# git diff vault files

**URL:** <https://forum.ansible.com/t/git-diff-vault-files/16999>\
**Category:** Ansible Project\
**Created:** [December 9, 2014, 4:26pm UTC](https://forum.ansible.com/t/git-diff-vault-files/16999 "2014-12-09T16:26:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Damjan\_Georgievski](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@Damjan\_Georgievski](https://forum.ansible.com/u/Damjan_Georgievski)\
**Post date:** [December 9, 2014, 4:26pm UTC](https://forum.ansible.com/t/git-diff-vault-files/16999/1 "2014-12-09T16:26:31Z")

</div>

Now that we started using vault files for secret data, one of the problems is that git diff on the vault files gives the whole file as changed (understandably).  
The trouble I have now is that I use git diff before I commit to double check I didn’t change something I didn’t want to.

Is there some trick that people are using to git diff encrypted files?

---

<div class="post-metadata">

**Author:** ![Toshio\_Kuratomi](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Toshio\_Kuratomi](https://forum.ansible.com/u/Toshio_Kuratomi)\
**Post date:** [December 10, 2014, 12:45am UTC](https://forum.ansible.com/t/git-diff-vault-files/16999/2 "2014-12-10T00:45:03Z")

</div>

I haven't used vault extensively so I've never had to dive into this  
before. however, I think that either filters or pointing git at an  
external diff tool which you write a short wrapper to do the  
decryption are the ways to do this. Doing some web searching I do  
notive that other people are using git's filters for similar  
transparent encryption and decryption operations. For instance:

[https://www.agwa.name/projects/git-crypt/](https://www.agwa.name/projects/git-crypt/)  
[http://stackoverflow.com/questions/11575398/how-can-i-save-my-secret-keys-and-password-securely-in-my-version-control-system](http://stackoverflow.com/questions/11575398/how-can-i-save-my-secret-keys-and-password-securely-in-my-version-control-system)

Sorry I don't have an out of the box recipe for you but it does seem  
doable with a bit of time and reading.

-Toshio

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [December 12, 2014, 12:27am UTC](https://forum.ansible.com/t/git-diff-vault-files/16999/3 "2014-12-12T00:27:57Z")

</div>

I’d consider using the new “ansible-vault view” command to view when you don’t want to edit – it’s new on the devel branch if not actually part of 1.8.

I don’t remember 🙂 … but it may help and avoid writing the script.

---

<div class="post-metadata">

**Author:** ![Damjan\_Georgievski](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@Damjan\_Georgievski](https://forum.ansible.com/u/Damjan_Georgievski)\
**Post date:** [December 12, 2014, 3:53pm UTC](https://forum.ansible.com/t/git-diff-vault-files/16999/4 "2014-12-12T15:53:44Z")

</div>

> I’d consider using the new “ansible-vault view” command to view when you don’t want to edit – it’s new on the devel branch if not actually part of 1.8.
> 
> I don’t remember 🙂 … but it may help and avoid writing the script.

“ansible-vault view” is in 1.8 yes, very helpful.  
But doesn’t solve the issue when I DID edit the file, and want a quick check to see what I’ve edited.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [December 15, 2014, 11:50am UTC](https://forum.ansible.com/t/git-diff-vault-files/16999/5 "2014-12-15T11:50:35Z")

</div>

“But doesn’t solve the issue when I DID edit the file, and want a quick check to see what I’ve edited.”

I suspect that feature is not going to be a thing, as it would require comparing the unencrypted versions in memory.

If the implementation is small, we might consider it.