sealed::
git-remote-sealed $ age -d -i key.txt git-remote-sealed.1.age | man -l -
GIT-REMOTE-SEALED(1)Git ManualGIT-REMOTE-SEALED(1)

NAME

git-remote-sealed — encrypt your whole repository with age before it reaches the remote

SYNOPSIS

git remote add name sealed::url
git-remote-sealed [info | enroll | revoke | compact | upgrade | forget]

DESCRIPTION

Your repository stays normal on your machine. The remote (the "vault") stores only encrypted files. The host (GitHub, or any other git server) cannot see file contents, file names, branch names, or history.

DEMO

A 51-second demo, with captions and no audio. Watch on GitHub

EXAMPLES

# make a key pair for this device
$ age-keygen -o ~/.config/sealed-key.txt
$ cd my-secret-repo
$ git config sealed.identity ~/.config/sealed-key.txt
$ git remote add origin sealed::git@github.com:me/my-secret-repo.git
$ git push -u origin main

The first push creates the vault, encrypted to this device's key only. The vault itself remembers which keys can read it. There is nothing else to configure.

Next, add a recovery key. If you lose every key, the data is gone.

$ age-keygen -o recovery-key.txt
$ git-remote-sealed enroll age1...

COMMANDS

infoThis device's key, what it remembers about the vault, and the keys the vault is encrypted to.
enroll age1...Add a key.
revoke age1...Remove a key (--yes to remove this device's own key).
compactRewrite the vault as one snapshot. Deleted history really leaves the host here.
upgradeFor vaults made with 0.2.x.
forget --yesForget what this repository knows about a vault you re-created on purpose. Read its warning first.

ADDING A DEVICE

Keys never move between devices. Each device makes its own key, and a device that already reads the vault lets the new one in with enroll. Every other device picks up the new key list on its next fetch. Removal is not erasure: the host may still keep older copies that a removed key can read.

RECOVERY

The encrypted files are ordinary git bundles. With git, age, and your secret key, you can get the history back without this helper.

$ age -d -i key.txt 1-full.bundle.age > full.bundle
$ git clone --bare full.bundle recovered.git

INSTALL

Linux and macOS only for now. You need git and age-keygen on PATH. Prebuilt binaries cover Linux (x86_64, aarch64) and Apple Silicon. Or build it yourself:

$ cargo install --git https://github.com/hibariya/git-remote-sealed

SEE ALSO

age(1), OVERVIEW.md, FORMAT.md, DESIGN-NOTES.md, github.com/hibariya/git-remote-sealed

AUTHOR

Hibariya