Elasticdog Transcrypt Versions Save

transparently encrypt files within a git repository

v2.2.3

1 year ago

Properly fixes a bug introduced in 2.2.1 that could cause errors like fatal: filename: smudge filter crypt failed and/or the message warning: command substitution: ignored null byte in input when decrypting some files, as reported in issue #158.

The fix required removing a feature that automatically fixed faulty encrypted files that with double-salting due to incompatibility with LibreSSL 3+. If you have problems decrypting some files where the decrypted version has binary junk at the top, open an issue at https://github.com/elasticdog/transcrypt/issues/ for help.

Feature summary

Fixed

  • Revert faulty automatic fix for mistakenly double-salted encrypted files, which caused more problems than it solved by preventing decryption of some files on some systems #158

Changed

  • The hexdump command is no longer required by Transcrypt.

Steps to Upgrade

To upgrade transcrypt it is not enough to have a newer version on your system, you must also run the --upgrade command in each repository:

  1. Check the version of transcrypt on your system:

    $ transcrypt --version
    
  2. Check the version of transcrypt in your Git repository, which may be different:

    $ .git/crypt/transcrypt --version
    
  3. Upgrade the version of transcrypt in your Git repository:

    $ transcrypt --upgrade
    

v2.2.2

1 year ago

Fixes bug introduced in 2.2.1 that could cause errors like fatal: filename: smudge filter crypt failed and/or the message warning: command substitution: ignored null byte in input when decrypting some files, as reported in issue #158.

Feature summary

Changed

  • The hexdump command is now required by Transcrypt. It will be installed already on many systems, or comes with the bsdmainutils package on Ubuntu/Debian that was already required to get the column command.

Fixed

  • Avoid null byte warnings when decrypting certain files, caused by a work- around in 2.2.1 to repair files that could have been incorrectly encrypted with 2.2.0 due to issue #147

Steps to Upgrade

To upgrade transcrypt it is not enough to have a newer version on your system, you must also run the --upgrade command in each repository:

  1. Check the version of transcrypt on your system:

    $ transcrypt --version
    
  2. Check the version of transcrypt in your Git repository, which may be different:

    $ .git/crypt/transcrypt --version
    
  3. Upgrade the version of transcrypt in your Git repository:

    $ transcrypt --upgrade
    

v2.2.1

1 year ago

This release fixes a bug introduced in version 2.2.0 that made transcrypt incompatible with the LibreSSL version 3 and later, which particularly affected users on MacOS 13 "Ventura" which shipped with the LibreSSL project's binary version 3.3.6.

Feature summary

Fixed

  • Compatibility fix for LibreSSL versions 3 (and above) especially for MacOS 13 Ventura, to more carefully apply a work-around required for OpenSSL 3+ that isn't required for LibreSSL 3+ (#147 #133)

Steps to Upgrade

To upgrade transcrypt it is not enough to have a newer version on your system, you must also run the --upgrade command in each repository:

  1. Check the version of transcrypt on your system:

    $ transcrypt --version
    
  2. Check the version of transcrypt in your Git repository, which may be different:

    $ .git/crypt/transcrypt --version
    
  3. Upgrade the version of transcrypt in your Git repository:

    $ transcrypt --upgrade
    

v2.2.0

1 year ago

This release includes compatibility with OpenSSL 3, installs a single script into the Git crypt/ directory instead of multiple, adds the option --set-openssl-path to use a specific version of openssl, and a number of other tweaks and fixes.

Steps to upgrade

  1. Make sure you are running the latest version of transcrypt:

    $ transcrypt --version
    
  2. Upgrade a repository:

    $ transcrypt --upgrade
    

Feature summary

Added

  • Add --set-openssl-path option to configure transcrypt to use a specific openssl version instead of the default version found in $PATH. This will be most useful to macOS users who might want to use a newer version of OpenSSL. This option can be used on init, on upgrade, or by itself.
  • Add support for an optional transcrypt.crypt-dir setting for advanced users to override the path of the .git/crypt/ directory to permit things like installing transcrypt in a repository on a device without execute permissions (#104)

Changed

  • No longer need stand-alone scripts for git operations clean, smudge, textconv, and merge in the repository's crypt/ directory; the single consolidated transcrypt script is stored there instead.

Fixed

  • Remain compatible with OpenSSL versions 3 and above which changes the way explicit salt values are expressed in ciphertext, requires xxd command (#133)
  • Ensure Git index is up-to-date before checking for dirty repo, to avoid failures seen in CI systems where the repo seems dirty when it isn't. (#37)
  • Respect Git core.hooksPath setting when installing the pre-commit hook. (#104)
  • Zsh completion. (#107)
  • Fix salt generation for partial (patch) commits (#118)
  • Improve command hint to fix secret files not encrypted in index (#120)
  • Fix handling of files with null in first 8 bytes (#116)

v2.1.0

3 years ago

This release includes features to make it easier and safer to use transcrypt, in particular: fix merge of encrypted files with conflicts, preventing accidental commit of plain text files by incompatible Git tools, and upgrade easily with --upgrade.

Steps to upgrade

  1. Make sure you are running the latest version of transcrypt:

    $ transcrypt --version
    
  2. Upgrade a repository:

    $ transcrypt --upgrade
    
  3. Enable the merge handling fix by adding merge=crypt to the end of each transcrypt pattern in .gitattribute, to look like this:

    sensitive_file  filter=crypt diff=crypt merge=crypt
    

New features

  • Add --upgrade command to apply the latest transcrypt scripts in an already configured repository without the need to re-apply existing settings.
  • Install a Git pre-commit hook to reject accidental commit of unencrypted plain text version of sensitive files, which could otherwise happen if a tool does not respect the .gitattribute filters Transcrypt needs to do its job.

Fixed

  • Fix handling of branch merges with conflicts in encrypted files, which would previously leave the user to manually merge files with a mix of encrypted and unencrypted content. (#69, #8, #23, #67)
  • Remove any cached unencrypted files from Git's object database when credentials are removed from a repository with a flush or uninstall, so sensitive file data does not remain accessible in a surprising way. (#74)
  • Fix handling of sensitive files with non-ASCII file names, such as extended Unicode characters. (#78)
  • transcrypt --version and --help commands now work when run outside a Git repository. (#68)
  • The --list command now works in a repository that has not yet been init-ed.

Changed

  • Add a functional test suite built on bats-core.
  • Apply Continuous Integration: run functional tests with GitHub Actions.
  • Fix EditorConfig file config for Markdown files.
  • Add CHANGELOG.md file to make it easier to find notes about project changes (see also Release)

v2.0.0

4 years ago

*** WARNING: Re-encryption will be required when updating to version 2.0.0! ***

This is not a security issue, but the result of a bug fix to ensure that the salt generation is consistent across all operating systems. Once someone on your team updates to version 2.0.0, it will manifest as the encrypted files in your repository showing as changed. You should ensure that all users upgrade at the same time...since transcrypt itself is small, it may make sense to commit the script directly into your repo to maintain consistency moving forward.

Steps to Re-encrypt

After you've upgraded to v2.0.0...

  1. Display the current config so you can reference the command to re-initialize things:

    $ transcrypt --display
    The current repository was configured using transcrypt version 1.1.0
    and has the following configuration:
    
      GIT_WORK_TREE:  /home/elasticdog/src/transcrypt
      GIT_DIR:        /home/elasticdog/src/transcrypt/.git
      GIT_ATTRIBUTES: /home/elasticdog/src/transcrypt/.gitattributes
    
      CIPHER:   aes-256-cbc
      PASSWORD: correct horse battery staple
    
    Copy and paste the following command to initialize a cloned repository:
    
      transcrypt -c aes-256-cbc -p 'correct horse battery staple'
    
  2. Flush the credentials and re-configure the repo with the same settings as above:

    $ transcrypt --flush-credentials
    $ transcrypt -c aes-256-cbc -p 'correct horse battery staple'
    
  3. Now that all of the appropriate files have been re-encrypted, add them and commit the changes:

    $ git add -- $(transcrypt --list)
    $ git commit --message="Re-encrypt files protected by transcrypt using new salt value"
    

Changelog

Fixed

  • Force the use of macOS's system sed binary to prevent errors (#50)
  • Fix cross-platform compatibility by making salt generation logic consistent (#57)

Changed

v1.1.0

5 years ago

Fixed

  • Fix broken cipher validation safety check when running with OpenSSL v1.1.0+. (#48)

v1.0.3

6 years ago

Fixed

  • Explicitly set digest hash function to match default settings before OpenSSL v1.1.0. (#41)

v1.0.2

6 years ago

Fixed

  • Ensure realpath function does not incorrectly return the current directory for certain inputs. (#38)

v1.0.1

7 years ago

Fixed

  • Correct the behavior of mktemp when running on OS X versions 10.10 Yosemite and earlier.
  • Prevent unexpected error output when running transcrypt outside of a Git repository.