Function is_never_encrypted 

pub fn is_never_encrypted(path: &[u8]) -> bool

Paths that are never encrypted, whatever the patterns say.

They are needed to bootstrap: git reads .gitattributes to know to call us at all, we read .git-xcrypt to know what to do, and the envelope directory must stay readable to whoever holds a recipient key. Public because the check-in path consults it before anything else, including before refusing on a missing .git-xcrypt — otherwise a user who deleted the file could not commit its replacement.

Compared with ASCII case folded, like everything else here — see [MATCHING], and note that this one is not a free consequence of that decision. On a case-insensitive filesystem .GITATTRIBUTES is the attributes file, so encrypting it would replace the catch-all line with ciphertext and turn the filter off for every file in the repository, not for one. On a case-sensitive filesystem the fold costs the opposite: a file deliberately named secrets/.GITATTRIBUTES stays in the clear. Folding is the direction taken because the rendered .gitattributes lines fold too, and a filter that encrypted a path those lines put git’s defaults back on would leave ciphertext without -text — the shape measured destroying a 2 MB file at checkout. Recorded in README.md §Known limitations.