chezmoi keeps desired state separate from the home directory
chezmoi stores a source representation of managed files under ~/.local/share/chezmoi. The home directory remains the destination. chezmoi add brings a file into source state, chezmoi diff shows what would change, and chezmoi apply makes the destination match. This extra layer is why it can do more than a directory of symlinks. It is also the concept new users must understand before an edit lands where they expect.
commit e570ee6 was a 1,015-file checkout with about 48,435 lines of source and a 5.3 MB footprint before installation. The project is primarily Go, ships as a single binary, and documents package-manager or prebuilt downloads for Linux, macOS, Windows, FreeBSD, OpenBSD, Termux, and more. A new machine can initialize and apply a hosted dotfiles repository in one command, though reviewing the diff first is the safer habit.
Go templates make one repository behave differently per machine
Files ending in .tmpl use Go's text/template syntax plus helper functions. The template data includes operating system, hostname, user configuration, environment variables, files, and password-manager results. That is enough to choose different settings for work and personal machines or render platform-specific paths. Shared templates can reduce repetition. Debugging them still feels like programming, especially once conditionals, data files, and source-name attributes interact.
The source format encodes behavior in names and special files. Attributes can make entries private, executable, encrypted, exact, or removable. External definitions can download files, archives, or Git repositories, verify checksums, and apply include or exclude patterns. The measured checkout's 48,435 source lines hint at how much behavior sits behind the friendly quick start. Someone managing only .vimrc and .gitconfig may be happier with yadm, Dotbot, or plain Git.
What happened when we ran it
We cloned commit e570ee6 and followed the workflow our sandbox detected as Python. Installation succeeded in 19 seconds, adding 34 packages and occupying 38 MB. The available build completed in 1 second. No test script or target was present for that detected workflow, so the lab skipped tests. Pip-audit found 0 known vulnerabilities in the Python packages installed during the run.
That result needs a boundary because GitHub identifies chezmoi's primary language as Go. The measured workflow passed its build, but the lab block does not say that it compiled or tested the Go CLI. It provides no Go test count. Our scan found 7 CI workflow files, no Dockerfile, and no tests directory. The missing directory does not prove an absence of Go tests, which are often kept beside package code.
The install and 1-second build show that the detected repository path was light enough for a fresh 3-CPU, 8 GB container. They do not measure applying a real dotfiles repository, calling a password manager, fetching external archives, or running user scripts. Those operations depend on the user's configuration and network. A trial should use a temporary home directory and -n -v before touching a daily account.
Prebuilt binaries avoid the repository's Python and Go toolchains
Most users do not need the source checkout. The installation guide lists native package commands, release archives, and an official shell installer. Source builds require Go 1.25 or later. Releases include signed checksum files and a documented cosign verification path, which is preferable when the binary will later rewrite shell, editor, SSH, or Git configuration. People who dislike piping a downloaded script into a shell can use their package manager or verify a release archive.
A hosted Git repository is the usual transport across machines. Public repositories need no login for cloning. Private repositories rely on SSH or credentials handled by local Git; chezmoi says it does not store those credentials. The 19-second lab install did not authenticate to a remote or exercise private repository setup. Automatic add, commit, and push can be enabled, but keeping those operations explicit is easier to reason about while learning.
Password managers keep raw secrets out of the source repository
Template functions can retrieve values from tools such as 1Password, Bitwarden, KeePassXC, and cloud secret stores when a destination file is rendered. Whole-file encryption is another option. This makes a public dotfiles repository possible without publishing the final token value. It does not make secret handling automatic: the relevant client must be installed, authenticated, and available on every machine where apply needs that value.
Pip-audit found 0 known vulnerabilities among the 34 Python packages in our run, but that result does not assess a user's password-manager client, downloaded externals, or scripts. External entries can pin SHA256, SHA384, or SHA512 checksums, and users should do so for fixed artifacts. A dotfiles repository can execute setup logic with the account's permissions. Reading someone else's repository before init --apply is basic self-defense.
Deletions and renames are not automatic two-way sync
Open issue 4361 describes the recurring gap plainly: chezmoi cannot automatically infer that a home-directory deletion or rename should be synchronized across source and other machines. Existing commands and remove_ attributes provide the pieces, but the reported workflows require explicit forget, destroy, remove, rename, or add steps. Users coming from Dropbox-style synchronization must adjust their mental model. Source state is authoritative when apply runs.
There are narrower platform edges too. Issue 4935 reports KeePassXC YubiKey challenge-response working on Linux but returning unsupported on Windows. Issue 5133 reports a missing PowerShell native-completion parameter. GitHub showed 58 open issues and pull requests when fetched, with a last push on September 7, 2026. Release 2.72.1 arrived August 30, so the current issue activity sits beside a current release rather than a dormant tag.
The project rejects every LLM-assisted contribution
The contribution guide says using ChatGPT, Claude, Gemini, Copilot, Llama, or another LLM for any contribution leads to an immediate ban without recourse. That policy does not affect ordinary use of the binary, but it directly affects who can submit documentation, tests, or code. Teams that require AI-assisted development should treat chezmoi as an upstream dependency they consume, not a project to which their normal workflow can contribute.