Git-secret: Correct use of pre-commit

[colinbes]

What are the steps to reproduce this issue?

1. Add secret file and ensure it's added to .gitignore
2. Ensure clean staging area, no unmodified files
3. Add pre-commit hook for git
4. Modify a file
5. Using command line (also fails using source tree), add changed file to staging area and commit file

What happens?

Changed file is committed to git but I am left with two unstaged and modified files, one being .gitsecret/paths/mapping.cfg and the other my encrypted secret file.

What were you expecting to happen?

I was not expecting to see any unstaged and/or modified files, I expected them to be committed as well.

I am not sure what pre-commit file should look like, I can't imagine I would need to manually staged and commit secret files within the pre commit stage.

How does one get around this issue as now it's perpetual and impossible to commit them, plus having to commit twice every time wouldn't make much sense.

my pre-commit file is

#!/bin/sh
export PATH=/usr/local/bin:$PATH
echo "path $PATH"
git secret hide

[gtback]

[not a maintainer, just a user]

I don't believe git secret hide adds any files to your working tree. You would need to also git add the secret files in order for them to be committed.

Based on some limited testing I did (and something similar I tried to do a long time ago), I don't think it will work even then, because I don't think you can call git add from within a pre-commit hook; git calculates the files that are going to be committed before calling any hooks, and doesn't update its information after the hook.

Furthermore, I'd say it's a bad idea to blindly re-hide files on every commit. It should be an explicit decision when you've changed the files or added/removed users from the keyring.

[colinbes]

git secret hides encrypts specified secret files and adds .secret to extension and are in working tree - this way you can commit and save the secret file in repo - at least that's my thinking.

I agree with you on your comment about blindly hiding files and think I am rather going to have my pre-commit hook check for changes and abort commit if it detects any - that way I am still kinda in control except for not being able to commit a file unless I hide file which has changed.

BTW, I did add two git add lines

git add .gitsecret/paths/mapping.cfg
git add src/*.secret

to my pre-commit file and it appears to work fine (which I didn't expect) but don't like hiding each time - guess I could detect change and only hide when change is detected but think I am rather going with idea of warning that change has been detected and leaving decision to hide as manual process.

Thanks for your input and helping me get off this horse!

[gtback]

I recently discovered git secret changes, which I use to great effect when reviewing PRs that include the changed files. You might be able to hack together a pre-commit hook script that checks the output of that and errors if there are changes between the decrypted and encrypted versions of the secret file (it looks like by default git secret changes will always return a 0 exit code unless there were decryption errors).

[joshrabinowitz]

@colinbes I'm pretty sure you're not supposed to put .gitsecret/paths/mapping.cfg in your .gitignore file -- See https://git-secret.io/git-secret , which indicates all files in .gitsecret should be checked in except .gitsecret/keys/random_seed

[colinbes]

@joshrabinowitz only .gitsecret/keys/random_seed is in my .gitignore file. Problem I was having is that on running git secret hide both the secret file (expected) and the mapping file are changed and need to be added and committed back to repository - To me, this appears that you then need to call git add on files you expect to change in your pre-commit file else they won't be staged and thus not committed.

Would be good to know if assumptions are correct as I have still to find an example pre-commit file for use with git secret.

Currently my pre-commit looks like:

#!/bin/sh
export PATH=/usr/local/bin:$PATH
git secret hide
git add .gitsecret/paths/mapping.cfg
git add src/*.secret

[joshrabinowitz]

@colinbes

Thanks for following this through! This issue has gone through a few iterations of setups, so for clarity, can you explain in one comment
how you set up your git-secret repo, the contents of your pre-commit.sh file, the steps you took to get your problem, and what you expected to happen instead?

Also please use git-secret's -v options (or the SECRETS_VERBOSE env var set to 1) so you get more detailed output from git-secret and gnupg. Additionally, can you let us know what version of git-secret you're using?

Please give enough specific details so I can replicate the issue on my machine here and I should be able to help you work through this!

[colinbes]

my pre-commit file is as above and included below for ease. Originally I didn't include the git add .gitsecret/paths/mapping.cfg and git add src/*.secret lines as wasn't expecting to and am still not sure if this is correct or not as I couldn't find any good examples of pre-commit for git-secret.

With file below it is working and would appreciate comment if this is correct.

#!/bin/sh
export PATH=/usr/local/bin:$PATH
git secret hide
git add .gitsecret/paths/mapping.cfg
git add src/*.secret

[joshrabinowitz]

@colinbes , OK I looked into this using git 2.20.1, and git-secret 0.2.6.

As far as I can tell (Edit: and as @gtback says above on 7/8), altering files to be committed in the pre-commit hook doesn't work because git decides which files have changed and need to be committed when you run git commit, but _before_ the pre-commit hook is run.

Therefore if the pre-commit hooks causes git-secret to change mapping.cfg and any .secret files (or any other files that were unaltered since the previous commit), those changes won't be recognized as needing commits until the _next_ run of git commit.

In my testing, even repeating the git add lines in the pre-commit hook (like you show) didn't cause the changed files to be immediately committed after the pre-commit hook was run.

Please let me know if this agrees with your understanding and what you're observing, or if you have more questions. Alternately if this explains what you're seeing, feel free to close this ticket. Thanks again.

[colinbes]

pre-commit shown below works for me, I am not sure why I need to add the mapping.cfg, but if I call git add after git security hide in pre-commit file then it does commit the *.secret and mapping file.

#!/bin/sh
export PATH=/usr/local/bin:$PATH
echo "encrypting files"
git secret hide
git add .gitsecret/paths/mapping.cfg
git add src/*.secret

[joshrabinowitz]

Interesting, thanks for the follow up @colinbes . What version of git are you using?

[joshrabinowitz]

Also, the mapping.cfg file gets changed because it holds a hash of the secret file contents.

[colinbes]

I am using git version 2.19.1

[phlegx]

@colinbes Hi there!

Did you ever find out why you need the git add? For me I have the same situation when I change a encrypted file and the execute git secret hide, i need to re-add the .secret file and the mapping.cfg

[colinbes]

I haven't to be honest, I just stuck with what worked for me