Open source · MIT License · Rust 2024 Edition

Version control
you fully own

Every repository is a single encrypted file you can store on any cloud, NAS, or USB drive. Use encrypted single-file repositories through a native desktop app, the browser UI, or the CLI. The desktop app includes its local service and is ready after installation.

Download Desktop App Install the CLI
CLI install
$ curl -fsSL https://raw.githubusercontent.com/Olib-AI/ovc/main/scripts/install.sh | bash

Windows: irm https://raw.githubusercontent.com/Olib-AI/ovc/main/scripts/install.ps1 | iex  ·  Build from source

Desktop App

Install OVC and start working

The native app includes the OVC service and complete interface. No CLI, daemon, or manual server setup is required.

macOS
Signed and notarized DMG
Choose the build for Apple Silicon or Intel Macs.
Apple Silicon Intel
Windows
64-bit MSI installer
Install OVC from the standard Windows installer.
Download MSI
Linux
DEB or portable AppImage
Install the Debian package or run the portable application.
Download DEB AppImage

Prefer the terminal? The CLI remains available for local workflows, automation, and servers. View CLI setup.

3
Desktop Platforms
47
CLI Commands
26
Built-in CI Checks
200+
Tests
Features

Everything in one encrypted file

No server to manage. No SaaS dependency. One portable file per repository, encrypted with keys you control.

Encrypted at rest

XChaCha20-Poly1305 with Ed25519+X25519 key pairs. An attacker with the file sees only ciphertext.

Single portable file

Your entire repo, including code, branches, tags, and history, lives in one .ovc file you can drop anywhere.

Commit signing

Ed25519 signatures on every commit. Verified/unverified badges in CLI and web UI. No GPG needed.

Built-in CI/CD

28 built-in checks, parallel DAG execution, matrix strategy, secrets vault, Docker support. No external tools.

Git-compatible

Bidirectional import/export with full history fidelity. Same workflow you already know.

Multi-user + RBAC

Share via cloud storage with file locking, conflict detection, auto-merge. Per-user roles and branch protection.

Cloud sync

Content-defined chunking via FastCDC. Only changed parts transfer. Supports iCloud, GCS, NAS, and more.

Native desktop app

Install on macOS, Windows, or Linux. The local service and complete interface are included.

Local LLM integration

AI-powered commit messages, PR review, and diff explanation via any local model. Multi-pass pipeline handles diffs of any size.

CLI and web access

Use the same repository format from the terminal or host the embedded React UI in a browser.

Desktop and Web UI

One polished interface, available everywhere

The desktop app opens the embedded React UI in the operating system webview. Browser access remains available through the CLI server.

Staged changes and diff viewer
Staged changes with inline diff viewer
Actions CI/CD dashboard
Built-in CI/CD actions dashboard
File manager and code browser
File manager with code preview
Dependency updates dashboard
Dependency updates dashboard
How It Works

Three commands to get started

Generate a key pair, create an encrypted repository, and start committing. Same workflow as Git.

Generate your key

One Ed25519+X25519 key pair encrypts repos and signs commits. No GPG, no separate keys.

ovc key generate --name mykey \ --identity "you@email.com"

Create a repository

Initialize an encrypted .ovc file. Optionally store it on any cloud for automatic sync.

ovc init --name project.ovc \ --key mykey

Commit and collaborate

Stage, commit, branch, and merge with the familiar Git workflow, fully encrypted.

ovc add . ovc commit -m "initial commit" ovc log --oneline --graph
Security

Encryption is not optional

Every .ovc file is encrypted by default. Constant-time auth, secret zeroization, and bounded resource allocation throughout.

01

XChaCha20-Poly1305

256-bit encryption with 192-bit nonces per segment. Authenticated encryption prevents tampering.

02

Ed25519 commit signing

Every commit carries a cryptographic signature. One key pair handles both encryption and identity.

03

Argon2id key derivation

Memory-hard KDF with configurable parameters. Brute-force attacks are computationally infeasible.

04

Zero secrets in memory

All sensitive data zeroed on drop via Zeroizing wrappers. Constant-time authentication prevents timing attacks.

05

Memory-safe Rust

unsafe_code = "forbid" workspace-wide. No buffer overflows, no use-after-free, no data races.

Key Pair (Ed25519 + X25519) | |-- X25519 ECDH with ephemeral key | | | +-- HKDF-SHA256 | | | +-- Sealed Key Encryption Key | +-- Segment Encryption Key (256-bit) | +-- XChaCha20-Poly1305 | +-- Encrypted data (192-bit nonce per segment) What an attacker sees: 64 bytes header (magic, KDF params) ?????? ciphertext (everything else) 32 bytes trailer (HMAC, offsets) File names, commit messages, authors, branches, tags -- all encrypted.
Quick Start

Familiar commands, encrypted by default

If you know Git, you know OVC. Every operation works on encrypted repositories transparently. 

ovc add .                          # Stage all files
ovc commit -m "add feature X"     # Commit (auto-signed)
ovc status                         # Working tree status
ovc log --oneline --graph         # Commit history
ovc diff --staged                  # View staged changes
ovc show HEAD~2                     # Inspect a commit
ovc branch feature-x               # Create branch
ovc checkout feature-x             # Switch branch
ovc merge feature-x                # Merge into current
ovc rebase main                    # Rebase onto main
ovc cherry-pick abc123             # Cherry-pick commit
ovc stash push -m "WIP"           # Stash changes
# Add a remote backend
ovc remote add origin gs://bucket/repos --backend gcs
ovc remote add nas /mnt/nas/repos --backend local

# Push/pull: only changed chunks transfer
ovc push
ovc pull

# Or store on iCloud for auto-sync
ovc init --store ~/iCloud/ovc-repos/ --key mykey
# Auto-detect languages and generate config
ovc actions init

# Run all pre-commit checks
ovc actions run --trigger pre-commit

# Commit runs hooks automatically
ovc commit -m "checked and verified"

# 26 built-in checks: secret scan, linting,
# dead code, complexity, and more

Start owning your code

Open source. MIT licensed. Native desktop apps and a complete CLI.

View on GitHub Download Desktop Read the Docs