org-mode allows users to encrypt the contents under a headline by adding the crypt tag with C-c C-q crypt and then calling M-x org-encrypt-entry.

Below is an example using this feature:

* Headline                  :crypt:


I would like to prevent users from saving the file and committing changes to a git repository if the content under a headline should be encrypted but is not.

The goal is to prevent unintentional leaks to local file system and stop unencrypted text from being added to the git repository.

How to detect programmatically if content under org-mode headline is not encrypted before a save or commit?

I'm looking for an answer that could be called from the command-line for use in a on commit hook.

Thank you of your help!

emacs version: 24.3 or greater
org mode version: 9.1.2 or greater
git version: 2.12.3 or greater
gpg version: 1.4.21 or greater


From the commentary at the beginning of org-crypt.el:

;; 4. To automatically encrypt all necessary entries when saving a
;;    file, call `org-crypt-use-before-save-magic' after loading
;;    org-crypt.el.

So add to your init.el something like:

(with-eval-after-load 'org
  (require 'org-crypt)
  (add-hook 'before-save-hook #'org-crypt-use-before-save-magic))

Encrypting from a commit hook seems like the wrong time to do it. Perhaps your commit hook could more usefully test against the absence of -----BEGIN PGP MESSAGE----- immediately following each :crypt: tag instead.

Your Answer

