Skip to content

Instantly share code, notes, and snippets.

@turboBasic

turboBasic/Use-symmetric-key-to-encrypt-repository.md

Last active October 31, 2024 15:14
Show Gist options
  • Save turboBasic/29d00adf652aa0a8a582478c95cd566a to your computer and use it in GitHub Desktop.
Save turboBasic/29d00adf652aa0a8a582478c95cd566a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. turboBasic revised this gist Nov 28, 2018. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions Use-symmetric-key-to-encrypt-repository.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,8 +7,8 @@ Requirements
    1. [GnuPG](https://www.gnupg.org) aka "gpg"
    2. [git-crypt](https://github.com/AGWA/git-crypt)

    > you may totally ignore complicated gpg manuals, but you must understand how git-crypt is working.
    > gpg 2.2+ uses AES256 by default, so your secrets are fully depend on the passphrase you are going to use
    > you may totally ignore complicated gpg manuals, but you must understand how `git-crypt` operates. <br/>
    > `gpg` 2.2+ uses AES256 by default, so your secrets are fully depend on the passphrase you are going to use.
    Prepare repository for encryption
    ---------------------------------
  2. turboBasic revised this gist Nov 28, 2018. 1 changed file with 4 additions and 2 deletions.
    6 changes: 4 additions & 2 deletions Use-symmetric-key-to-encrypt-repository.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,12 +1,14 @@
    Use symmetric key kept in the repo to encrypt the repo
    ======================================================
    Use git-crypt & symmetric key kept inside a repo to encrypt some files in the repository
    ========================================================================================

    Requirements
    ------------

    1. [GnuPG](https://www.gnupg.org) aka "gpg"
    2. [git-crypt](https://github.com/AGWA/git-crypt)

    > you may totally ignore complicated gpg manuals, but you must understand how git-crypt is working.
    > gpg 2.2+ uses AES256 by default, so your secrets are fully depend on the passphrase you are going to use
    Prepare repository for encryption
    ---------------------------------
  3. turboBasic revised this gist Nov 28, 2018. No changes.
  4. turboBasic renamed this gist Nov 28, 2018. 1 changed file with 0 additions and 0 deletions.
    0 README.md → Use-symmetric-key-to-encrypt-repository.md
    View file
    File renamed without changes.
  5. turboBasic revised this gist Nov 28, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -19,7 +19,7 @@ Prepare repository for encryption
    mkdir encrypted-repo && cd encrypted-repo
    git init && git-crypt init
    curl --user GITHUB_NAME https://api.github.com/user/repos --data '{ "name": "encrypted-repo" }' && \
    git remote add origin https://github.com/GITHUB_NAME/my-encrypted-repo.git
    git remote add origin https://github.com/GITHUB_NAME/encrypted-repo.git
    ```

    ### Encrypt just generated key using GPG and your super-password, save it as `local.key.asc`
  6. turboBasic revised this gist Nov 28, 2018. 1 changed file with 4 additions and 6 deletions.
    10 changes: 4 additions & 6 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -16,11 +16,10 @@ Prepare repository for encryption
    ### Create repository & initialize encryption with git-crypt
    ```bash
    mkdir my-encrypted-repo
    cd my-encrypted-repo
    mkdir encrypted-repo && cd encrypted-repo
    git init && git-crypt init
    curl --user YOUR_GITHUB_NAME https://api.github.com/user/repos --data '{"name":"my-encrypted-repo"}' && \
    git remote add origin https://github.com/YOUR_GITHUB_NAME/my-encrypted-repo.git
    curl --user GITHUB_NAME https://api.github.com/user/repos --data '{ "name": "encrypted-repo" }' && \
    git remote add origin https://github.com/GITHUB_NAME/my-encrypted-repo.git
    ```

    ### Encrypt just generated key using GPG and your super-password, save it as `local.key.asc`
    @@ -57,8 +56,7 @@ Decrypt repository in the new location

    ### Clone & enter repo
    ```bash
    git clone https://github.com/you/your-repo.git
    cd your-repo
    git clone https://github.com/GITHUB_NAME/encrypted-repo.git && cd encrypted-repo
    ```

    ### Decrypt key by GPG and decrypt repo with it
  7. turboBasic revised this gist Nov 28, 2018. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -11,7 +11,7 @@ Requirements
    Prepare repository for encryption
    ---------------------------------

    > :skull::skull::skull:
    > :skull::skull::skull: <br/>
    > ¡ instructions are intentionally provided for empty repository, otherwise it cannot be guaranteed that files you are going to encrypt haven't been leaked to the repo in previous commits !
    ### Create repository & initialize encryption with git-crypt
    @@ -48,8 +48,8 @@ Usage
    Follow your usual git workflow, git-crypt will take care of transparent encryption of selected files.
    When you need the new file to be encrypted, add it to `.gitattributes` as stated in [Add files which need to be encrypted to `.gitattributes`](#add-files-which-need-to-be-encrypted-to-gitattributes).

    > :skull::skull::skull:
    > ¡¡¡ Do it before adding with `git add` otherwise non-encrypted file will be committed & pushed to the Internet !!! **
    > :skull::skull::skull: <br/>
    > ¡¡¡ Do it before adding with `git add` otherwise non-encrypted file will be committed & pushed to the Internet !!!

    Decrypt repository in the new location
  8. turboBasic revised this gist Nov 28, 2018. 1 changed file with 4 additions and 2 deletions.
    6 changes: 4 additions & 2 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -11,7 +11,8 @@ Requirements
    Prepare repository for encryption
    ---------------------------------

    > :skull::skull::skull: ¡ instructions are intentionally provided for empty repository, otherwise it cannot be guaranteed that files you are going to encrypt haven't been leaked to the repo in previous commits !
    > :skull::skull::skull:
    > ¡ instructions are intentionally provided for empty repository, otherwise it cannot be guaranteed that files you are going to encrypt haven't been leaked to the repo in previous commits !
    ### Create repository & initialize encryption with git-crypt
    ```bash
    @@ -47,7 +48,8 @@ Usage
    Follow your usual git workflow, git-crypt will take care of transparent encryption of selected files.
    When you need the new file to be encrypted, add it to `.gitattributes` as stated in [Add files which need to be encrypted to `.gitattributes`](#add-files-which-need-to-be-encrypted-to-gitattributes).

    > ** :skull::skull::skull: ¡¡¡ Do it before adding with `git add` otherwise non-encrypted file will be committed & pushed to the Internet !!! **
    > :skull::skull::skull:
    > ¡¡¡ Do it before adding with `git add` otherwise non-encrypted file will be committed & pushed to the Internet !!! **

    Decrypt repository in the new location
  9. turboBasic revised this gist Nov 28, 2018. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -4,7 +4,7 @@ Use symmetric key kept in the repo to encrypt the repo
    Requirements
    ------------

    1. [GnuPG](https://www.gnupg.org) aka `gpg`
    1. [GnuPG](https://www.gnupg.org) aka "gpg"
    2. [git-crypt](https://github.com/AGWA/git-crypt)


    @@ -18,8 +18,8 @@ Prepare repository for encryption
    mkdir my-encrypted-repo
    cd my-encrypted-repo
    git init && git-crypt init
    curl --user YOUR_GITHUB_USER_NAME https://api.github.com/user/repos --data '{"name":"my-encrypted-repo"}' && \
    git remote add origin https://github.com/YOUR_GITHUB_USER_NAME/my-encrypted-repo.git
    curl --user YOUR_GITHUB_NAME https://api.github.com/user/repos --data '{"name":"my-encrypted-repo"}' && \
    git remote add origin https://github.com/YOUR_GITHUB_NAME/my-encrypted-repo.git
    ```

    ### Encrypt just generated key using GPG and your super-password, save it as `local.key.asc`
  10. turboBasic revised this gist Nov 28, 2018. 1 changed file with 4 additions and 2 deletions.
    6 changes: 4 additions & 2 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -11,7 +11,7 @@ Requirements
    Prepare repository for encryption
    ---------------------------------

    > ¡ :skull: instructions are intentionally provided for empty repository, otherwise it cannot be guaranteed that files you are going to encrypt haven't been leaked to the repo in previous commits !
    > :skull::skull::skull: ¡ instructions are intentionally provided for empty repository, otherwise it cannot be guaranteed that files you are going to encrypt haven't been leaked to the repo in previous commits !
    ### Create repository & initialize encryption with git-crypt
    ```bash
    @@ -45,7 +45,9 @@ Usage
    -----

    Follow your usual git workflow, git-crypt will take care of transparent encryption of selected files.
    When you need the new file to be encrypted, add it to `.gitattributes` as stated in [Add files which need to be encrypted to `.gitattributes`](#add-files-which-need-to-be-encrypted-to-gitattributes). ** :skull: Do it before adding with `git add` otherwise non-encrypted file will be committed & pushed to the Internet **
    When you need the new file to be encrypted, add it to `.gitattributes` as stated in [Add files which need to be encrypted to `.gitattributes`](#add-files-which-need-to-be-encrypted-to-gitattributes).

    > ** :skull::skull::skull: ¡¡¡ Do it before adding with `git add` otherwise non-encrypted file will be committed & pushed to the Internet !!! **

    Decrypt repository in the new location
  11. turboBasic revised this gist Nov 28, 2018. 1 changed file with 39 additions and 30 deletions.
    69 changes: 39 additions & 30 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,56 +1,65 @@
    Use symmetric key to encrypt repository
    =======================================
    Use symmetric key kept in the repo to encrypt the repo
    ======================================================

    Encrypt using symmetric key and keep the key in the repository
    --------------------------------------------------------------
    Requirements
    ------------

    1. Initialize git-crypt in the repository
    ```bash
    cd repo
    git-crypt init
    ```
    1. [GnuPG](https://www.gnupg.org) aka `gpg`
    2. [git-crypt](https://github.com/AGWA/git-crypt)


    Prepare repository for encryption
    ---------------------------------

    2. Add files which need to be encrypted to `.gitattributes`
    > ¡ :skull: instructions are intentionally provided for empty repository, otherwise it cannot be guaranteed that files you are going to encrypt haven't been leaked to the repo in previous commits !
    ### Create repository & initialize encryption with git-crypt
    ```bash
    echo "secretfile1.txt filter=git-crypt diff=git-crypt" >> .gitattributes
    echo "secretfile2.txt filter=git-crypt diff=git-crypt" >> .gitattributes
    mkdir my-encrypted-repo
    cd my-encrypted-repo
    git init && git-crypt init
    curl --user YOUR_GITHUB_USER_NAME https://api.github.com/user/repos --data '{"name":"my-encrypted-repo"}' && \
    git remote add origin https://github.com/YOUR_GITHUB_USER_NAME/my-encrypted-repo.git
    ```

    3. Add `local.key` to `.gitignore` to avoid pushing unencrypted key
    ### Encrypt just generated key using GPG and your super-password, save it as `local.key.asc`
    ```bash
    echo local.key >> .gitignore
    git-crypt export-key -- - | gpg --symmetric --armor --output local.key.asc
    ```

    4. Commit `.gitattributes` and `.gitignore`
    ### Add files which need to be encrypted to `.gitattributes`
    ```bash
    git add .gitattributes .gitignore
    git commit -m "Config: git-crypt settings"
    echo "secretfile filter=git-crypt diff=git-crypt" >> .gitattributes
    echo "secretfile2 filter=git-crypt diff=git-crypt" >> .gitattributes
    ```

    5. Encrypt repo using `git-crypt` & encrypt git-crypt's key using GPG and your secret well-known password
    ### Commit encrypted key, `.gitattributes` and `.gitignore`, set upsream tracking reference
    ```bash
    git-crypt export-key local.key
    gpg --symmetric --armor local.key
    rm local.key
    git add local.key.asc
    git commit -m "Config: add symmetric encryption key"
    git add local.key.asc .gitattributes .gitignore
    git commit --message="Config: git-crypt settings"
    git push --set-upstream origin master
    ```


    Decrypt repository on a new location
    Usage
    -----

    Follow your usual git workflow, git-crypt will take care of transparent encryption of selected files.
    When you need the new file to be encrypted, add it to `.gitattributes` as stated in [Add files which need to be encrypted to `.gitattributes`](#add-files-which-need-to-be-encrypted-to-gitattributes). ** :skull: Do it before adding with `git add` otherwise non-encrypted file will be committed & pushed to the Internet **


    Decrypt repository in the new location
    ------------------------------------

    1. Clone & enter repo
    ### Clone & enter repo
    ```bash
    git clone https://github.com/you/your-repo.git
    cd your-repo
    ```

    2. Decrypt key by GPG and decrypt repo by it
    ### Decrypt key by GPG and decrypt repo with it
    ```bash
    gpg --decrypt local.key.asc > local.key
    git-crypt unlock local.key
    rm local.key
    gpg --decrypt local.key.asc | git-crypt unlock -
    ```

    3. You are done :sunglasses: !
    ### You are done :sunglasses: :beers: !
  12. turboBasic revised this gist Nov 26, 2018. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -10,7 +10,7 @@ cd repo
    git-crypt init
    ```

    2. Add files which need to be encrypted to .gitattributes
    2. Add files which need to be encrypted to `.gitattributes`
    ```bash
    echo "secretfile1.txt filter=git-crypt diff=git-crypt" >> .gitattributes
    echo "secretfile2.txt filter=git-crypt diff=git-crypt" >> .gitattributes
    @@ -27,7 +27,7 @@ git add .gitattributes .gitignore
    git commit -m "Config: git-crypt settings"
    ```

    5. Encrypt repo using git-crypt & encrypt git-crypt's key using GPG and your secret well-known password
    5. Encrypt repo using `git-crypt` & encrypt git-crypt's key using GPG and your secret well-known password
    ```bash
    git-crypt export-key local.key
    gpg --symmetric --armor local.key
    @@ -40,7 +40,7 @@ git commit -m "Config: add symmetric encryption key"
    Decrypt repository on a new location
    ------------------------------------

    1. Clone & enter
    1. Clone & enter repo
    ```bash
    git clone https://github.com/you/your-repo.git
    cd your-repo
  13. turboBasic revised this gist Nov 26, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -27,7 +27,7 @@ git add .gitattributes .gitignore
    git commit -m "Config: git-crypt settings"
    ```

    5. Encrypt repo using git-crypt & encrypt they key using GPG and your password
    5. Encrypt repo using git-crypt & encrypt git-crypt's key using GPG and your secret well-known password
    ```bash
    git-crypt export-key local.key
    gpg --symmetric --armor local.key
  14. turboBasic revised this gist Nov 26, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -53,4 +53,4 @@ git-crypt unlock local.key
    rm local.key
    ```

    3. You are done :smile: !
    3. You are done :sunglasses: !
  15. turboBasic revised this gist Nov 26, 2018. 1 changed file with 26 additions and 4 deletions.
    30 changes: 26 additions & 4 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -4,31 +4,53 @@ Use symmetric key to encrypt repository
    Encrypt using symmetric key and keep the key in the repository
    --------------------------------------------------------------

    1. `cd repo; git-crypt init`
    1. Initialize git-crypt in the repository
    ```bash
    cd repo
    git-crypt init
    ```

    2. Add files which need to be encrypted to .gitattributes
    ```bash
    echo "secretfile1.txt filter=git-crypt diff=git-crypt" >> .gitattributes
    echo "secretfile2.txt filter=git-crypt diff=git-crypt" >> .gitattributes
    ```

    3. Add `local.key` to .gitignore
    3. Add `local.key` to `.gitignore` to avoid pushing unencrypted key
    ```bash
    echo local.key >> .gitignore
    ```

    4. Commit .gitattributes and .gitignore
    4. Commit `.gitattributes` and `.gitignore`
    ```bash
    git add .gitattributes .gitignore
    git commit -m "Config: git-crypt settings"
    ```

    5. Encrypt repo using git-crypt & encrypt they key using GPG and your password
    ```bash
    git-crypt init
    git-crypt export-key local.key
    gpg --symmetric --armor local.key
    rm local.key
    git add local.key.asc
    git commit -m "Config: add symmetric encryption key"
    ```


    Decrypt repository on a new location
    ------------------------------------

    1. Clone & enter
    ```bash
    git clone https://github.com/you/your-repo.git
    cd your-repo
    ```

    2. Decrypt key by GPG and decrypt repo by it
    ```bash
    gpg --decrypt local.key.asc > local.key
    git-crypt unlock local.key
    rm local.key
    ```

    3. You are done :smile: !
  16. turboBasic created this gist Nov 26, 2018.
    34 changes: 34 additions & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,34 @@
    Use symmetric key to encrypt repository
    =======================================

    Encrypt using symmetric key and keep the key in the repository
    --------------------------------------------------------------

    1. `cd repo; git-crypt init`

    2. Add files which need to be encrypted to .gitattributes
    ```bash
    echo "secretfile1.txt filter=git-crypt diff=git-crypt" >> .gitattributes
    echo "secretfile2.txt filter=git-crypt diff=git-crypt" >> .gitattributes
    ```

    3. Add `local.key` to .gitignore
    ```bash
    echo local.key >> .gitignore
    ```

    4. Commit .gitattributes and .gitignore
    ```bash
    git add .gitattributes .gitignore
    git commit -m "Config: git-crypt settings"
    ```

    5. Encrypt repo using git-crypt & encrypt they key using GPG and your password
    ```bash
    git-crypt init
    git-crypt export-key local.key
    gpg --symmetric --armor local.key
    rm local.key
    git add local.key.asc
    git commit -m "Config: add symmetric encryption key"
    ```