Module keyfile 

Reading and writing the repository key on disk.

Two shapes, both holding the same 32-byte master key — never a cipher key, so a future suite cannot strand either of them:

• the binary file in .git/git-xcrypt/keys/, which the tool reads on every filter run and no human ever looks at;
• the portable text file encode_portable produces, which is what export-key writes and unlock reads. It is text so it survives a password manager, an email body and a copy-paste, and it names its key_id in the clear so a user can tell two exports apart without decrypting anything.

Both carry their own magic and version, independent of the data format’s, because the three evolve for different reasons.

Functions

decode_portable

Parses the portable text form.

encode_portable

Renders key in the portable text form export-key writes.

holds_a_key

Whether content is one of this tool’s key files, in either shape.

read

Reads the key stored at path.

read_portable

Reads a key from a portable file.

write

Writes key to path, creating parent directories.

write_owner_only

Creates path with owner-only permissions and writes contents.

write_portable

Writes key to path in the portable form, owner-only.