Encrypted repositories

In an encrypted repository, file contents are encrypted on your computer before they're pushed. Zaryn stores and serves them, but has no key to read them. Only the devices of people you've given access can. Encryption is for **private** repositories, and you turn it on per repository. Public repositories stay unencrypted, so everyone can read them. ## What is and isn't encrypted | Encrypted (only your devices can read it) | Not encrypted (Zaryn can see it) | |---|---| | the contents of every file | file and folder names | | | commit messages, authors and dates | | | each file's size | Because Zaryn can't read the contents, features that look inside files (code search, security scans, weight diffs) don't work on encrypted repositories. ## Turn it on Encryption has to be turned on before anything is pushed, on a new, empty private repository: ```bash zev new # choose "private" zev encrypt on zev encrypt recovery # make a recovery code zev push ``` `zev encrypt recovery` shows a recovery code **once**. Write it down or put it in a password manager. If you lose every device that has the key and don't have this code, nobody, including Zaryn, can recover the files. ## Give teammates access Add the person as a collaborator on Zaryn. Then, on their computer, they register their device: ```bash zev clone you/project # or, inside an existing copy: zev encrypt unlock ``` and you (or anyone who already has the key) share it with their device: ```bash zev encrypt share ``` From then on their `zev pull` and `zev push` encrypt and decrypt by themselves. ## Read it on the website The website can show encrypted files too, but only in a browser you approve. In Settings → Encryption on this browser, your browser shows a fingerprint. Approve it from a device that has the key: ```bash zev encrypt approve ABCD-1234-EF56-7890 ``` The browser keeps its key in your browser's storage and decrypts files on your screen. Zaryn's server still never sees them. ## When someone leaves, or a device is lost Remove the person or the device on Zaryn, then make a new key for everything pushed from now on: ```bash zev encrypt rotate ``` Devices that still belong get the new key automatically. ## A new computer ```bash zev clone you/project ``` If a teammate is around, they run `zev encrypt share`. On your own, use your recovery code: ```bash zev encrypt unlock --recovery XXXX-XXXX-… ``` ## Commands | Command | What it does | |---|---| | `zev encrypt status` | whether this repository is encrypted, and which devices have the key | | `zev encrypt on` | encrypt this repository (private, nothing pushed yet) | | `zev encrypt recovery` | make a recovery code (shown once) | | `zev encrypt share` | give the key to members' devices that don't have it yet | | `zev encrypt unlock [--recovery <code>]` | get the key onto this device | | `zev encrypt approve <fingerprint>` | let one of your browsers read encrypted repositories | | `zev encrypt rotate` | a new key from now on, after someone leaves or a device is lost (owner only) |