transcrypt

I understand the simplicity angle. https://github.com/elasticdog/transcrypt has been around for a long time and strikes that balance very well in my opinion. And it's just a bash script that can also be committed so the git repo is atomic.

I hesitate to append this but one option I have seen thrown around and also debated is git-crypt [1] Here [2] is a discussion on HN about git-crypt. There are many caveats to doing this as any integrations that would need to read the file contents would also need to be able to decrypt the files so this may not be entirely useful and may add many levels of complexity and fragility. In theory one could encrypt specific files and then check them into any of the cloud hosted git repositories but anything that needs to read the contents of the file will need a mechanism to decrypt them automatically. That thread also mentions transcrypt [3] If doing this I would strongly recommend also having a local non-encrypted weekly snapshot of your files in the event that nobody is able to decrypt your committed files. [1] - https://github.com/AGWA/gi

git-crypt doesn't really seem well maintained any longer. Two alternatives that I've used and like are: https://github.com/StackExchange/blackbox https://github.com/elasticdog/transcrypt

Maybe I shouldn't have mentioned Encryptr. There are fair number of open source alternatives that allow you to store secrets in the cloud: vault: https://github.com/hashicorp/vault blackbox: https://github.com/StackExchange/blackbox git-crypt: https://www.agwa.name/projects/git-crypt/ Pass: http://www.zx2c4.com/projects/password-store/ Transcrypt: https://github.com/elasticdog/transcrypt Keyringer: https://keyringer.pw/ git-secret: https://github.com/sobolevn/git-secret

If you need to do this, I would recommend looking at Transcrypt: https://github.com/elasticdog/transcrypt

StackExchange's blackbox[0] has solved this problem for me. Alternatives: * https://github.com/AGWA/git-crypt * https://github.com/shadowhand/git-encrypt * http://docs.ansible.com/ansible/playbooks_vault.html * https://github.com/elasticdog/transcrypt * http://www.passwordstore.org/ [0]: https://github.com/StackExchange/blackbox

There are a lot of alternatives in this space (I wrote transcrypt [1] for just this purpose), but I think the killer features here are that you don't need shared credentials since you can have multiple keys, and that it's generic enough to work with multiple VCS's. With transcrypt, I do the encryption/decryption transparently once a repository has been configured by utilizing Git's clean/smudge filters, but it uses OpenSSL out of the box rather than GPG. A different workflow, and there are certainly pros and cons to both ways. [1] https://github.com/elasticdog/transcrypt

That's essentially what I've automated with transcrypt (which uses Git's clean/smudge filters) to do that for you transparently: https://github.com/elasticdog/transcrypt

Another similar project that aims to do the same thing: https://github.com/elasticdog/transcrypt The readme contains an itemized comparison, though it sounds some of this actual comparison may be out of date or more specific to git-encrypt (yet another project) git-crypt does appear to use openssl libraries for example. transcrypt is just a Bash script and does not require compilation transcrypt uses OpenSSL's symmetric cipher routines rather then implementing its own crypto transcrypt does not have to remain installed after the initial repository configuration transcrypt generates a unique salt for each encrypted file transcrypt uses safety checks to avoid clobbering or duplicating configuration data transcrypt facilitates setting up additional clones as well as rekeying transcrypt adds an alias git ls-crypt to list all encrypted files