Skip to main content

Git Clean & Smudge Filters - Complete Reference Guide

A comprehensive guide to understanding, implementing, and mastering Git's clean/smudge filter system for automatic file transformations, including practical examples, security implementations, and advanced techniques.

Git Clean/Smudge Filters are powerful mechanisms that automatically transform file content as it moves between your working directory and Git's internal storage. Think of them as translators that ensure files have the right format in the right place. This guide covers everything from basic setup to advanced security implementations like line-by-line encryption.

Overview & Core Concepts​

What Are Git Clean/Smudge Filters?​

Git Clean/Smudge Filters are powerful mechanisms that automatically transform file content as it moves between your working directory and Git's internal storage. Think of them as translators that ensure files have the right format in the right place.

Key Benefits:

  • Automatic file transformations during Git operations
  • Keep sensitive data out of repositories while maintaining local convenience
  • Support for environment-specific configurations
  • Seamless integration with normal Git workflow
  • Transparent to daily development work

Filter Types​

Clean Filter: Runs during git add

  • Transforms files FROM working directory TO Git storage
  • "Cleans" files for repository storage
  • Examples: Remove secrets, convert line endings, compress data, encrypt content

Smudge Filter: Runs during git checkout

  • Transforms files FROM Git storage TO working directory
  • "Smudges" files for local use
  • Examples: Inject secrets, expand templates, decompress data, decrypt content

When Filters Execute​

Clean Filter Triggers:

  • git add <file>
  • git commit -a
  • Any operation that stages file content

Smudge Filter Triggers:

  • git checkout <branch>
  • git switch <branch>
  • git reset --hard
  • git clone (initial checkout)
  • Any operation that updates working directory files

How Clean/Smudge Filters Work​

The Transformation Flow​

This diagram illustrates how Git clean and smudge filters transform files bidirectionally during repository operations:

Working Directory (local format) ←→ Repository (storage format)
                ↑                                    ↑
         smudge filter                      clean filter
    (decrypt/expand/localize)        (encrypt/compress/sanitize)

Process Flow​

  1. On git add: Clean filter processes file content before storing in Git's index
  2. On git commit: Cleaned content is stored in the repository
  3. On git checkout: Smudge filter processes stored content before writing to working directory
  4. Result: Working directory contains "smudged" files, repository contains "cleaned" files

Basic Setup Pattern​

Every clean/smudge filter implementation follows this three-step pattern:

Step 1: Configure the Filter Driver​

Add filter configuration to .git/config (local) or ~/.gitconfig (global):

This configuration defines the commands that Git will execute during clean and smudge operations:

[filter "myfilter"]
    clean = command-to-clean-files
    smudge = command-to-smudge-files
    required = true  # Optional: make filter mandatory

Step 2: Apply Filter to File Patterns​

Create or edit .gitattributes in your repository root:

This file specifies which files should be processed by your filter using glob patterns:

# Apply myfilter to all .txt files
*.txt filter=myfilter

# Apply to specific files
config.json filter=myfilter

# Apply to files in specific directories
src/*.conf filter=myfilter

# Apply to multiple file types
*.py filter=myfilter
*.js filter=myfilter
*.secret filter=myfilter

Step 3: Test the Implementation​

These commands verify that your filters are working correctly before committing any changes:

# Test clean filter
echo "test content" | your-clean-command

# Test smudge filter  
echo "cleaned content" | your-smudge-command

# Force re-checkout to test smudge
git checkout HEAD -- filename.txt

# Check if filters are applied
git check-attr --all filename.txt

Practical Examples​

Example 1: Secret Token Management​

Problem: Need to keep API tokens in config files locally but not commit them to repository.

Solution:

This filter configuration uses sed to replace sensitive API keys with placeholders during commits:

# .git/config or ~/.gitconfig
[filter "secrets"]
    clean = sed 's/api_key=.*/api_key=PLACEHOLDER/'
    smudge = sed 's/api_key=PLACEHOLDER/api_key=your-actual-token/'

The corresponding gitattributes file specifies which configuration files should use the secrets filter:

# .gitattributes
config.json filter=secrets
*.env filter=secrets

Usage:

  • Working directory: config.json contains real API key
  • Repository: config.json contains placeholder
  • Automatic conversion on git add and git checkout

Example 2: Environment-Specific Configuration​

Problem: Different database URLs for development vs production.

Solution:

This bash script dynamically handles environment-specific database configurations based on the filter operation:

#!/bin/bash
# filter-script.sh
if [ "$1" = "clean" ]; then
    sed 's/localhost:3306/DATABASE_HOST/' 
elif [ "$1" = "smudge" ]; then
    sed 's/DATABASE_HOST/localhost:3306/'
fi
# .git/config
[filter "dbconfig"]
    clean = /path/to/filter-script.sh clean
    smudge = /path/to/filter-script.sh smudge

Example 3: Tab/Space Conversion​

Problem: Team uses different indentation preferences.

Solution:

# .git/config
[filter "tabspace"]
    clean = expand -t 4    # Convert tabs to 4 spaces
    smudge = unexpand -t 4 # Convert 4 spaces to tabs
# .gitattributes
*.py filter=tabspace
*.js filter=tabspace
*.cpp filter=tabspace

Example 4: Keyword Expansion​

Problem: Need to inject build information into source files.

Solution:

#!/bin/bash
# keyword-filter.sh
if [ "$1" = "clean" ]; then
    sed 's/\$VERSION\$/$VERSION$/'
elif [ "$1" = "smudge" ]; then
    VERSION=$(git describe --tags --always)
    sed "s/\$VERSION\$/$VERSION/"
fi

Security Implementation: Line-by-Line Encryption​

Overview​

This advanced implementation provides automatic line-by-line encryption for Git repositories using Git's clean/smudge filter mechanism. This approach keeps files decrypted locally while storing encrypted versions in the remote repository.

Key Security Benefits:

  • Files remain decrypted in your working directory for development
  • Encrypted versions are automatically stored in the repository
  • Line-by-line encryption minimizes diff changes
  • Transparent encryption/decryption during Git operations
  • Private code storage in public repositories

Implementation​

Step 1: Create the Encryption Script​

Enhanced Git Line Encryption Tool with advanced features:

Key Features:

  • Binary detection (auto pass-through)
  • Comprehensive error handling
  • Dependency checking with graceful fallback
  • Bulk processing for large files (>10KB)
  • Multiple key version support (key rotation)
  • AES-256-GCM encryption with deterministic nonces
  • Performance optimizations

Usage:

# Setup filters
git config filter.hum_gitline.clean 'python3 /path/to/hum_gitline.py'
git config filter.hum_gitline.smudge 'python3 /path/to/hum_gitline.py decrypt'
git config filter.hum_gitline.required true

# Key management
python3 hum_gitline.py add-key     # Add new key
python3 hum_gitline.py list-keys   # List all keys

Core Implementation (Simplified Prototype):

#!/usr/bin/env python3
"""Simplified prototype showing core encryption logic"""
import sys, os, json, base64, hashlib, time
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

class GitLineEncryption:
    def __init__(self):
        self.config_file = os.path.expanduser('~/.hum_gitline_config')
        self.key_id, self.key = self._get_key()
        self.large_file_threshold = 10000  # bytes
    
    def _get_key(self):
        """Load or generate encryption key with versioning"""
        config = self._load_config()
        current_key_id = config.get('current_key_id', f'v{int(time.time())}')
        
        if current_key_id in config.get('keys', {}):
            key_data = config['keys'][current_key_id]
            return current_key_id, base64.b64decode(key_data['key'])
        
        # Generate new 256-bit AES key
        key = os.urandom(32)
        config.setdefault('keys', {})[current_key_id] = {
            'key': base64.b64encode(key).decode(),
            'created': time.time()
        }
        config['current_key_id'] = current_key_id
        self._save_config(config)
        return current_key_id, key
    
    def encrypt_stream(self):
        """Main encryption entry point"""
        content = sys.stdin.read()
        
        # Binary detection
        if b'\0' in content.encode()[:1024]:
            sys.stdout.write(content)  # Pass through
            return
        
        # Bulk processing for large files
        if len(content.encode()) > self.large_file_threshold:
            encrypted = self._encrypt_data(content)
            sys.stdout.write(f"BULK_DATA:{encrypted}")
        else:
            # Line-by-line encryption
            for line in content.splitlines(keepends=True):
                if line.strip():
                    encrypted = self._encrypt_data(line.rstrip('\n'))
                    sys.stdout.write(f"DATA:{encrypted}\n")
                else:
                    sys.stdout.write(line)
    
    def decrypt_stream(self):
        """Main decryption entry point"""
        content = sys.stdin.read()
        
        if content.startswith('BULK_DATA:'):
            decrypted = self._decrypt_data(content[10:])
            sys.stdout.write(decrypted.decode())
        else:
            for line in content.splitlines(keepends=True):
                if line.startswith('DATA:'):
                    decrypted = self._decrypt_data(line[5:].rstrip('\n'))
                    sys.stdout.write(f"{decrypted.decode()}\n")
                else:
                    sys.stdout.write(line)
    
    def _encrypt_data(self, data):
        """AES-256-GCM encryption with deterministic nonce"""
        # ... implementation details in full script ...
        pass
    
    def _decrypt_data(self, encrypted_data):
        """AES-256-GCM decryption with key version support"""
        # ... implementation details in full script ...
        pass
    
    # ... additional methods for config management, key rotation, etc ...

def main():
    encryptor = GitLineEncryption()
    if len(sys.argv) > 1 and sys.argv[1] == 'decrypt':
        encryptor.decrypt_stream()
    else:
        encryptor.encrypt_stream()

if __name__ == "__main__":
    main()

Step 2: Install Dependencies and Make Executable​

# Install required Python package
pip install cryptography

# Make script executable (Linux/macOS)
chmod +x hum_gitline.py

# Move to a directory in your PATH, or use full path in git config
sudo mv hum_gitline.py /usr/local/bin/
# OR keep locally and reference full path in git config

Step 3: Configure Git Filters​

Run these commands in your repository (one time setup per repo):

# Set up the clean filter (encrypts when staging/pushing)
git config filter.hum_gitline.clean 'python3 /path/to/hum_gitline.py'

# Set up the smudge filter (decrypts when checking out/pulling)
git config filter.hum_gitline.smudge 'python3 /path/to/hum_gitline.py decrypt'

# Make it required (optional, prevents accidental unencrypted commits)
git config filter.hum_gitline.required true

# Verify configuration
git config --list | grep filter.hum_gitline

Step 4: Configure File Patterns​

Create or edit .gitattributes to specify which files should be encrypted:

# Source code files
*.py filter=hum_gitline
*.js filter=hum_gitline
*.cpp filter=hum_gitline
*.java filter=hum_gitline
*.go filter=hum_gitline

# Configuration files
*.conf filter=hum_gitline
*.ini filter=hum_gitline
config/*.json filter=hum_gitline

# Secret files
*.secret filter=hum_gitline
*.key filter=hum_gitline
.env.* filter=hum_gitline

# Specific sensitive directories
private/* filter=hum_gitline
secrets/* filter=hum_gitline

Commit the .gitattributes file:

git add .gitattributes
git commit -m "Add encryption filters configuration"

Initial Setup Process for Existing Repositories​

When working with repositories that already contain encrypted files, follow this specific setup sequence:

Step 1: Clone Repository First​

git clone <repository-url>
cd <repository-name>

Note: Files will remain encrypted at this point since no filters are configured yet.

Step 2: Configure Clean/Smudge Filters​

# Set up encryption (clean) and decryption (smudge) commands
git config filter.hum_git_line.clean 'python3 /path/to/encrypt.py'
git config filter.hum_git_line.smudge 'python3 /path/to/encrypt.py decrypt'

# Alternative with direct OpenSSL commands (less secure)
git config filter.encrypt.clean 'openssl enc -aes-256-cbc -salt -k mypassword'
git config filter.encrypt.smudge 'openssl enc -d -aes-256-cbc -k mypassword'

Step 3: Force Filter Application to Decrypt Files​

# Method 1: Remove from index and re-checkout
git rm --cached -r .
git reset --hard HEAD

# Method 2: Alternative approach
git stash
git checkout HEAD -- .
git stash pop

# Method 3: For specific files only
git checkout HEAD -- <specific-encrypted-files>

Step 4: Verify Setup​

# Check if files are now readable
file <previously-encrypted-file>
head <previously-encrypted-file>

# Verify filter configuration
git config --list | grep filter

Deterministic Encryption Implementation​

The Problem with Non-Deterministic Encryption​

Standard encryption libraries like Fernet produce different output each time, even for identical input. This causes Git to always see files as modified, leading to:

  • Files showing as "modified" immediately after checkout
  • Inability to switch branches due to "uncommitted changes"
  • Merge conflicts in seemingly unchanged files
  • Constant noise in git status output

Solution: Content-Based Deterministic Encryption​

import sys
import os
import hashlib
import base64
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes

class GitLineEncryption:
    def __init__(self):
        self.key_file = os.path.expanduser('~/.git-line-encrypt-key')
        self.base_key = self._get_base_key()
    
    def _get_base_key(self):
        if os.path.exists(self.key_file):
            with open(self.key_file, 'rb') as f:
                return f.read()
        else:
            key = Fernet.generate_key()
            with open(self.key_file, 'wb') as f:
                f.write(key)
            os.chmod(self.key_file, 0o600)
            return key
    
    def _get_deterministic_key(self, content):
        """Generate deterministic key based on content"""
        # Use content hash as salt for deterministic results
        salt = hashlib.sha256(content.encode()).digest()[:16]
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256,
            length=32,
            salt=salt,
            iterations=100000,
        )
        derived_key = base64.urlsafe_b64encode(kdf.derive(self.base_key))
        return derived_key
    
    def encrypt_line_deterministic(self, content):
        """Deterministic encryption - same input = same output"""
        det_key = self._get_deterministic_key(content)
        fernet = Fernet(det_key)
        return fernet.encrypt(content.encode()).decode()
    
    def encrypt_stream(self):
        """Read from stdin, encrypt line by line, write to stdout"""
        try:
            for line in sys.stdin:
                if line.strip():  # Don't encrypt empty lines
                    encrypted = self.encrypt_line_deterministic(line.rstrip('\n'))
                    sys.stdout.write(f"ENC:{encrypted}\n")
                else:
                    sys.stdout.write(line)
        except Exception as e:
            sys.stderr.write(f"Encryption failed: {e}\n")
            # Pass through unchanged as fallback
            for line in sys.stdin:
                sys.stdout.write(line)
            sys.exit(0)

def main():
    encryptor = GitLineEncryption()
    
    if len(sys.argv) > 1 and sys.argv[1] == 'decrypt':
        encryptor.decrypt_stream()
    else:
        encryptor.encrypt_stream()

if __name__ == "__main__":
    main()

Common Issues and Solutions​

1. Files Show as Modified After Filter Setup​

Cause: Non-deterministic encryption produces different output each time.

Solution: Use deterministic encryption (see implementation above) or accept the limitation:

# Workaround: Skip worktree for affected files
git update-index --skip-worktree <files>

# Or force ignore changes
git update-index --assume-unchanged <files>

2. Cannot Switch Branches Due to "Modified" Files​

Problem:

error: Your local changes to the following files would be overwritten by checkout:
Please commit your changes or stash them before you switch branches.

Solutions:

# Option 1: Force checkout (loses local changes)
git checkout -f origin/main
git branch -D main
git checkout -b main

# Option 2: Temporarily disable filters
mv .gitattributes .gitattributes.bak
git checkout origin/main
git branch -D main
git checkout -b main
mv .gitattributes.bak .gitattributes

# Option 3: Skip worktree for problematic files
git update-index --skip-worktree <problematic-files>
git checkout origin/main

3. Merge Conflicts Show Encrypted Content​

Solution:

# Disable filters during merge
mv .gitattributes .gitattributes.bak
git merge <branch>
# Resolve conflicts manually
mv .gitattributes.bak .gitattributes
git add . && git commit

# Or configure textconv for readable diffs
git config diff.encrypted.textconv 'python3 /path/to/encrypt.py decrypt'

Production Gotchas and Workarounds​

1. Team Onboarding​

Problem: New team members don't have filters configured.

Solution: Create setup script:

#!/bin/bash
# setup-filters.sh
git config filter.hum_git_line.clean 'python3 scripts/encrypt.py'
git config filter.hum_git_line.smudge 'python3 scripts/encrypt.py decrypt'
git checkout HEAD -- .
echo "Filters configured successfully!"

2. Filter Script Dependencies​

Problem: Missing Python packages break Git operations.

Solution: Add dependency checks:

try:
    from cryptography.fernet import Fernet
except ImportError:
    # Fallback: pass through unchanged
    import sys
    for line in sys.stdin:
        sys.stdout.write(line)
    sys.exit(0)

3. Binary Files Get Corrupted​

Problem: Filters run on all files, corrupting binaries.

Solution: Be specific in .gitattributes:

# Good: Specific file types
*.txt filter=hum_git_line
*.py filter=hum_git_line
*.md filter=hum_git_line

# Bad: All files
# * filter=hum_git_line

4. CI/CD Pipeline Issues​

Problem: Build servers don't have encryption keys.

Solution: Configure in CI pipeline:

# .github/workflows/ci.yml
- name: Setup encryption key
  run: echo "${{ secrets.GIT_ENCRYPT_KEY }}" > ~/.git-line-encrypt-key

- name: Setup git filters
  run: |
    git config filter.hum_git_line.clean 'python3 scripts/encrypt.py'
    git config filter.hum_git_line.smudge 'python3 scripts/encrypt.py decrypt'
    git checkout HEAD -- .

Best Practices & Guidelines​

1. Start Simple​

Begin with basic transformations like:

  • Environment variable substitution
  • Line ending normalization
  • Simple text replacements

Before moving to complex encryption implementations.

2. Always Provide Fallback Behavior​

try:
    # Your filter logic here
    process_content()
except Exception as e:
    # Log error and pass through unchanged
    sys.stderr.write(f"Filter failed: {e}\n")
    for line in sys.stdin:
        sys.stdout.write(line)
    sys.exit(0)

3. Test Thoroughly​

  • Test round-trip operations (clean → smudge → original)
  • Test with binary files
  • Test with empty files
  • Test with large files
  • Test error conditions

4. Document Setup Process​

Create clear documentation for:

  • Initial setup steps
  • Team onboarding process
  • Troubleshooting common issues
  • Recovery procedures

5. Version Your Filter Scripts​

  • Keep filter scripts in version control
  • Tag stable versions
  • Maintain backward compatibility
  • Plan for migration between versions

Team Collaboration & Key Management​

1. Secure Key Distribution​

# Option 1: Use environment variables
export GIT_FILTER_KEY="your-encryption-key"

# Option 2: Use external key management
aws ssm get-parameter --name "/git-filters/encryption-key" --with-decryption

# Option 3: Use GPG-encrypted key files
gpg --decrypt filter-key.gpg > ~/.git-filter-key

2. Onboarding Script​

#!/bin/bash
# onboard-new-developer.sh

echo "Setting up Git filters..."

# Install dependencies
pip install cryptography

# Get encryption key from secure source
./get-encryption-key.sh

# Configure filters
git config filter.encrypt.clean 'python3 scripts/encrypt.py'
git config filter.encrypt.smudge 'python3 scripts/encrypt.py decrypt'

# Test setup
python3 scripts/test-filters.py

echo "Setup complete!"

3. Multiple Environment Support​

def get_environment_config():
    env = os.environ.get('DEPLOYMENT_ENV', 'development')
    
    config_map = {
        'development': {
            'key_source': 'local_file',
            'encryption_level': 'basic'
        },
        'staging': {
            'key_source': 'environment_var',
            'encryption_level': 'standard'
        },
        'production': {
            'key_source': 'key_management_service',
            'encryption_level': 'high'
        }
    }
    
    return config_map.get(env, config_map['development'])

Integration Examples​

GitHub Actions Integration​

name: Build with Encrypted Files

on: [push, pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    
    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    
    - name: Install dependencies
      run: pip install cryptography
    
    - name: Setup Git filters
      env:
        ENCRYPTION_KEY: ${{ secrets.GIT_FILTER_KEY }}
      run: |
        echo "$ENCRYPTION_KEY" | base64 -d > ~/.git-filter-key
        chmod 600 ~/.git-filter-key
        git config filter.encrypt.clean 'python3 scripts/encrypt.py'
        git config filter.encrypt.smudge 'python3 scripts/encrypt.py decrypt'
    
    - name: Decrypt files
      run: git checkout HEAD -- .
    
    - name: Build application
      run: |
        # Your build commands here
        npm install
        npm run build

Docker Integration​

FROM python:3.9-slim

# Install filter dependencies
RUN pip install cryptography

# Copy filter scripts
COPY scripts/filter-*.py /usr/local/bin/
RUN chmod +x /usr/local/bin/filter-*.py

# Setup filters globally
RUN git config --global filter.encrypt.clean 'python3 /usr/local/bin/filter-encrypt.py' && \
    git config --global filter.encrypt.smudge 'python3 /usr/local/bin/filter-encrypt.py decrypt'

# Runtime key setup
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]

Performance Optimization​

1. Lazy Loading​

import functools

class FilterProcessor:
    @functools.lru_cache(maxsize=1)
    def get_crypto_instance(self):
        # Expensive initialization done once
        return CryptoProcessor(self.get_key())
    
    @functools.lru_cache(maxsize=100)
    def process_content_cached(self, content_hash, content):
        return self.expensive_processing(content)

2. Parallel Processing​

import concurrent.futures

def process_large_file(content):
    lines = content.splitlines()
    
    if len(lines) > 1000:
        # Process in chunks
        chunk_size = len(lines) // 4
        chunks = [lines[i:i+chunk_size] for i in range(0, len(lines), chunk_size)]
        
        with concurrent.futures.ThreadPoolExecutor(max_workers=4) as executor:
            results = list(executor.map(process_chunk, chunks))
        
        return '\n'.join(results)
    else:
        return process_sequential(content)

3. Content-Based Optimization​

def smart_processing(content):
    # Skip processing for certain file types
    if content.startswith(b'\x89PNG') or content.startswith(b'\xFF\xD8\xFF'):
        return content  # Pass through images
    
    # Different processing for different content types
    if len(content) < 1024:
        return process_small_file(content)
    elif content.count(b'\n') > 10000:
        return process_bulk(content)
    else:
        return process_line_by_line(content)

Filter Compatibility Matrix​

Git Version Compatibility​

Git VersionClean/Smudge SupportAdvanced FeaturesNotes
1.6.0+✅ Basic❌Initial implementation
1.7.0+✅ Full❌Stable implementation
2.0.0+✅ Full✅ Required attrProduction ready
2.5.0+✅ Full✅ Process filtersModern features

Platform Compatibility​

PlatformBash ScriptsPython ScriptsPowerShellNotes
Linux✅ Native✅ Native✅ OptionalFull support
macOS✅ Native✅ Native✅ OptionalFull support
Windows✅ WSL/Git Bash✅ Native✅ NativePath escaping required

CI/CD Integration Status​

PlatformSupport LevelSetup ComplexityNotes
GitHub Actions✅ FullLowNative support
GitLab CI✅ FullMediumContainer setup
Jenkins✅ FullHighPlugin dependencies
Azure DevOps✅ PartialMediumLimited examples

Resources​

Official Documentation​

Community Resources​

Tutorials and Guides​

Security and Encryption Resources​

Advanced Implementation Resources​

Tools and Libraries​

Conclusion​

Git Clean/Smudge Filters are powerful tools for automatic file transformations, but they require careful implementation and thorough testing. The key to success is:

  1. Start Simple: Begin with basic transformations before attempting complex encryption
  2. Test Thoroughly: Use the provided testing framework to validate filter behavior
  3. Handle Errors Gracefully: Always provide fallback behavior for failed transformations
  4. Document Everything: Ensure team members understand the setup and recovery procedures
  5. Plan for Scale: Consider performance implications for large repositories

Remember that filters are a double-edged sword - they provide powerful automation but can also introduce complexity and potential points of failure. Use them judiciously and always maintain comprehensive documentation and recovery procedures.

The examples and patterns provided in this guide represent battle-tested approaches used in production environments. Adapt them to your specific needs, but always prioritize reliability and maintainability over cleverness.

This guide represents a comprehensive collection of Git Clean/Smudge Filter knowledge from real-world implementations. For updates and additional examples, contribute to the knowledge base.