Git Integration

Smudge / clean filters

Configure Git to automatically encrypt files on commit and decrypt on checkout:

# .gitattributes
*.secret filter=enprot diff=enprot merge=enprot

# .git/config
[filter "enprot"]
    clean = enprot smudge --word SECRET
    smudge = enprot clean --word SECRET

[diff "enprot"]
    textconv = enprot inspect --format json

[merge "enprot"]
    name = EPT-aware merge driver
    driver = enprot merge --ours %O --theirs %A --base %P

With this configuration:

• On commit (clean): enprot encrypts BEGIN/END segments in the file before Git stores it
• On checkout (smudge): enprot decrypts ENCRYPTED segments so you see plaintext in your working directory
• On diff: Git shows the parsed tree structure (not ciphertext), making diffs readable
• On merge: enprot resolves conflicts at the WORD/segment level, not the line level

Why merges work

EPT segments are independent — each BEGIN/END or ENCRYPTED block is self-contained. Two branches that modify different WORDs can merge without conflict. Even when both branches modify the same WORD, the merge driver compares the plaintext (decrypted with the shared key), not the ciphertext.

For deterministic AEAD (aes-256-gcm-det), identical plaintext produces identical ciphertext. This means:

• Two branches adding the same secret → no merge conflict (identical ciphertext)
• Renames and moves work without re-encryption
• CAS dedup works across branches and history

Pre-commit hook

#!/bin/sh
# .git/hooks/pre-commit
# Verify all EPT blocks have valid hashes/signatures before commit
enprot verify $(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(rs|py|sh|yaml|md)$')
if [ $? -ne 0 ]; then
  echo "EPT verification failed. Fix integrity errors before committing."
  exit 1
fi

CI pipeline

# .github/workflows/verify.yml
- name: Verify EPT integrity
  run: enprot verify --strict **/*.secret