git-secret-hide - encrypts all added files with repo keyring.
git secret hide [-c] [-F] [-P] [-v] [-d] [-m]
git-secret-hide - writes an encrypted version of each file added by
Then anyone enabled via
git secret tell can decrypt these files.
Under the hood,
git-secret uses the keyring of public keys in
.gitsecret/keys to encrypt files,
encrypted versions are typically called
Later permitted users can use their secret key (typically from their home directory) to decrypt files.
It is recommended to encrypt (or re-encrypt) all the files in a
git-secret repo each
git secret hide is run.
Otherwise the keyring (the one stored in
may have changed since the last time the files were encrypted, and it’s possible
to create a state where the users in the output of
git secret whoknows
may not be able to decrypt the some files in the repo, or may be able decrypt files
they’re not supposed to be able to.
In other words, unless you re-encrypt all the files in a repo each time you
it’s possible to make it so some files can no longer be decrypted by users who should be
(and would appear) able to decrypt them, and vice-versa.
If you know what you are doing and wish
to encrypt or re-encrypt only a subset of the files
even after reading the above paragraphs, you can use the
-F option forces
git secret hide to skip any hidden files
where the unencrypted versions aren’t present.
-m option skips any hidden files that have
not be been modified since the last time they were encrypted.
-v - verbose, shows extra information. -c - deletes encrypted files before creating new ones. -F - forces hide to continue if a file to encrypt is missing. -P - preserve permissions of unencrypted file in encrypted file. -d - deletes unencrypted files after encryption. -m - encrypt files only when modified. -h - shows help.
SECRETS_GPG_COMMANDchanges the default
gpgcommand to anything else
SECRETS_GPG_ARMORis a boolean to enable
--armormode to store secrets in text format over binary
SECRETS_DIRchanges the default
.gitsecret/folder to another name as documented at git-secret(7)
SECRETS_EXTENSIONchanges the default
SECRETS_VERBOSEchanges the output verbosity as documented at git-secret(7)
gpg --pinentrymode as documented at git-secret(7)
man git-secret-hide to see this document.