I'm trying out age[1] as a filter for encrypting files in a git
repo but I must be missing something because every new clone
thinks the encrypted file has changed, and if I commit that change
then every other clone sees a diff after pulling in the change.
The main reason I want to try out age is that it can make use of
SSH keys for encryption, which makes it a bit nicer than something
like git-crypt.
I'm setting it up like this:
---------------------------------------------
❯ cat .gitattributes
*.secret filter=age
❯ git config -l --local|grep filter.age
filter.age.smudge=age --decrypt -i ~/.ssh/id_ed25519 -
filter.age.clean=age --encrypt -R ~/.ssh/id_ed25519.pub -
---------------------------------------------
Here's a sequence setting up a first repo:
---------------------------------------------
❯ git init
Initialized empty Git repository in /home/user/tmp/age-0/.git/
❯ echo '*.secret filter=age' > .gitattributes
❯ git config --local --add filter.age.smudge "age --decrypt -i
~/.ssh/id_ed25519 -"
❯ git config --local --add filter.age.clean "age --encrypt -R
~/.ssh/id_ed25519.pub -"
❯ echo "a secret" > foo.secret
❯ echo "not a secret" > bar.txt
❯ git add .gitattributes bar.txt foo.secret
❯ git commit -m 'The first commit'
[main (root-commit) ae75577] The first commit
3 files changed, 2 insertions(+)
create mode 100644 .gitattributes
create mode 100644 bar.txt
create mode 100644 foo.secret
---------------------------------------------
Now I can make a clone:
---------------------------------------------
❯ cd ..
❯ git clone age-0 age-1
Cloning into 'age-1'...
done.
❯ cd age-1
❯ git ls-files
.gitattributes
bar.txt
foo.secret
❯ cat foo.secret
age-encryption.org/v1
-> ssh-ed25519 ozAWLA ReSnu8CTgPgnuKUMvG8PWTcc7Lr5IHkKaWc6k4Hfsms
dHsdERPHdsdOQluzyeeRamfjIrmsc2pQ+lhwLlt/0no
--- aHijNp3L2/0MeE/EXWwVhVwyv1uBYW1Ake055jico5M
WF}`YqBO7Ԏwߨ%
---------------------------------------------
So far so good. The file is encrypted. Now I configure the filter
the same way and make sure the file is decrypted:
---------------------------------------------
❯ git config --local --add filter.age.smudge "age --decrypt -i
~/.ssh/id_ed25519 -"
age-1 on main
❯ git config --local --add filter.age.clean "age --encrypt -R
~/.ssh/id_ed25519.pub -"
❯ rm foo.secret
❯ git reset --hard HEAD
HEAD is now at ae75577 The first commit
❯ cat foo.secret
a secret
---------------------------------------------
Now comes the problem, git thinks the file with secrets has been
changed when it really hasn't:
---------------------------------------------
❯ git status
On branch main
Your branch is up to date with 'origin/main'.
Changes not staged for commit:
(use "git add <file>..." to update what will be committed)
(use "git restore <file>..." to discard changes in working
directory)
modified: foo.secret
no changes added to commit (use "git add" and/or "git commit -a")
❯ git diff
diff --git a/foo.secret b/foo.secret
index 2de33ca..18e4331 100644
Binary files a/foo.secret and b/foo.secret differ
❯ md5sum foo.secret ../age-0/foo.secret
6046316bf834dbdf83a5be74be6fd2ac foo.secret
6046316bf834dbdf83a5be74be6fd2ac ../age-0/foo.secret
---------------------------------------------
This isn't what I expected. What's wrong with my setup, what am I
missing?
/M
[1]: https://github.com/FiloSottile/age
--
Magnus Therning OpenPGP: 0x927912051716CE39
email: mag...@therning.org
@magthe@mastodon.technology http://magnus.therning.org/
"He dropped his voice still lower. In the stillness, a fly would
not
have dared clear its throat."
--
You received this message because you are subscribed to the Google Groups "Git for
human beings" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to git-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/git-users/87cz24zo6b.fsf%40therning.org.
