ahmza
42c805f430
result is a symlink into /nix/store that nix build rewrites on every invocation, so tracking it churns the history and pins a store path that means nothing on any other machine. it was committed pointing at a t480 system while sitting on shadow. the two git-secret lines are what `git secret init` writes. worth being explicit about what they do and do not cover: `!*.secret` un-ignores the *encrypted* blobs only. nothing here protects the plaintext originals - that relies entirely on `git secret add` appending each plaintext path to this file, so always run it from the repo root rather than hand-editing .gitsecret/paths/mapping.cfg. .gitsecret/keys is git-secret's gpg homedir. pubring.kbx is meant to be committed, but a stray `gpg --homedir .gitsecret/keys --import` of a private key would drop private-keys-v1.d/ in there, so those paths are ignored up front rather than after the fact.