GnuPG encrypted file editing with Neovim

Question

Is there a way to open a GnuPG encrypted file with neovim so that one can read/edit it and on write the file is re-encrypted?

This is possible via vim-gnupg in classic vim but has not been ported to neovim. I cannot use the gpg-agent hack as I do not have X11 installed on the remote machine I wish to use this on.

Answer 1

I did a little research and it seems that the only option right now is the one mentioned by @grodzik: you need to configure gpg-agent. Quoting Thiago de Arruda (Neovim lead developer):

I'm a long time vim-gnupg user and have been using it with neovim since day 1. I never had problems because I use gpg-agent which by defaults displays a x11 prompt to get the password (the GPG_TTY warning can be safely ignored).

In the same thread the vim-pgp author has shared his progress on making the plug-in compatible with Neovim. I think it will take a while but lately he has been contributing to Neovim (in fact the last Neovim commit is authored by him) so it's just matter of time.

Answer 2

I've been using the solution from this gist with Vim for years, so when I moved to NeoVim, I translated it to Lua, and it still works:

local gpgGroup = vim.api.nvim_create_augroup('customGpg', { clear = true })

-- autocmds execute in the order in which they were defined.
-- https://neovim.io/doc/user/autocmd.html#autocmd-define

vim.api.nvim_create_autocmd({ 'BufReadPre', 'FileReadPre' }, {
    pattern = '*.gpg',
    group = gpgGroup,
    callback = function ()
        -- Make sure nothing is written to shada file while editing an encrypted file.
        vim.opt_local.shada = nil
        -- We don't want a swap file, as it writes unencrypted data to disk
        vim.opt_local.swapfile = false
        -- Switch to binary mode to read the encrypted file
        vim.opt_local.bin = true

        vim.cmd("let ch_save = &ch|set ch=2")
    end
})

vim.api.nvim_create_autocmd({ 'BufReadPost', 'FileReadPost' }, {
    pattern = '*.gpg',
    group = gpgGroup,
    callback = function ()
        vim.cmd("'[,']!gpg --decrypt 2> /dev/null")

        -- Switch to normal mode for editing
        vim.opt_local.bin = false

        vim.cmd('let &ch = ch_save|unlet ch_save')
        vim.cmd(":doautocmd BufReadPost " .. vim.fn.expand("%:r"))
    end
})

-- Convert all text to encrypted text before writing
vim.api.nvim_create_autocmd({ 'BufWritePre', 'FileWritePre' }, {
    pattern = '*.gpg',
    group = gpgGroup,
    command = "'[,']!gpg --default-recipient-self -ae 2>/dev/null",
})
-- Undo the encryption so we are back in the normal text, directly
-- after the file has been written.
vim.api.nvim_create_autocmd({ 'BufWritePost', 'FileWritePost' }, {
    pattern = '*.gpg',
    group = gpgGroup,
    command = 'u'
})

(gist)

It is far from optimal, and I'm open to suggestions for improving it!

Answer 3

I discovered some days ago that encryption functionality was removed in Neovim, it's great to have a full featured plugin like vim-gnupg but for anyone who wants to go for a minimalist solution to integrate back the encryption functionality in Neovim:

augroup gpg_files
  autocmd!
  autocmd BufReadPre,FileReadPre *.gpg setlocal shada= noswapfile noundofile nobackup
  autocmd BufRead *.gpg %!gpg -qd %
  autocmd BufWriteCmd *.gpg write !gpg --batch --yes -co %
augroup END

This configuration seems to not require any additional environment variables.

PS. Of course this is only for an exclusive use of symmetric cipher encryption, which is my use case, trying to bring back the removed :X functionality in Neovim.