you pretty much nailed it. this treats aws as an untrusted provider. i version almost everything with git, and there are three buckets something might go in: -

you pretty much nailed it. this treats aws as an untrusted provider. i version almost everything with git, and there are three buckets something might go in: - if it's public, it's on github. - if it's a private company project, it probably already has a home, on github or some other trusted commercial provider with cicd and all the trimmings. - everything else goes here, as encrypted git bundles on s3. i previously used git-remote-gcrypt for a long time. recently i've been thinking about how i wish worked with git, cicd, and infra. this is how i'm going to be working with that third bucket from now on. the first bucket is fine, aside from lock of sha256 support. the second bucket i'm still thinking about.