diff --git a/NEWS b/NEWS index 9a4081e..b48b47a 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,21 @@ +v0.4 (2014-11-16) + (See RELEASE_NOTES-0.4.md for important details.) + * Add optional GPG support: GPG can be used to share the repository + between one or more users in lieu of sharing a secret key. + * New workflow: the symmetric key is now stored inside the .git + directory. Although backwards compatibility has been preserved + with repositories created by old versions of git-crypt, the + commands for setting up a repository have changed. See the + release notes file for details. + * Multiple key support: it's now possible to encrypt different parts + of a repository with different keys. + * Initial 'git-crypt status' command to report which files are + encrypted and to fix problems that are detected. + * Numerous usability, documentation, and error reporting improvements. + * Major internal code improvements that will make future development + easier. + * Initial experimental Windows support. + v0.3 (2013-04-05) * Fix 'git-crypt init' on newer versions of Git. Previously, encrypted files were not being automatically decrypted after diff --git a/NEWS.md b/NEWS.md index ce434e7..1746721 100644 --- a/NEWS.md +++ b/NEWS.md @@ -1,6 +1,24 @@ News ==== +######v0.4 (2014-11-16) +(See [the release notes](RELEASE_NOTES-0.4.md) for important details.) +* Add optional GPG support: GPG can be used to share the repository + between one or more users in lieu of sharing a secret key. +* New workflow: the symmetric key is now stored inside the .git + directory. Although backwards compatibility has been preserved + with repositories created by old versions of git-crypt, the + commands for setting up a repository have changed. See the + release notes file for details. +* Multiple key support: it's now possible to encrypt different parts + of a repository with different keys. +* Initial `git-crypt status` command to report which files are + encrypted and to fix problems that are detected. +* Numerous usability, documentation, and error reporting improvements. +* Major internal code improvements that will make future development + easier. +* Initial experimental Windows support. + ######v0.3 (2013-04-05) * Fix `git-crypt init` on newer versions of Git. Previously, encrypted files were not being automatically decrypted after running diff --git a/README b/README index 297f855..41936da 100644 --- a/README +++ b/README @@ -66,18 +66,13 @@ encryption and decryption happen transparently. CURRENT STATUS -The latest version of git-crypt is 0.3, released on 2013-04-05. +The latest version of git-crypt is 0.4, released on 2014-11-16. git-crypt aims to be bug-free and reliable, meaning it shouldn't crash, malfunction, or expose your confidential data. However, it has not yet reached maturity, meaning it is not as documented, featureful, or easy-to-use as it should be. Additionally, there may be backwards-incompatible changes introduced before version 1.0. -Development on git-crypt is currently focused on improving the user -experience, especially around setting up repositories. There are also -plans to add additional key management schemes, such as passphrase-derived -keys and keys encrypted with PGP. - SECURITY diff --git a/README.md b/README.md index 7a4db96..3a6c082 100644 --- a/README.md +++ b/README.md @@ -67,19 +67,14 @@ encryption and decryption happen transparently. Current Status -------------- -The latest version of git-crypt is [0.3](NEWS.md), released on -2013-04-05. git-crypt aims to be bug-free and reliable, meaning it +The latest version of git-crypt is [0.4](RELEASE_NOTES-0.4.md), released on +2014-11-16. git-crypt aims to be bug-free and reliable, meaning it shouldn't crash, malfunction, or expose your confidential data. However, it has not yet reached maturity, meaning it is not as documented, featureful, or easy-to-use as it should be. Additionally, there may be backwards-incompatible changes introduced before version 1.0. -Development on git-crypt is currently focused on improving the user -experience, especially around setting up repositories. There are also -plans to add additional key management schemes, such as -passphrase-derived keys and keys encrypted with PGP. - Security -------- diff --git a/RELEASE_NOTES-0.4.md b/RELEASE_NOTES-0.4.md new file mode 100644 index 0000000..41e2634 --- /dev/null +++ b/RELEASE_NOTES-0.4.md @@ -0,0 +1,84 @@ +Changes to be aware of for git-crypt 0.4 +======================================== + +(For a complete list of changes, see the [NEWS](NEWS.md) file.) + + +### New workflow + +The commands for setting up a repository have changed in git-crypt 0.4. +The previous commands continue to work, but will be removed in a future +release of git-crypt. Please get in the habit of using the new syntax: + +`git-crypt init` no longer takes an argument, and is now used only when +initializing a repository for the very first time. It generates a key +and stores it in the `.git` directory. There is no longer a separate +`keygen` step, and you no longer need to keep a copy of the key outside +the repository. + +`git-crypt init` is no longer used to decrypt a cloned repository. Instead, +run `git-crypt unlock /path/to/keyfile`, where `keyfile` is obtained by +running `git-crypt export-key /path/to/keyfile` from an already-decrypted +repository. + + +### GPG mode + +git-crypt now supports GPG. A repository can be shared with one or more +GPG users in lieu of sharing a secret symmetric key. Symmetric key support +isn't going away, but the workflow of GPG mode is extremely easy and all users +are encouraged to consider it for their repositories. + +See the [README](README.md) for details on using GPG. + + +### Status command + +A new command, `git-crypt status`, lists encrypted files, which is +useful for making sure your `.gitattributes` pattern is protecting the +right files. + + +### Multiple key support + +git-crypt now lets you encrypt different sets of files with different +keys, which is useful if you want to grant different collaborators access +to different sets of files. + +See [doc/multiple_keys.md](doc/multiple_keys.md) for details. + + +### Compatibility with old repositories + +Repositories created with older versions of git-crypt continue to work +without any changes needed, and backwards compatibility with these +repositories will be maintained indefinitely. + +However, you will not be able to take advantage of git-crypt's new +features, such as GPG support, unless you migrate your repository. + +To migrate your repository, first ensure the working tree is clean. +Then migrate your current key file and use the migrated key to unlock +your repository as follows: + + git-crypt migrate-key /path/to/old_key /path/to/migrated_key + git-crypt unlock /path/to/migrated_key + +Once you've confirmed that your repository is functional, you can delete +both the old and migrated key files (though keeping a backup of your key +is always a good idea). + + +### Known issues + +It is not yet possible to revoke access from a GPG user. This will +require substantial development work and will be a major focus of future +git-crypt development. + +The output of `git-crypt status` is currently very bare-bones and will +be substantially improved in a future release. Do not rely on its output +being stable. A future release of git-crypt will provide an option for stable +machine-readable output. + +On Windows, git-crypt does not create key files with restrictive +permissions. Take care when using git-crypt on a multi-user Windows system.