Git-secret: Suggest comparison to git-crypt

[barak]

It would be nice if the README.md file mentioned git-crypt as an alternative program with similar functionality, and maybe even either discussed the advantages/disadvantages/differences, or had a pointer to such a discussion.

[sobolevn]

That's nice! Thanks for the idea.

But, I really don't have any experience in using this particular software. Do you have any thing to share?

[barak]

Well, the base level functionality is pretty similar.
You can encrypt individual files, and the system maintains a list of PGP public keys whose corresponding private keys allow viewing of the encrypted files.
Beyond that, it's a bit hard for me to tell what are fundamental differences versus philosophical differences vs design choices that could be easily changed.

Here's a short description.

$ apt show git-crypt 
Package: git-crypt
Version: 0.5.0-2
Priority: optional
Section: vcs
Maintainer: Andrew Ayer <[email protected]>
Installed-Size: 201 kB
Depends: libc6 (>= 2.14), libgcc1 (>= 1:3.0), libssl1.0.2 (>= 1.0.2d), libstdc++6 (>= 5.2), git (>= 1.7.2)
Recommends: gnupg
Enhances: git
Homepage: https://www.agwa.name/projects/git-crypt
Download-Size: 75.9 kB
APT-Manual-Installed: yes
APT-Sources: http://http.debian.net/debian stretch/main amd64 Packages
Description: Transparent file encryption in git
 git-crypt enables transparent encryption and decryption of files in a
 git repository.  Files which you choose to protect are encrypted when
 committed, and decrypted when checked out.  git-crypt lets you freely
 share a repository containing a mix of public and private content.
 git-crypt gracefully degrades, so developers without the secret key
 can still clone and commit to a repository with encrypted files.
 This lets you store your secret material (such as keys or passwords)
 in the same repository as your code, without requiring you to lock down
 your entire repository.

and here's the man page:

$ env MANWIDTH=75 man git-crypt
GIT-CRYPT(1)                    git-crypt                    GIT-CRYPT(1)

NAME
       git-crypt - transparent file encryption in Git

SYNOPSIS
       git-crypt [OPTIONS] COMMAND [ARGS...]

COMMON COMMANDS
       git-crypt init

       git-crypt status

       git-crypt lock

GPG COMMANDS
       git-crypt add-gpg-user GPG_USER_ID

       git-crypt unlock

SYMMETRIC KEY COMMANDS
       git-crypt export-key OUTPUT_KEY_FILE

       git-crypt unlock KEY_FILE

DESCRIPTION
       git-crypt enables transparent encryption and decryption of files
       in a git repository. Files which you choose to protect are
       encrypted when committed, and decrypted when checked out.
       git-crypt lets you freely share a repository containing a mix of
       public and private content. git-crypt gracefully degrades, so
       developers without the secret key can still clone and commit to a
       repository with encrypted files. This lets you store your secret
       material (such as keys or passwords) in the same repository as
       your code, without requiring you to lock down your entire
       repository.

COMMANDS
       git-crypt is logically divided into several sub-commands which
       perform distinct tasks. Each sub-command, and its arguments, are
       documented below. Note that arguments and options to sub-commands
       must be specified on the command line after the name of the
       sub-command.

       init [OPTIONS]
           Generate a key and prepare the current Git repository to use
           git-crypt.

           The following options are understood:

           -k KEY_NAME, --key-name KEY_NAME
               Initialize the given key instead of the default key.
               git-crypt supports multiple keys per repository, allowing
               you to share different files with different sets of
               collaborators.

       status [OPTIONS]
           Display a list of files in the repository, with their status
           (encrypted or unencrypted).

           The following options are understood:

           -e
               Show only encrypted files.

           -u
               Show only unencrypted files.

           -f, --fix
               Encrypt files that should be encrypted but were committed
               to the repository or added to the index without
               encryption. (This can happen if a file is added before
               git-crypt is initialized or before the file is added to
               the gitattributes file.)

       add-gpg-user [OPTIONS] GPG_USER_ID...
           Add the users with the given GPG user IDs as collaborators.
           Specifically, git-crypt uses gpg(1) to encrypt the shared
           symmetric key to the public keys of each GPG user ID, and
           stores the GPG-encrypted keys in the .git-crypt directory at
           the root of the repository.

           GPG_USER_ID can be a key ID, a full fingerprint, an email
           address, or anything else that uniquely identifies a public
           key to GPG (see "HOW TO SPECIFY A USER ID" in the gpg(1) man
           page).

           The following options are understood:

           -k KEY_NAME, --key-name KEY_NAME
               Grant access to the given key, rather than the default
               key.

           -n, --no-commit
               Don't automatically commit the changes to the .git-crypt
               directory.

           --trusted
               Assume that the GPG keys specified on the command line are
               trusted; i.e. they actually belong to the users that they
               claim to belong to.

               Without this option, git-crypt uses the same trust model
               as GPG, which is based on the Web of Trust by default.
               Under this model, git-crypt will reject GPG keys that do
               not have trusted signatures.

               If you don't want to use the Web of Trust, you can either
               change GPG's trust model by setting the trust-model option
               in ~/.gnupg/gpg.conf (see gpg(1)), or use the --trusted
               option to add-gpg-user on a case-by-case basis.

       unlock [KEY_FILE...]
           Decrypt the repository. If one or more key files are specified
           on the command line, git-crypt attempts to decrypt using those
           shared symmetric keys. If no key files are specified,
           git-crypt attempts to decrypt using a GPG-encrypted key stored
           in the repository's .git-crypt directory.

           This command takes no options.

       export-key [OPTIONS] FILENAME
           Export the repository's shared symmetric key to the given
           file.

           The following options are understood:

           -k KEY_NAME, --key-name KEY_NAME
               Export the given key, rather than the default key.

       help [COMMAND]
           Display help for the given COMMAND, or an overview of all
           commands if no command is specified.

       version
           Print the currently-installed version of git-crypt. The format
           of the output is always "git-crypt", followed by a space,
           followed by the dotted version number.

USING GIT-CRYPT
       First, you prepare a repository to use git-crypt by running
       git-crypt init.

       Then, you specify the files to encrypt by creating a
       gitattributes(5) file. Each file which you want to encrypt should
       be assigned the "filter=git-crypt diff=git-crypt" attributes. For
       example:

           secretfile filter=git-crypt diff=git-crypt
           *.key filter=git-crypt diff=git-crypt

       Like a .gitignore file, .gitattributes files can match wildcards
       and should be checked into the repository. Make sure you don't
       accidentally encrypt the .gitattributes file itself (or other git
       files like .gitignore or .gitmodules). Make sure your
       .gitattributes rules are in place before you add sensitive files,
       or those files won't be encrypted!

       To share the repository with others (or with yourself) using GPG,
       run:

           git-crypt add-gpg-user GPG_USER_ID

       GPG_USER_ID can be a key ID, a full fingerprint, an email address,
       or anything else that uniquely identifies a public key to GPG.
       Note: git-crypt add-gpg-user will add and commit a GPG-encrypted
       key file in the .git-crypt directory of the root of your
       repository.

       Alternatively, you can export a symmetric secret key, which you
       must securely convey to collaborators (GPG is not required, and no
       files are added to your repository):

           git-crypt export-key /path/to/key

       After cloning a repository with encrypted files, unlock with with
       GPG:

           git-crypt unlock

       Or with a symmetric key:

           git-crypt unlock /path/to/key

       That's all you need to do - after git-crypt is set up (either with
       git-crypt init or git-crypt unlock), you can use git normally -
       encryption and decryption happen transparently.

THE .GITATTRIBUTES FILE
       The .gitattributes file is documented in gitattributes(5). The
       file pattern format is the same as the one used by .gitignore, as
       documented in gitignore(5), with the exception that specifying
       merely a directory (e.g. "/dir/") is not sufficient to encrypt all
       files beneath it.

       Also note that the pattern "dir/*" does not match files under
       sub-directories of dir/. To encrypt an entire sub-tree dir/, place
       the following in dir/.gitattributes:

           * filter=git-crypt diff=git-crypt
           .gitattributes !filter !diff

       The second pattern is essential for ensuring that .gitattributes
       itself is not encrypted.

MULTIPLE KEY SUPPORT
       In addition to the implicit default key, git-crypt supports
       alternative keys which can be used to encrypt specific files and
       can be shared with specific GPG users. This is useful if you want
       to grant different collaborators access to different sets of
       files.

       To generate an alternative key named KEYNAME, pass the -k KEYNAME
       option to git-crypt init as follows:

           git-crypt init -k KEYNAME

       To encrypt a file with an alternative key, use the
       git-crypt-KEYNAME filter in .gitattributes as follows:

           secretfile filter=git-crypt-KEYNAME diff=git-crypt-KEYNAME

       To export an alternative key or share it with a GPG user, pass the
       -k KEYNAME option to git-crypt export-key or git-crypt
       add-gpg-user as follows:

           git-crypt export-key -k KEYNAME /path/to/keyfile
           git-crypt add-gpg-user -k KEYNAME GPG_USER_ID

       To unlock a repository with an alternative key, use git-crypt
       unlock normally. git-crypt will automatically determine which key
       is being used.

SEE ALSO
       git(1), gitattributes(5), git-crypt home page[1], GitHub
       repository[2]

AUTHOR
       Andrew Ayer <[email protected]>

NOTES
        1. git-crypt home page
           https://www.agwa.name/projects/git-crypt

        2. GitHub repository
           https://github.com/AGWA/git-crypt

git-crypt 0.5.0                 2015-05-30                   GIT-CRYPT(1)

[sobolevn]

Thanks! I am actually planing to write an article about git-secret, so I guess I will mentions some alternatives.

Right now it seems that these two tools are quite similar, but git-secret seems to have more commands. I will dig into it!

[nictrix]

I've been evaluating both projects and have seen these differences/similarities so far:

git-crypt has an option to export a symmetric key instead of only individual gpg keys.

git-secret you can encrypt/decrypt files with gpg commands (that means I can use the gnupg vim plugin to edit the files directly without needing to use reveal/hide).
git-crypt you can encrypt/decrypt files, but its a bit more complicated: https://github.com/AGWA/git-crypt/issues/99#issuecomment-270179200

git-secret you can set the extension of the secrets file, as I like to use .gpg to be compatible with the vim gnupg plugin.

git-crypt unlocks and locks (decrypts, encrypts) on top of the same file
git-secret reveals the plaintext file (decrypts) via a file without the secret extension
git-secret and git-crypt both leave un-encrypted files on the filesystem (something I don't like doing)

git-secret puts the entire .gnupg directory in .gitsecret/keys/
git-crypt does not add any of the .gnupg files to git

git-secret and git-crypt both handle one level of whitelisting gpg keys (no listing of gpg keys per file - i.e. some users having access to only specific files)

git-secret and git-crypt can be used on plaintext and binary files

In my opinion, without referring back to the docs, git-secret command line options are straightforward, they even give you some guardrails if you do the workflow in the wrong order.

[sobolevn]

@nictrix thanks for your awesome answer!

[aymens]

BTW git-crypt is buggy.

Happened to me to corrupt the repo by issuing a git-crypt lock then a git-crypt init on an already git-crypt inited repo..