Module unlock 

git-xcrypt unlock — make a cloned repository readable again.

This is the command PRD US-01 is about: the code is on the new machine, the secrets are not, and one key file has to turn ciphertext in the working tree back into the bytes that were committed.

Three properties shape the implementation.

The registration comes before the decryption. .git/config is not versioned, so a clone has no driver; and the * filter=git-xcrypt line in .gitattributes is only there if whoever set the repository up committed that file. Both are repaired here, because git treats a missing attribute and an undefined driver identically — as no filter. Decrypting first would leave a window in which the working tree holds plaintext and git has no filter, where git status reports every secret as modified and the next git add stores it in the clear.

A wrong key changes nothing at all. Every encrypted file is inspected — 38 bytes each, no decryption — before a single byte is written, and before the key is even installed. Discovering the mismatch on the fourth file out of ten would leave a working tree that is half readable and a repository holding a key that does not belong to it. The limit of that promise is worth naming: the check can only object to a key it has evidence against, so a working tree with no encrypted file in it accepts any key. That case gets a warning rather than a refusal, because proving it would mean scanning history, which is status’s job in S-06.

Interrupting it is survivable. The files are converted in place, one at a time, so a run cut short leaves some plain and some not. That is recoverable only because each file says what it is in its own header: a second unlock skips what is already plain and finishes the rest. Working from the object database instead would have been no safer and would have missed every file that is not committed yet.

Which files get decrypted is decided by the header, not by .git-xcrypt — the same rule the smudge path follows, and for the same reason. It is also what makes the result byte-identical to a checkout, which is what git status being clean afterwards actually proves.

Structs

Report

What unlock did.

Enums

KeySource

Where the key comes from, when one is offered at all.

Functions

run

Unlocks repo, optionally installing the key at key_source first.