Module attributes 

The managed section of .gitattributes.

The section holds one static line, * filter=git-xcrypt, and the whole security guarantee rests on it. It does not depend on the contents of .git-xcrypt, so it cannot drift from it — that is the entire point of the catch-all construction.

Everything below that line is cosmetic in the sense that letting it go stale never stores a secret in the clear. It is not cosmetic in the sense of being optional: -text is what keeps git’s own CRLF conversion off the ciphertext. Git applies that conversion to the output of the clean filter, so on a path where some other rule sets text — a user’s own *.env text line is entirely ordinary — the conversion eats the CR bytes inside the ciphertext. git add still exits 0, the damaged blob is committed, and the loss only surfaces at the next checkout as a failed authentication tag, with the plaintext already gone.

So the rendered lines have to cover exactly the set of paths the filter encrypts. Neither direction is free: too narrow leaves the hole above, too broad turns line-ending conversion off for files that are not encrypted at all. The two syntaxes make that harder than it sounds — see [translate].

Structs

AttributeResolver

Answers “would git run our filter for this path, and would git convert its line endings”, the way git answers both.

Culprit

Where an attribute value came from, in terms a reader can act on.

Resolution

What git resolves for one path, on both axes the managed section sets.

StagedAttributes

A .gitattributes whose working-tree file is gone but whose staged copy git still reads on the check-in path.

Enums

DeclaredEol

The eol= value git resolved, in the only two spellings that decide anything.

EolConversion

Whether git would run its own end-of-line conversion over stored bytes.

FilterAttribute

What git resolves the filter attribute to for one path.

Rendering

Spells a pattern so it matches either case of every ASCII letter.

Constants

ACCEPTED

Every spelling of the section this build considers current.

CATCH_ALL

The line the filter actually hangs on.

Functions

attribute_files_under

Every .gitattributes in the working tree under work_tree, sorted shallowest first, ties by path.

catch_all_present

Whether the attributes file at path carries the catch-all line.

desired

What the attributes file at path should contain for extra_lines.

driver_keys

The configuration keys init writes, for status to check for completeness.

foreign_lines_touching

Lines outside the managed section that touch one of axes.

has_section

Whether contents shows any sign of a managed section.

read

Reads the attributes file at path, treating an absent one as empty.

render_lines

Renders the per-pattern lines for config.

render_lines_as_written

render_lines in whichever spelling the file already uses.

render_section

Renders the body of the managed section, LF-terminated.

render_section_with

Renders the body of the managed section with a chosen line terminator.

staged_fallbacks

The .gitattributes files git would read from the index for check-in.

upsert

Replaces the managed section in contents, or appends one.

write_section

Writes the managed section into the attributes file at path.