=1, please open a new ticket to track this, the bug first reported here in 2016 has definitely been fixed.