Using git-crypt to Transmit Sensitive Data on the Git Client

About git-crypt

git-crypt is a third-party open-source software that can transparently encrypt and decrypt files in the Git repository. The git-crypt command can be used to encrypt and store specified files and file types. Developers can store encrypted files (e.g. confidential information or sensitive data) in the same repository as shareable code, and the repository can be pulled and pushed just like a normal repository, with the contents of the encrypted files visible only to those who have the corresponding file key, but with no restriction on participants' ability to read or write to unencrypted files.

Using Key Pairs for Encryption and Decryption on Windows

1. Download and install the latest Git client for Windows, download the latest git-crypt for Windows, and save the downloaded .exe file to the cmd folder in the Git installation directory.
2. Run the following commands to generate a key pair locally:
   1. Open Git Bash and go to the local repository.
   2. Run the following command to create the .git-crypt folder in the Git repository. The folder contains the key and configuration file required for encrypting the file.

      git-crypt init
   3. Run the following command to export the key file to the C:/test directory and name the file KeyFile:

      git-crypt export-key /c/test/keyfile
   4. After the preceding steps are performed, you can go to the path of the exported key file to check whether the key is successfully generated. The computer containing the key file can decrypt the corresponding encrypted file.

3. Run the following command to configure the encryption range for the repository:
   1. Create a file named .gitattributes in the root directory of the repository.
   2. Open the .gitattributes file and run the following command to set the encryption range.

      <file_name_or_file_range>: filter=git-crypt diff=git-crypt
      Four examples are as follows:

      FT/file01.txt filter=git-crypt diff=git-crypt  # Encrypt a specified file. In this example, the file01.txt file in the FT folder is encrypted.
      *.java filter=git-crypt diff=git-crypt  # The .java file is encrypted.
      G* filter=git-crypt diff=git-crypt   # Files which names start with G are encrypted.
      ForTest/** filter=git-crypt diff=git-crypt   # Files in the ForTest folder are encrypted.

      

   NOTE:

   • If the system prompts you to enter the file name when you create the .gitattributes file, you can enter .gitattributes. to create the file. If you run the Linux command to create the file, this problem does not occur.
   • Do not save the .gitattributes file as a .txt file. Otherwise, the configuration does not take effect.

4. Encrypt the file.

   Open Git Bash in the root directory of the repository and run the following command to encrypt the file. The encryption status of the file is displayed.

   git-crypt status

   

   After the encryption, you can still open and edit the encrypted files in plaintext in your local repository because your local repository has a key.

   You can run the add, commit, and push commands to push the repository to CodeArts Repo. In this case, the encrypted files are pushed together.

   Encrypted files are stored in CodeArts Repo as encrypted binary files and cannot be viewed directly. If you do not have a key, you cannot decrypt it even if you download it to the local computer.

   NOTE:

   git-crypt status encrypts only the files to be committed this time. It does not encrypt the historical files that are not modified this time. Git displays a message for the unencrypted files involved in this setting (see Warning in the preceding figure). If you want to encrypt all files of a specified type in the repository, run the git-crypt status -f command.

   The -f (enforce) option is risky in getting teams to work together, so use it with caution.

5. Decrypt the file.
   1. Ensure that the git-crypt file exists in the Git installation path on the local computer.

      

   2. Clone the repository from CodeArts Repo to the local host.
   3. Obtain the key file for encrypting the repository and store it on the local computer.

      

   4. Go to the repository directory and right-click Git Bash.
   5. Run the decryption command. If no command output is displayed, the command is successfully executed.

      git-crypt unlock /C/test/KeyFile # Replace /C/test/KeyFile with the actual key storage path.

Encrypting and Decrypting a File in GPG Mode on Windows

1. Install and initialize Git.
2. Download the latest Windows-based git-crypt and save the downloaded .exe file to the cmd folder in the Git installation directory. The following figure uses the default Git Bash installation path of Windows Server 2012 R2 Standard (64-bit) as an example.

   

3. Download the GPG of the latest version. When you are prompted to donate the open-source software, select 0 to skip the donation process.

   

   Double-click to start the installation. Click Next to complete the installation.

4. Generate a key pair in GPG mode.
   1. Open Git Bash and run the following command:

      GPG --gen-key
   2. Enter the name and email address as prompted.

      

   3. Enter o as prompted and press Enter. The dialog boxes for entering and confirming the password are displayed.

      

      The password can be empty. For information security, you are advised to set a new password.

   4. If the following information is displayed, the GPG key pair is generated successfully.

      

5. Initialize the repository encryption.
   1. Open Git bash in the root directory of the repository and run the following command to initialize the repository:

      git-crypt init

      

   2. Run the following command to add a copy of the key to your repository. The copy has been encrypted using your public GPG key.

      git-crypt add-GPG-user USER_ID

      USER_ID can be the name, email address, or fingerprint that uniquely identifies the key, as shown in 1, 2, and 3 in the following figure in sequence.

      

      After the command is executed, a message is displayed, indicating that the .git-crypt folder and two files in it are created.

      

6. Configure the encryption scope for the repository.
   1. Go to the .git-crypt folder in the repository.
   2. Open the .gitattributes file and run the following command to set the encryption range.

      <file_name_or_file_range>: filter=git-crypt diff=git-crypt
      Four examples are as follows:

      FT/file01.txt filter=git-crypt diff=git-crypt  # Encrypt a specified file. In this example, the file01.txt file in the FT folder is encrypted.
      *.java filter=git-crypt diff=git-crypt  # The .java file is encrypted.
      G* filter=git-crypt diff=git-crypt   # Files which names start with G are encrypted.
      ForTest/** filter=git-crypt diff=git-crypt   # Files in the ForTest folder are encrypted.

      

   3. Copy the .gitattributes file to the root directory of the repository.

7. Encrypt the file.

   Open Git Bash in the root directory of the repository and run the following command to encrypt the file. The encryption status of the file is displayed.

   git-crypt status

   

   After the encryption, you can still open and edit the encrypted files in plaintext in your local repository because your local repository has a key.

   You can run the add, commit, and push commands to push the repository to CodeArts Repo. In this case, the encrypted files are pushed together.

   Encrypted files are stored in CodeArts Repo as encrypted binary files and cannot be viewed directly. If you do not have a key, you cannot decrypt it even if you download it to the local computer.

   NOTE:

   git-crypt status encrypts only the files to be committed this time. It does not encrypt the historical files that are not modified this time. Git displays a message for the unencrypted files involved in this setting (see Warning in the preceding figure). If you want to encrypt all files of a specified type in the repository, run the git-crypt status -f command.

   In team cooperation, -f (forcible execution) has certain risks and may cause the members' work output to remain unchanged. Exercise caution when using -f.

8. Export the key.
   1. Lists the currently visible keys. You can view the name, email address, and fingerprint of each key.

      GPG --list-keys

      

   2. Run the GPG --export-secret-key command to export the keys. In this example, the GPGTest key is exported to drive C and named Key.

      GPG --export-secret-key -a GPGTest > /c/key

      During the execution, the system prompts you to enter the key password. Enter the correct password.

      No command output is displayed. You can view the key file in the corresponding directory (drive C in this example).

   3. Send the generated key to the team members to share the encrypted file.

9. Import the key and decrypt the file.
   1. To decrypt files on another machine, download and install git-crypt and GPG based on Git.
   2. Clone the corresponding repository to the local host.
   3. Obtain the key of the corresponding encrypted file. For details about how to export the key, see step 8. In this example, the obtained key is stored in drive C.
   4. Go to the repository, open Git Bash, and run the import command to import the key. You will be prompted to enter the key password during the import.

      GPG --import  /c/key
   5. Run the unlock command to decrypt the file.

      git-crypt unlock

      During the decryption, a dialog box is displayed, prompting you to enter the password of the key. If no command output is displayed after you enter the correct password, the decryption is successful.

      

10. View the file before and after decryption.

Application of git-crypt Encryption in Teamwork

In most cases, a team needs to store files that have restricted disclosure in the code repository. The combination of CodeArts Repo, Git, and git-crypt can be used to encrypt some files in the distributed open-source repository.

Generally, Key pair encryption can meet the requirements of restricting the access to some files.

When a team needs to set different confidential levels for encrypted files, the GPG encryption can be used. This encryption mode allows you to use different keys to encrypt different files in the same repository and share the keys of different confidential levels with team members, restricting file access by level.

Installing git-crypt and GPG on Linux and MacOS

Install git-crypt and GPG on Linux.

• Linux installation environment

  Software	Debian/Ubuntu Package	RHEL/CentOS Package
  Make	make	make
  A C++11 compiler (e.g. gcc 4.9+)	g++	gcc-c++
  OpenSSL development files	libssl-dev	openssl-devel

• In Linux, install git-crypt by compiling the source code.

  Download the source code.

  make
  make install

  Install git-crypt to a specified directory

  make install PREFIX=/usr/local
• In Linux, install GPG by compiling the source code.

  Download the source code.

  ./configure
  make
  make install
• Install git-crypt using the Debian package.

  Download the source code.

  The Debian package can be found in the debian branch of the project Git repository.

  The software package is built using git-buildpackage, as shown in the following figure.

  git checkout debian
  git-buildpackage -uc -us
• Install GPG using the build package in Debian.

  sudo apt-get install gnupg

Install git-crypt and GPG on macOS.

• Install git-crypt on macOS.

  Run the following command to install git-crypt using the brew package manager.

  brew install git-crypt
• Install GPG on macOS.

  Run the following command to install git-crypt using the brew package manager.

  brew install GPG