Cool, thanks for pointing me towards transcrypt - I hadn't heard of it until now. You are correct: git-crypt does use the OpenSSL libraries; we do not roll our

Cool, thanks for pointing me towards transcrypt - I hadn't heard of it until now. You are correct: git-crypt does use the OpenSSL libraries; we do not roll our own crypto. I'm happy to see transcrypt didn't make the most common crypto mistake that Git crypto projects made, which is to use a block cipher in ECB mode or CBC mode with a fixed IV. That said, I don't think it's a good idea to implement this with shell scripts. While shell scripts are extremely convenient, it's very hard to write them securely. For example, in one place transcrypt leaks your passphrase as an argument to an openssl command, meaning there's an instant where another user could see it in the output of `ps`.