git-crypt

git-crypt

Use git-crypt for selected files that should remain readable in an unlocked work tree and encrypted in Git. Follow the user's chosen tool and file scope.

Task guidance

Read only the reference needed for the requested operation:

• New encryption rules, tracked plaintext, or checking stored contents:

references/setup.md.

• GPG access, symmetric-key export, or separate access groups:

references/access.md.

• Locking, unlocking, errors, or encrypted patches:

references/troubleshooting.md.

For simple explanations, the constraints below may be enough. A setup request does not imply permission to grant access, rewrite history, or force-push.

Constraints

• Configure the encryption filter and matching .gitattributes rules before

adding sensitive files to the index. Track .gitattributes; a separate earlier commit is optional. Verify encryption in the index before committing, and in the committed blob after a requested commit.

• Use dir/** for recursive rules. Keep .gitattributes, .gitignore, and

.gitmodules unencrypted.

• Keep exported repository keys and private GPG keys outside the repository.

Do not print keys or secret file contents. Sensitive application files such as .env may be committed only after their stored form is verified as encrypted.

• Encrypting current files does not remove historical plaintext. If

credentials were exposed, advise rotation or revocation; history cleanup is a separate operation. A tracked file is not, by itself, evidence of a leak.

• Access cannot be revoked from someone who already has the key. Removing a

GPG grant does not invalidate their key or access to historical ciphertext.

• Filenames and other Git metadata remain visible. Encryption reveals file

lengths and equality; repository write access can be used to disable filters.

Complete the requested operation and verify its stored result. Report staged changes as staged, and do not claim that history or remote copies were cleaned without performing and checking that work.

Upstream reference

Use the installed version's git-crypt help for options and the upstream README for tool behavior and limitations.