git-crypt

A Rust implementation of git-crypt for transparent encryption of files in a git repository.

Features

🔒 Transparent Encryption: Files are automatically encrypted when committed and decrypted when checked out
🛡️ AES-256-GCM: Strong authenticated encryption with tamper detection
🔧 Git Filter Integration: Seamless integration using git's clean/smudge filters
🔑 Key Management: Export and import symmetric keys for secure sharing
👥 GPG Support: Optional GPG integration for team key distribution
📦 Simple CLI: Easy-to-use command-line interface

Installation

Using cargo

cargo install --git https://github.com/AprilNEA/git-crypt-rs

With GPG support

macOS:

brew install nettle gmp
cargo install --git https://github.com/AprilNEA/git-crypt-rs --features gpg

Ubuntu/Debian:

sudo apt-get install libnettle-dev libgmp-dev
cargo install --git https://github.com/AprilNEA/git-crypt-rs --features gpg

Quick Start

# Initialize in your git repository
git-crypt init

# Configure which files to encrypt in .gitattributes
echo "*.secret filter=git-crypt diff=git-crypt" >> .gitattributes
git add .gitattributes
git commit -m "Configure git-crypt"

# Add encrypted files (automatically encrypted)
echo "my secret data" > test.secret
git add test.secret
git commit -m "Add encrypted file"

# Export key for sharing
git-crypt export-key git-crypt-key.bin

Documentation

📚 View Full Documentation (generated with cargo doc)

The complete documentation includes:

Detailed usage examples
Security considerations
Architecture overview
Complete API reference
Testing guide

Generate documentation locally:

cargo doc --no-deps --open

How It Works

git-crypt uses git's filter system to transparently encrypt and decrypt files:

Clean filter: Encrypts files when you git add
Smudge filter: Decrypts files when you git checkout
Diff filter: Shows encryption status in git diff

The encryption key is stored in .git/git-crypt/keys/default and is never committed.

Commands

init - Initialize git-crypt in the current repository
lock - Lock the repository (remove filters)
unlock [--key-file PATH] - Unlock the repository
export-key OUTPUT - Export the symmetric key to a file
import-key INPUT - Import a symmetric key from a file
add-gpg-user GPG_ID - Grant access to a GPG user (requires GPG feature)

Differences from Original git-crypt

This is a complete reimplementation with some differences:

✅ Written in Rust for memory safety and performance
✅ GPG support is optional (compile-time feature)
⚠️ Not compatible with original git-crypt (different file format)
✅ Focus on simplicity and modern Rust idioms

Development

# Run tests
cargo test

# Build with GPG support
cargo build --release --features gpg

# Generate documentation
cargo doc --no-deps --open

License

MIT OR Apache-2.0

Contributing

Contributions welcome! Please open an issue or pull request.

Note: For complete documentation, examples, and API reference, please run cargo doc --no-deps --open or visit docs.rs/git-crypt.

git-crypt 0.1.0