Add AUTHORS file

* Correctly check for existence of HEAD (use 'git rev-parse' instead
    of 'git show-ref').  Fixes bug where hard reset might be skipped
    after running 'git init'.
  * Don't require working directory to be clean if HEAD doesn't exist.
    (If HEAD doesn't exist, we won't be hard resetting so the working
    directory doesn't need to be clean.)
  * Overwrite existing git config values (instead of --add'ing them) so
    'git-crypt init' can be idempotent.
  * In the error message for a disrty working directory, advise user to
    commit changes or 'git stash' them.

AUTHORS

@@ -0,0 +1 @@
+Andrew Ayer <agwa@andrewayer.name>

Makefile

@@ -1,6 +1,7 @@
-CXX := g++
+CXX := c++
 CXXFLAGS := -Wall -pedantic -ansi -Wno-long-long -O2
 LDFLAGS := -lcrypto
+PREFIX := /usr/local
 
 OBJFILES = git-crypt.o commands.o crypto.o util.o
 
@@ -12,4 +13,7 @@ git-crypt: $(OBJFILES)
 clean:
 	rm -f *.o git-crypt
 
-.PHONY: all clean
+install:
+	install -m 755 git-crypt $(PREFIX)/bin/
+
+.PHONY: all clean install

README

@@ -11,7 +11,7 @@ repository as your code, without requiring you to lock down your entire
 repository.
 
 git-crypt was written by Andrew Ayer <agwa at andrewayer dot name>.
-For more information, see <http://www.andrewayer.name/projects/git-crypt>.
+For more information, see <http://www.agwa.name/projects/git-crypt>.
 
 
 BUILDING GIT-CRYPT
@@ -49,8 +49,8 @@ Configure a repository to use encryption:
 
 Specify files to encrypt by creating a .gitattributes file:
 
-	secretfile: filter=git-crypt diff=git-crypt
+	secretfile filter=git-crypt diff=git-crypt
-	*.key: filter=git-crypt diff=git-crypt
+	*.key filter=git-crypt diff=git-crypt
 
 Like a .gitignore file, it can match wildcards and should be checked
 into the repository.  Make sure you don't accidentally encrypt the

commands.cpp

@@ -22,6 +22,7 @@
 #include "util.hpp"
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <unistd.h>
 #include <stdint.h>
 #include <algorithm>
 #include <string>
@@ -179,6 +180,9 @@ void init (const char* argv0, const char* keyfile)
 		perror(keyfile);
 		std::exit(1);
 	}
+	
+	// 0. Check to see if HEAD exists.  See below why we do this.
+	bool		head_exists = system("git rev-parse HEAD >/dev/null 2>/dev/null") == 0;
 
 	// 1. Make sure working directory is clean
 	int		status;
@@ -187,8 +191,12 @@ void init (const char* argv0, const char* keyfile)
 	if (status != 0) {
 		std::clog << "git status failed - is this a git repository?\n";
 		std::exit(1);
-	} else if (!status_output.empty()) {
+	} else if (!status_output.empty() && head_exists) {
+		// We only care that the working directory is dirty if HEAD exists.
+		// If HEAD doesn't exist, we won't be resetting to it (see below) so
+		// it doesn't matter that the working directory is dirty.
 		std::clog << "Working directory not clean.\n";
+		std::clog << "Please commit your changes or 'git stash' them before setting up git-crypt.\n";
 		std::exit(1);
 	}
 
@@ -198,8 +206,8 @@ void init (const char* argv0, const char* keyfile)
 
 	// 2. Add config options to git
 
-	// git config --add filter.git-crypt.smudge "git-crypt smudge /path/to/key"
+	// git config filter.git-crypt.smudge "git-crypt smudge /path/to/key"
-	std::string	command("git config --add filter.git-crypt.smudge \"");
+	std::string	command("git config filter.git-crypt.smudge \"");
 	command += git_crypt_path;
 	command += " smudge ";
 	command += keyfile_path;
@@ -210,8 +218,8 @@ void init (const char* argv0, const char* keyfile)
 		std::exit(1);
 	}
 
-	// git config --add filter.git-crypt.clean "git-crypt clean /path/to/key"
+	// git config filter.git-crypt.clean "git-crypt clean /path/to/key"
-	command = "git config --add filter.git-crypt.clean \"";
+	command = "git config filter.git-crypt.clean \"";
 	command += git_crypt_path;
 	command += " clean ";
 	command += keyfile_path;
@@ -222,8 +230,8 @@ void init (const char* argv0, const char* keyfile)
 		std::exit(1);
 	}
 
-	// git config --add diff.git-crypt.textconv "git-crypt diff /path/to/key"
+	// git config diff.git-crypt.textconv "git-crypt diff /path/to/key"
-	command = "git config --add diff.git-crypt.textconv \"";
+	command = "git config diff.git-crypt.textconv \"";
 	command += git_crypt_path;
 	command += " diff ";
 	command += keyfile_path;
@@ -239,7 +247,7 @@ void init (const char* argv0, const char* keyfile)
 	//    will now be checked out decrypted.
 	// If HEAD doesn't exist (perhaps because this repo doesn't have any files yet)
 	// just skip the reset.
-	if (system("! git show-ref HEAD > /dev/null || git reset --hard HEAD") != 0) {
+	if (head_exists && system("git reset --hard HEAD") != 0) {
 		std::clog << "git reset --hard failed\n";
 		std::exit(1);
 	}
@@ -247,12 +255,13 @@ void init (const char* argv0, const char* keyfile)
 
 void keygen (const char* keyfile)
 {
-	umask(0077); // make sure key file is protected
+	mode_t		old_umask = umask(0077); // make sure key file is protected
 	std::ofstream	keyout(keyfile);
 	if (!keyout) {
 		perror(keyfile);
 		std::exit(1);
 	}
+	umask(old_umask);
 	std::ifstream	randin("/dev/random");
 	if (!randin) {
 		perror("/dev/random");

crypto.cpp

@@ -27,7 +27,7 @@
 #include <iostream>
 #include <cstring>
 #include <cstdlib>
-#include <endian.h>
+#include <arpa/inet.h>
 
 void load_keys (const char* filepath, keys_t* keys)
 {
@@ -71,7 +71,7 @@ void aes_ctr_state::process (const AES_KEY* key, const uint8_t* in, uint8_t* out
 			//  first 12 bytes - nonce
 			//  last   4 bytes - block number (sequentially increasing with each block)
 			uint8_t		ctr[16];
-			uint32_t	blockno = htole32(byte_counter / 16);
+			uint32_t	blockno = htonl(byte_counter / 16);
 			memcpy(ctr, nonce, 12);
 			memcpy(ctr + 12, &blockno, 4);
 			AES_encrypt(ctr, otp, key);

util.cpp

@@ -24,6 +24,7 @@
 #include <cstdlib>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <sys/stat.h>
 #include <unistd.h>
 #include <errno.h>
 #include <fstream>
@@ -82,11 +83,13 @@ void	open_tempfile (std::fstream& file, std::ios_base::openmode mode)
 	char*		path = new char[tmpdir_len + 18];
 	strcpy(path, tmpdir);
 	strcpy(path + tmpdir_len, "/git-crypt.XXXXXX");
+	mode_t		old_umask = umask(0077);
 	int		fd = mkstemp(path);
 	if (fd == -1) {
 		perror("mkstemp");
 		std::exit(9);
 	}
+	umask(old_umask);
 	file.open(path, mode);
 	if (!file.is_open()) {
 		perror("open");