<p align="center"><img src="https://www.gunnar.rs/download/gunnar.webp" alt="Gunnar" width="320"></p>
# gunnar-crypt
Encrypted repositories: the content envelope, the per-repo key ring, its members, the server's plaintext check, each person's one encryption key (opened by an SSH key, a security key's PRF or a recovery code), and the ring's wrap to members' encryption keys.
A new repository and a new person's key are quantum-safe by default: the key ring is
wrapped only to age's hybrid ML-KEM-768 + X25519 recipients (`age1pq1…`). Classic
X25519 is the visible opt-out (`Members::at(Level::Classic)`), and a members file without
a `level` line stays classic. Feature `pq` carries the quantum-safe key and ring (native
and wasm32), `wrap` adds the SSH unlock method.
Part of [Gunnar](https://www.gunnar.rs), a git server and git client. Source:
<https://www.gunnar.rs/repo/gunnar/gunnar>.
License: AGPL-3.0-only, or a commercial licence granted jointly by Ignalina ApS and
Vetra Automation AB (gunnar@gunnar.rs).