gitencryptiongit-lfsgit-filtergit-crypt

How to encrypt a file and store it on LFS?


I know how to encrypt a file on my repository, via git-crypt:

echo "*.crypt.* filter=git-crypt diff=git-crypt" > .gitattributes
echo "supersecret info" > somethingTo.crypt.txt
git add .gitattributes somethingTo.crypt.txt
git crypt status   # somethingTo.crypt.txt results encrypted
git commit
git push

and I know how to store a file with git-lfs (on a self-hosted GitLab; LFS enabled in the project settings):

git lfs track somethingTo.crypt.txt
git add .gitattributes    # updated LFS rule for tracked file
git commit
git push

... but, how does one use them both on the same file?


Even if .gitattributes has the git-filter for encrypting before the filter for storing on LFS, the file doesn't get encrypted (git crypt status | grep somethingTo reports "not encrypted"). All the other *.crypt.* files that are not tracked by LFS get encrypted correctly.

I guess that the issue is with my somethingTo.crypt.txt now being just a reference object in the repository, instead of the actual (encrypted) file. But I would expect (thanks to the git-filters) that the file gets filtered/encrypted before being pushed to the LFS Store.


Are the two filter extension compatible with each other? How do I make them work together?


Solution

  • Composing filters you get to do yourself. You'll have to make your own combined filter (and whatever other attributes those mods install) that has the effect you want, git doesn't know how to make third-part hooks cooperate with each other,

    Even if .gitattributes has the git-filter for encrypting before the filter for storing on LFS, the file doesn't get encrypted

    that would be because attributes don't accumulate, they overwrite. You get one value for each attribute, the one specified in the last match. If you want a filter that combines the effect of two third-party tools, you have to write a filter that combines the effect of those two third-party tools.