Expand description
git-xcrypt export-key — hand the repository key to the user, once.
This is the command that gives a key away, so it is the shortest route to a leak in the whole product. PRD FR-007 says as much: “one run inside CI, or one redirect into the repository directory, is all it takes”. Two refusals close the routes that do not need a compromised machine:
- a destination inside the working tree is refused outright, because that is
one
git add -Aaway from a commit; - an existing file is refused unless
--force, so a mistyped path cannot silently destroy someone’s backup of a different key.
The key reaches stdout only when --stdout asks for it, and the flag
exists for the one workflow the file form cannot serve: piping the key
straight into a secret store (| pbcopy, | gh secret set …) without it
ever touching the disk. A terminal was refused there between 2026-08-06 and
2026-08-11, and is now warned about instead — the owner’s call, on the
grounds that typing --stdout is the consent. The cost is unchanged and
measured, so the warning names it: a key printed to a terminal stays in the
scrollback, in the multiplexer’s buffer and in any session log, none of which
this process can reach afterwards. What the flag cannot police at all is a
shell redirect: --stdout > secrets/key.txt writes where the refusals above
would have said no, because a process cannot portably learn the path behind
its own file descriptor. Said out loud in the command’s own warning and in
the README, because it is the FR-007 leak with the guard rail removed by
hand.
The file itself is written owner-only and atomically, by the same code that writes the repository’s own key.
Structs§
- Exported
- What
--stdouthanded over, and whether the destination keeps a copy. - Report
- What
export-keywrote, so the binary can say so without naming the key.
Constants§
- SCROLLBACK_
WARNING - What the caller prints when the key landed in a terminal.