The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use git-crypt to keep selected configuration files encrypted in Git, then let Jenkins retrieve an unlock key from its Credentials system only during the build or deployment stage that needs plaintext. Commit the correct .gitattributes rules before adding secrets, use a protected agent, unlock briefly, run the job, and clean up. This protects file contents—not repository metadata or every plaintext copy created by a build.
How git-crypt fits a Jenkins pipeline
git-crypt installs Git clean and smudge filters. Files matching rules in .gitattributes are encrypted when stored in the Git object database and transparently decrypted for an authorized working tree. Developers and CI jobs can continue using normal Git commands after the repository is unlocked.
Jenkins still needs ordinary SCM authentication to clone the repository. Use an HTTPS username/password credential for an HTTPS remote or an SSH private-key credential for an SSH remote. The git-crypt unlock material is a separate secret and should have the narrowest possible scope.
Prepare the repository before Jenkins uses it
Install the required tools
Install git-crypt and GnuPG on the Jenkins agent image, or expose them through the tool installation used by the job. The agent must also have Git and the shell or Windows tooling required by your pipeline.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Define encrypted paths first
In a clean local clone, initialize git-crypt and commit the attributes file before any sensitive file is staged:
git-crypt init
cat >> .gitattributes <<'EOF'
secrets/** filter=git-crypt diff=git-crypt
*.env filter=git-crypt diff=git-crypt
*.key filter=git-crypt diff=git-crypt
.gitattributes !filter !diff
EOF
git add .gitattributes
git commit -m "Define encrypted configuration paths"The .gitattributes file must remain readable so Git can apply the filters. Do not encrypt .gitattributes, .gitignore, or .gitmodules. A pattern such as dir/* does not cover deeper directories; use dir/** when the whole subtree is intended.
Choose how Jenkins receives the repository key
| Mode | Provisioning | Jenkins requirement | Operational trade-off |
|---|---|---|---|
| GPG recipients | git-crypt add-gpg-user CI_JENKINS_KEY_ID stores a GPG-encrypted copy of the repository key under .git-crypt. |
The agent must have the corresponding private GPG key and a usable GPG keyring; after checkout, run git-crypt unlock. |
Supports named collaborators and alternative keys for separating access to different file sets, but private-key provisioning and agent keyring management are required. |
| Symmetric key | Export once with git-crypt export-key /secure/path/git-crypt.key, then transfer that file through a separately protected channel. |
Store the exported file as a Jenkins Secret file credential and run git-crypt unlock /path/to/key. |
Simple for a dedicated CI consumer, but anyone who obtains the key can unlock every file protected by that repository key. |
Keep recovery copies of keys outside the Git repository and document who can restore them. Replacing a Jenkins credential limits future use of that credential; it cannot make already leaked values or previously accessible Git history secret again.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Configure checkout and unlock in Jenkins
Checkout the repository
Use the Pipeline Git step for a basic checkout. Use checkout scmGit(...) when you need tags, a specific revision, refspecs, or other advanced options. This example uses an SSH remote and a credential named scm-deploy-key:
Recommended Free Tools
pipeline {
agent { label 'linux-gitcrypt' }
stages {
stage('Checkout') {
steps {
checkout scmGit(
branches: [[name: '*/main']],
userRemoteConfigs: [[
url: 'ssh://git@example.com/platform/app-config.git',
credentialsId: 'scm-deploy-key'
]]
)
}
}
stage('Build and deploy') {
steps {
withCredentials([file(credentialsId: 'git-crypt-key', variable: 'GITCRYPT_KEY')]) {
sh '''
set +x
git-crypt unlock "$GITCRYPT_KEY"
./ci/build-and-deploy.sh
git-crypt lock || true
rm -f "$GITCRYPT_KEY"
'''
}
}
}
}
}Limit the plaintext window
Bind the git-crypt credential only around the stage that requires decrypted files. Keep shell tracing disabled while the key path or secret values are in use. The exact withCredentials binding syntax varies by credential type and agent operating system, so verify the generated path, file permissions, and cleanup behavior on the target node.
Jenkins warns that secret files placed in browsable workspaces can be exposed. On agents that support it, use a protected temporary directory outside the workspace, restrict its permissions, and avoid running unrelated jobs on the same multi-executor node while the key is bound. Jenkins removes credential bindings at the end of the block, but explicit cleanup and workspace hygiene are still required.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Validate encryption before trusting the job
- Run
git-crypt statusin an authorized clone and confirm every intended path is listed with the expected filter. - Inspect the repository from a clone that has no unlock key. Protected files should be unreadable ciphertext while
.gitattributesremains readable. - Create a fresh authorized clone, run the appropriate
git-crypt unlockcommand, and verify that the build can read the required files. - Test an unauthorized clone and confirm it cannot recover plaintext.
- Review build artifacts, logs, caches, archived workspaces, and deployment outputs for accidental copies of decrypted data.
These checks should be part of onboarding and recovery exercises, not just the first pipeline run.
git-crypt versus Jenkins Credentials
| Comparison axis | git-crypt | Jenkins Credentials |
|---|---|---|
| Location of truth | Encrypted file contents and their revisions live in Git history. | Values live on the Jenkins controller or an integrated external secret store. |
| Versioning | Configuration changes can be reviewed and rolled back as encrypted Git commits. | Credential values are not versioned as file contents in Git. |
| Access model | GPG recipients, symmetric-key possession, and repository membership govern access. | Folder, item, and credential-ID permissions govern which jobs can request a value. |
| Revocation and rotation | Historical access cannot be revoked; rotate secrets when a key or plaintext value may have leaked. | You can replace or disable a credential for future builds, but an already leaked value remains compromised. |
| Metadata exposure | File names, commit messages, symlink targets, gitlinks, file lengths, and whether files changed remain visible; encrypted files also do not compress normally. | Controller encryption protects stored values, but access to the controller filesystem, backups, workspaces, or running executors can still expose them. |
| Recovery | Repository backups are insufficient without separately preserved unlock keys and a documented restore procedure. | Protect $JENKINS_HOME/secrets, controller backups, and any external secret-store recovery material. |
git-crypt depends on repository integrity. An attacker who can alter .gitattributes or the checkout process may undermine the filtering assumptions, and some third-party Git GUI clients may leave files unencrypted.
Common failure modes and fixes
A secret was committed before the attributes rule
That earlier Git object remains unencrypted even after you add .gitattributes. Use the project’s status and history-rewrite remediation workflow, then rotate the exposed secret. Treat every clone, mirror, cache, and backup containing the old object as potentially readable.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Nested files were missed
dir/* matches entries immediately below dir but not files in deeper subdirectories. Change the rule to dir/**, commit it, and verify the result with git-crypt status.
Filter configuration was encrypted
If .gitattributes, .gitignore, or .gitmodules is encrypted, Git may not be able to apply filters or initialize submodules correctly. Keep these control files plaintext.
Locking did not erase every plaintext copy
git-crypt lock relocks tracked files in the working tree; it does not erase files copied into build directories, logs, caches, artifacts, container layers, or backups. Add explicit cleanup and retention controls for those locations.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
A credential file was visible to another build
Do not bind a secret file in a browsable workspace or share an agent workspace between unrelated jobs. Use isolated workspaces, restrictive permissions, protected temporary storage, and the smallest practical executor concurrency.
Jenkins hardening checklist
- Grant the pipeline only the SCM credential and git-crypt credential it needs.
- Restrict access to
$JENKINS_HOME/secretsand protect controller and workspace backups. - Never commit Jenkins private keys, exported git-crypt keys, or plaintext deployment secrets to source control.
- Disable shell tracing around credential use and review console logs for accidental disclosure.
- Destroy temporary key files and decrypted workspaces after the stage completes.
- Separate build agents by trust level and avoid untrusted pull-request jobs on nodes that can unlock production secrets.
- Document key custody, rotation triggers, and restoration steps independently of the repository.
Version context
The AGWA/git-crypt project recorded release 0.8.0 on September 23, 2025. Verify that the version packaged in your agent image supports the commands and behaviors used by your pipeline.
The Bottom Line
For versioned encrypted configuration, git-crypt and Jenkins work well together when the repository rules are committed first, unlock material is scoped to one stage, and agents, workspaces, backups, and key recovery are treated as part of the security boundary.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
