remove git-crypt from a repository

[kalbasit]

Now that keybase unvailed encrypted Git, I'm going to move my private repos from Github to Keybase. How can I decrypt the history of an entire repository? I have tried several git filter-branch commands without success, here's what I've tried so far:

• git filter-branch --index-filter "git rm -rf .gitattributes .git-crypt; git update-index --really-refresh" --prune-empty -f
• git filter-branch --index-filter "git rm -rf .gitattributes .git-crypt" --prune-empty -f
• git filter-branch --index-filter "git reset HEAD && git rm -rf .gitattributes .git-crypt && git add -A ." --prune-empty -f

[varac]

Please document this, I'm also wondering how to properly remove git-crypt from a repo.

[kalbasit]

@AGWA any ideas on how to remove git-crypt from a repository?

[eqyiel]

I was able to do it like this. You have commit the plain text version (something to be aware of if you're migrating to something like transcrypt), but you can squash that out before you push.

1. Unlock the repository, rename existing files:

$ for i in "common/secrets.nix" "secrets/credentials/AWS_CONFIG_FILE" "secrets/credentials/AWS_SHARED_CREDENTIALS_FILE" "secrets/store/deployments.json"; do mv "${i}-tmp" "${i}"; done
$ rm .gitattributes
$ git add -A
$ git commit -m "Remove git-crypt"

2. Delete the .git-crypt directory in the root of your repo:

$ rm -rf .git-crypt
$ git add -A
$ git commit -m "Remove git-crypt" 

3. Delete the git-crypt stuff in your .git/config, also delete .git/git-crypt.

You now have plain text files in your repo.

4. If you're using transcrypt, set it up now and commit the encrypted files. Then squash the last 3 commits into one (git rebase -i, git merge --squash, ...).

[kalbasit]

@eqyiel that will only give you the files, as they existed in the last commit, in clear text. If you now do git log -p, all previously encrypted files in the previous commits will show up as gibberish, do you see this?

[eqyiel]

@kalbasit yeah, that will not give you the history in clear text. I'm not sure how to do that. 😢

[fullofcaffeine]

It'd be awesome to have an automated way of disabling git-crypt whilst decrypting the whole history.

[Jomik]

Sounds really tough to get history reencrypted again if that is what you want? You normally do not want to change history :-1:

[joeashcraft]

@kalbasit did you ever find a way to get the history in clear text when removing 'git-crypt'?

My use case: moving a git-crypt'd subdirectory of a repo over to its own repo (to then be a submodule) without git-crypt

[kalbasit]

@joeashcraft Unfortunately no. I ended up tossing the history and moving the code at the latest master I had to Keybase.

[mrlesmithjr]

I've just come across this issue and it's really a-shame that there is not any information on how decrypt permanently while maintaining history.

[Edik-Mkoyan-Vineti]

@mrlesmithjr that is true, but encrypting a repo is something i can't understand.

[marcopaganini]

This is a bit of an old thread, but I managed to create a procedure to remove git-crypt from a repo and maintain the entire history: https://gist.github.com/marcopaganini/62fc51a679f8985c10c3ca5d0c84031c. Maybe @AGWA would accept a humble PR creating a link to it from the docs?