Merging branches with smudge filter

Merging branches with smudge filter

[Leonardo]

Hi, everybody. I'm new to git and I'd like to keep track of some codes
we have here in our company. They have some sensitive information I
would like to keep private. After some googling, I found some
solutions that encrypt/decrypt the files using filters as they're
committed/checked out. I've been using this approach and it suits my
needs. Now I need to merge two branches, but the process is failing
for two files in particular. First of all, here's my config file:

[filter "openssl"]
    clean = openssl enc -aes-256-cbc -a -nosalt -pass pass:password
    smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass pass:password
    required

For these two files I mentioned, decryption fails. Then I did this:

    smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass
pass:password || tee -a /out.txt

Based on the output, it seems like the input data is corrupted, but I
don't get it. These files are regular source code like any other file.
I can also check out both branches individually, so I'm assuming the
stored blob is fine. Every other file is perfectly merged. What should
I do?

Thank you.

Re: Merging branches with smudge filter

[Junio C Hamano]

Leonardo <leobasilio@gmail.com> writes:

> Hi, everybody. I'm new to git and I'd like to keep track of some codes
> we have here in our company. They have some sensitive information I
> would like to keep private. After some googling, I found some
> solutions that encrypt/decrypt the files using filters as they're
> committed/checked out. I've been using this approach and it suits my
> needs. Now I need to merge two branches, but the process is failing
> for two files in particular. First of all, here's my config file:
>
> [filter "openssl"]
>     clean = openssl enc -aes-256-cbc -a -nosalt -pass pass:password
>     smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass pass:password
>     required

Git works on the "clean" representation of the data, i.e. the
representation of the blob object stored in the object database and
in the index, when manipulating the contents, e.g. diffing two
variants, patching (think "add -p"), merging, etc.

As you are making the "clean" version an encrypted opaque sequence
of bytes, it is expected that you wouldn't be able to run 3-way
merges.

Re: Merging branches with smudge filter

[Leonardo]

Hi. I understand what you mean, but if that's the case, I don't get
how every file was merged successfully despite the encryption, except
two of them. I thought the smudge filter was supposed to be applied to
every blob before any git operation, thus exposing the clean source
code. Well, in the end I've merged these two files manually. I think I
might have done something wrong while branching. I'm still learning.
Next time I'll be more attentive.

2016-02-08 15:32 GMT-02:00 Junio C Hamano <gitster@pobox.com>:
> Leonardo <leobasilio@gmail.com> writes:
>
>> Hi, everybody. I'm new to git and I'd like to keep track of some codes
>> we have here in our company. They have some sensitive information I
>> would like to keep private. After some googling, I found some
>> solutions that encrypt/decrypt the files using filters as they're
>> committed/checked out. I've been using this approach and it suits my
>> needs. Now I need to merge two branches, but the process is failing
>> for two files in particular. First of all, here's my config file:
>>
>> [filter "openssl"]
>>     clean = openssl enc -aes-256-cbc -a -nosalt -pass pass:password
>>     smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass pass:password
>>     required
>
> Git works on the "clean" representation of the data, i.e. the
> representation of the blob object stored in the object database and
> in the index, when manipulating the contents, e.g. diffing two
> variants, patching (think "add -p"), merging, etc.
>
> As you are making the "clean" version an encrypted opaque sequence
> of bytes, it is expected that you wouldn't be able to run 3-way
> merges.

Re: Merging branches with smudge filter

[Michael J Gruber]

[Please bottom-reply on this list]
Leonardo venit, vidit, dixit 08.02.2016 18:52:
> Hi. I understand what you mean, but if that's the case, I don't get
> how every file was merged successfully despite the encryption, except
> two of them. I thought the smudge filter was supposed to be applied to
> every blob before any git operation, thus exposing the clean source
> code. Well, in the end I've merged these two files manually. I think I
> might have done something wrong while branching. I'm still learning.
> Next time I'll be more attentive.

Simple rule with filters:
"cleaned" is what is stored in the repo (as blobs)
"smudged" is what you see in your files in the working tree

Now, if Git is asked to merge two revisions and some blobs were not
changed at all, or only by one side of the merge, these parts of the
merge can be resolved trivially.

The others can't. You may want to try merge tools, or even a custom
merge driver (see git-merge man page).

Michael

> 2016-02-08 15:32 GMT-02:00 Junio C Hamano <gitster@pobox.com>:
>> Leonardo <leobasilio@gmail.com> writes:
>>
>>> Hi, everybody. I'm new to git and I'd like to keep track of some codes
>>> we have here in our company. They have some sensitive information I
>>> would like to keep private. After some googling, I found some
>>> solutions that encrypt/decrypt the files using filters as they're
>>> committed/checked out. I've been using this approach and it suits my
>>> needs. Now I need to merge two branches, but the process is failing
>>> for two files in particular. First of all, here's my config file:
>>>
>>> [filter "openssl"]
>>>     clean = openssl enc -aes-256-cbc -a -nosalt -pass pass:password
>>>     smudge = openssl enc -d -aes-256-cbc -a -nosalt -pass pass:password
>>>     required
>>
>> Git works on the "clean" representation of the data, i.e. the
>> representation of the blob object stored in the object database and
>> in the index, when manipulating the contents, e.g. diffing two
>> variants, patching (think "add -p"), merging, etc.
>>
>> As you are making the "clean" version an encrypted opaque sequence
>> of bytes, it is expected that you wouldn't be able to run 3-way
>> merges.